https://bz.apache.org/bugzilla/show_bug.cgi?id=69135
Bug ID: 69135
Summary: Tag files doing relative file include does not works
in case tag is in jar
Product: Tomcat 9
Version: 9.0.x
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P2
Component: Jasper
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: -----
Tag files that are in jar package and using include like:
<%@ include file="/META-INF/include.jspf"%>
Works correctly
But tag files that are in jar package and using relative path file include
like:
<%@ include file="../include.jspf"%>
Doesn't works correctly.
Jasper compilation complains about file not found.
After some debugging in Jasper, it seem's that the JspUtil.getInputStream is
having the logic between in jar/not in jar:
if (jar != null) {
String jarEntryName = fname.substring(1);
in = jar.getInputStream(jarEntryName);
} else {
in = ctxt.getResourceAsStream(fname);
}
fname is built previously by ParserController.resolveFileName(String
inFileName)
But in case of relative inFileName, like: ../include.jspf
The output if the ParserController.resolveFileName(String inFileName) will be:
/META-INF/../include.jspf
It's a valid path, but when using this path on a Jar/ZipEntry it's not able to
find the entry.
May be the path need to be resolved first before looking for the entry in the
jar ? Something like:
Paths.get(fname).normalize().toString();
I'm sorry I was not able to find a fix in the code, also I did my tests on
Tomcat 9, but it look likes the code is similar in more recent versions.
But I did implemented unit tests to reproduce easily:
- one unit test of an absolute file include from a tag in a jar that works
- one unit test of a relative file include from a tag in a jar that fails
Here is the commit from my fork:
https://github.com/jkevan/tomcat/commit/eeda51262c4bbdc9e46b30f52ef7b7862a0e0b84
(didn't open a Pull request since I don't have a fix)
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
