Merge pull request #1407 from fl4via/UNDERTOW-2186-master

[UNDERTOW-2186] allow WEB-INF or META-INF subdirectory access

Author: fl4via

servlet/src/main/java/io/undertow/servlet/handlers/Paths.java

@@ -35,7 +35,7 @@ private Paths() {
     static boolean isForbidden(final String path) {
         final StringTokenizer st = new StringTokenizer(path, "/\\", false);
         String subPath;
-        while (st.hasMoreTokens()) {
+        if (st.hasMoreTokens()) {
             subPath = st.nextToken();
             if (META_INF.equalsIgnoreCase(subPath) || WEB_INF.equalsIgnoreCase(subPath)) {
                 return true;

servlet/src/test/java/io/undertow/servlet/test/defaultservlet/DefaultServletTestCase.java

@@ -273,6 +273,30 @@ public void testNoAccessToMetaInfResource() throws IOException {
         }
     }
 
+    @Test
+    public void testAccessToMetaInfSubDirResource() throws IOException {
+        TestHttpClient client = new TestHttpClient();
+        try {
+            HttpGet get = new HttpGet(DefaultServer.getDefaultServerURL() + "/servletContext/foo/meta-inf/notsecret");
+            HttpResponse result = client.execute(get);
+            Assert.assertEquals(StatusCodes.OK, result.getStatusLine().getStatusCode());
+        } finally {
+            client.getConnectionManager().shutdown();
+        }
+    }
+
+    @Test
+    public void testAccessToWebInfSubDirResource() throws IOException {
+        TestHttpClient client = new TestHttpClient();
+        try {
+            HttpGet get = new HttpGet(DefaultServer.getDefaultServerURL() + "/servletContext/foo/web-inf/notsecret");
+            HttpResponse result = client.execute(get);
+            Assert.assertEquals(StatusCodes.OK, result.getStatusLine().getStatusCode());
+        } finally {
+            client.getConnectionManager().shutdown();
+        }
+    }
+
     @Test
     public void testDirectoryListing() throws IOException {
         TestHttpClient client = new TestHttpClient();

servlet/src/test/java/io/undertow/servlet/test/defaultservlet/foo/meta-inf/notsecret

@@ -0,0 +1 @@
+not confidential

servlet/src/test/java/io/undertow/servlet/test/defaultservlet/foo/web-inf/notsecret

@@ -0,0 +1 @@
+not confidential