Top Description Inners Fields Constructors Methods
org.eclipse.jetty.server

public Class AllowedResourceAliasChecker

extends AbstractLifeCycle
implements AliasCheck
Class Inheritance
All Implemented Interfaces
org.eclipse.jetty.server.AliasCheck
Known Direct Subclasses
org.eclipse.jetty.server.SymlinkAllowedResourceAliasChecker
Imports
java.io.IOException, java.nio.file.Files, .LinkOption, .Path, java.util.ArrayList, .Arrays, .List, .Objects, java.util.function.Supplier, org.eclipse.jetty.server.handler.ContextHandler, org.eclipse.jetty.util.component.AbstractLifeCycle, .LifeCycle, org.eclipse.jetty.util.resource.Resource, org.slf4j.Logger, .LoggerFactory

This will approve any alias to anything inside of the ContextHandlers resource base which is not protected by a protected target as defined by the ContextHandler protected targets at start.

Aliases approved by this may still be able to bypass SecurityConstraints, so this class would need to be extended to enforce any additional security constraints that are required.

Nested and Inner Type Summary

Modifier and TypeClass and Description
private class
AllowedResourceAliasChecker.AllowedResourceAliasCheckListener

Field Summary

Modifier and TypeField and Description
protected Path
_base

private final ContextHandler
_contextHandler

private boolean
_initialized

private final AllowedResourceAliasChecker.AllowedResourceAliasCheckListener
_listener

private final List<Path>
_protected

private final Supplier<Resource>
_resourceBaseSupplier

protected static final LinkOption[]
FOLLOW_LINKS

private static final Logger
LOG

Hides org.eclipse.jetty.util.component.AbstractLifeCycle.LOG.

protected static final LinkOption[]
NO_FOLLOW_LINKS

Inherited from org.eclipse.jetty.util.component.AbstractLifeCycle:
FAILEDSTARTEDSTARTINGSTOPPEDSTOPPING

Constructor Summary

AccessConstructor and Description
public
AllowedResourceAliasChecker(ContextHandler
the context handler to use.
contextHandler)

public
AllowedResourceAliasChecker(ContextHandler contextHandler, Resource baseResource)

public
AllowedResourceAliasChecker(ContextHandler contextHandler, Supplier<Resource> resourceBaseSupplier)

Method Summary

Modifier and TypeMethod and Description
protected boolean
check(String pathInContext, Path path)

public boolean
checkAlias(String
The path the aliased resource was created for.
pathInContext, Resource
The aliased resourced.
resource)

Implements org.eclipse.jetty.server.AliasCheck.checkAlias.

Check if an alias is allowed to be served.
protected void
doStart()

Overrides org.eclipse.jetty.util.component.AbstractLifeCycle.doStart.

Method to override to start the lifecycle
protected void
doStop()

Overrides org.eclipse.jetty.util.component.AbstractLifeCycle.doStop.

Method to override to stop the lifecycle
private void
extractBaseResourceFromContext()

protected ContextHandler
getContextHandler()

protected Path
getPath(Resource resource)

private String[]
getProtectedTargets()

private static Path
getRealPath(Path path)

protected void
initialize()

protected boolean
isAllowed(Path path)

protected boolean
isSameFile(Path path1, Path path2)

public String
toString()

Overrides org.eclipse.jetty.util.component.AbstractLifeCycle.toString.

Returns a string representation of the object.
Inherited from org.eclipse.jetty.util.component.AbstractLifeCycle:
addEventListenergetEventListenersgetStategetStateisFailedisRunningisStartedisStartingisStoppedisStoppingremoveEventListenersetEventListenersstartstop

Field Detail

_baseback to summary
protected Path _base
_contextHandlerback to summary
private final ContextHandler _contextHandler
_initializedback to summary
private boolean _initialized
_listenerback to summary
private final AllowedResourceAliasChecker.AllowedResourceAliasCheckListener _listener
_protectedback to summary
private final List<Path> _protected
_resourceBaseSupplierback to summary
private final Supplier<Resource> _resourceBaseSupplier
LOGback to summary
private static final Logger LOG

Hides org.eclipse.jetty.util.component.AbstractLifeCycle.LOG.

Constructor Detail

AllowedResourceAliasCheckerback to summary
public AllowedResourceAliasChecker(ContextHandler contextHandler)
Parameters
contextHandler:ContextHandler

the context handler to use.

AllowedResourceAliasCheckerback to summary
public AllowedResourceAliasChecker(ContextHandler contextHandler, Resource baseResource)
AllowedResourceAliasCheckerback to summary
public AllowedResourceAliasChecker(ContextHandler contextHandler, Supplier<Resource> resourceBaseSupplier)

Method Detail

checkback to summary
protected boolean check(String pathInContext, Path path)
checkAliasback to summary
public boolean checkAlias(String pathInContext, Resource resource)

Implements org.eclipse.jetty.server.AliasCheck.checkAlias.

Doc from org.eclipse.jetty.server.AliasCheck.checkAlias.

Check if an alias is allowed to be served. If any AliasCheck returns true then the alias will be allowed to be served, therefore any alias checker should take things like the ContextHandler#getProtectedTargets() and Security Constraints into consideration before allowing a return a value of true.

Parameters
pathInContext:String

The path the aliased resource was created for.

resource:Resource

The aliased resourced.

Returns:boolean

True if the resource is OK to be served.

Annotations
@Override
doStartback to summary
protected void doStart() throws Exception

Overrides org.eclipse.jetty.util.component.AbstractLifeCycle.doStart.

Doc from org.eclipse.jetty.util.component.AbstractLifeCycle.doStart.

Method to override to start the lifecycle

Annotations
@Override
Exceptions
Exception:
If there was a problem starting. Will cause a transition to FAILED state
doStopback to summary
protected void doStop() throws Exception

Overrides org.eclipse.jetty.util.component.AbstractLifeCycle.doStop.

Doc from org.eclipse.jetty.util.component.AbstractLifeCycle.doStop.

Method to override to stop the lifecycle

Annotations
@Override
Exceptions
Exception:
If there was a problem stopping. Will cause a transition to FAILED state
extractBaseResourceFromContextback to summary
private void extractBaseResourceFromContext()
getContextHandlerback to summary
protected ContextHandler getContextHandler()
getPathback to summary
protected Path getPath(Resource resource)
getProtectedTargetsback to summary
private String[] getProtectedTargets()
getRealPathback to summary
private static Path getRealPath(Path path)
initializeback to summary
protected void initialize()
isAllowedback to summary
protected boolean isAllowed(Path path)
isSameFileback to summary
protected boolean isSameFile(Path path1, Path path2)
toStringback to summary
public String toString()

Overrides org.eclipse.jetty.util.component.AbstractLifeCycle.toString.

Doc from java.lang.Object.toString.

Returns a string representation of the object.

Returns:String

a string representation of the object.

Annotations
@Override
org.eclipse.jetty.server back to summary

private Class AllowedResourceAliasChecker.AllowedResourceAliasCheckListener

extends Object
implements Listener
Class Inheritance
  • java.lang.Object
  • org.eclipse.jetty.server.AllowedResourceAliasChecker.AllowedResourceAliasCheckListener
All Implemented Interfaces
org.eclipse.jetty.util.component.LifeCycle.Listener, java.util.EventListener

Constructor Summary

AccessConstructor and Description
private
AllowedResourceAliasCheckListener()

Method Summary

Modifier and TypeMethod and Description
public void
lifeCycleStarted(LifeCycle event)

Overrides default org.eclipse.jetty.util.component.LifeCycle.Listener.lifeCycleStarted.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Constructor Detail

AllowedResourceAliasCheckListenerback to summary
private AllowedResourceAliasCheckListener()

Method Detail

lifeCycleStartedback to summary
public void lifeCycleStarted(LifeCycle event)

Overrides default org.eclipse.jetty.util.component.LifeCycle.Listener.lifeCycleStarted.

Annotations
@Override