Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

webdav testcase for special path #808

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

webdav testcase for special path #808

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
87 changes: 64 additions & 23 deletions test/org/apache/catalina/servlets/TestWebdavServlet.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,11 +18,13 @@

import java.io.File;
import java.io.FileOutputStream;
import java.io.FileWriter;
import java.io.IOException;
import java.io.StringReader;
import java.util.ArrayList;
import java.util.List;
import java.util.Map;
import java.util.UUID;

import javax.xml.parsers.SAXParserFactory;

Expand All @@ -46,46 +48,85 @@

public class TestWebdavServlet extends TomcatBaseTest {

/*
* Test attempting to access special paths (WEB-INF/META-INF) using WebdavServlet
*/
@Test
public void testGetSpecials() throws Exception {
public void testGetSpecial_allowSpecialPaths_rootdavcontext() throws Exception {
testGetSpecials(true, false);
}

@Test
public void testGetSpecial_allowSpecialPaths_nonrootdavcontext() throws Exception {
testGetSpecials(true, true);
}

@Test
public void testGetSpecial_disallowSpecialPaths_rootdavcontext() throws Exception {
testGetSpecials(false, false);
}

@Test
public void testGetSpecial_disallowSpecialPaths_nonrootdavcontext() throws Exception {
testGetSpecials(false, true);
}

/* Test attempting to access special paths (WEB-INF/META-INF) using WebdavServlet */
private void testGetSpecials(boolean allowSpecialPaths, boolean useSubpathWebdav) throws Exception {
Tomcat tomcat = getTomcatInstance();

String contextPath = "/examples";
// Create a temp webapp that can be safely written to
File tempWebapp = new File(getTemporaryDirectory(), "webdav-specialpath"+UUID.randomUUID());
Assert.assertTrue("Failed to mkdirs on "+tempWebapp.getCanonicalPath(),tempWebapp.mkdirs());
Assert.assertTrue(new File(tempWebapp,"WEB-INF").mkdir());
Assert.assertTrue(new File(tempWebapp,"META-INF").mkdir());
try (FileWriter fw = new FileWriter(new File(tempWebapp, "WEB-INF-desc.xml"))) {
fw.write("<CheckSpecial>This is not a special file</CheckSpecial>");
}
try (FileWriter fw = new FileWriter(new File(tempWebapp, "WEB-INF/web.xml"))) {
fw.write("<web>...</web>");
}
try (FileWriter fw = new FileWriter(new File(tempWebapp, "META-INF/context.xml"))) {
fw.write("<context>...</context>");
}

File appDir = new File(getBuildDirectory(), "webapps" + contextPath);
// app dir is relative to server home
Context ctx = tomcat.addWebapp(null, "/examples", appDir.getAbsolutePath());
Context ctx = tomcat.addContext("", tempWebapp.getAbsolutePath());
Wrapper webdavServlet = Tomcat.addServlet(ctx, "webdav", new WebdavServlet());

Tomcat.addServlet(ctx, "webdav", new WebdavServlet());
ctx.addServletMappingDecoded("/*", "webdav");
webdavServlet.addInitParameter("listings", "true");
webdavServlet.addInitParameter("allowSpecialPaths", allowSpecialPaths ? "true" : "false");

String contextPath="";
if (useSubpathWebdav) {
ctx.addServletMappingDecoded("/webdav/*", "webdav");
contextPath = "/webdav";
} else {
ctx.addServletMappingDecoded("/*", "webdav");
}

tomcat.start();

final ByteChunk res = new ByteChunk();

int rc =getUrl("http://localhost:" + getPort() + contextPath +
"/WEB-INF/web.xml", res, null);
Assert.assertEquals(HttpServletResponse.SC_NOT_FOUND, rc);
int rc = 0;

rc =getUrl("http://localhost:" + getPort() + contextPath +
"/WEB-INF/doesntexistanywhere", res, null);
Assert.assertEquals(HttpServletResponse.SC_NOT_FOUND, rc);
// Notice: Special paths /WEB-INF and /META-INF are protected by StandardContextValve.
// allowSpecialPaths works only when webdav re-mount to a non-root path.
rc = getUrl("http://localhost:" + getPort() + contextPath + "/WEB-INF/web.xml", res, null);
Assert.assertEquals(
useSubpathWebdav && allowSpecialPaths ? HttpServletResponse.SC_OK : HttpServletResponse.SC_NOT_FOUND,
rc);

rc =getUrl("http://localhost:" + getPort() + contextPath +
"/WEB-INF/", res, null);
rc = getUrl("http://localhost:" + getPort() + contextPath + "/WEB-INF/doesntexistanywhere", res, null);
Assert.assertEquals(HttpServletResponse.SC_NOT_FOUND, rc);

rc =getUrl("http://localhost:" + getPort() + contextPath +
"/META-INF/MANIFEST.MF", res, null);
Assert.assertEquals(HttpServletResponse.SC_NOT_FOUND, rc);
rc = getUrl("http://localhost:" + getPort() + contextPath + "/META-INF/context.xml", res, null);
Assert.assertEquals(
useSubpathWebdav && allowSpecialPaths ? HttpServletResponse.SC_OK : HttpServletResponse.SC_NOT_FOUND,
rc);

rc =getUrl("http://localhost:" + getPort() + contextPath +
"/META-INF/doesntexistanywhere", res, null);
rc = getUrl("http://localhost:" + getPort() + contextPath + "/META-INF/doesntexistanywhere", res, null);
Assert.assertEquals(HttpServletResponse.SC_NOT_FOUND, rc);

rc = getUrl("http://localhost:" + getPort() + contextPath + "/WEB-INF-desc.xml", res, null);
Assert.assertEquals(HttpServletResponse.SC_OK, rc);
}

/*
Expand Down
Loading