Spark: Error with static files in version 2.5.2

[giflw]

Hi

I was using v2.5.0, but static files content-type header was missing (v2.5.1 has the same issue).

Then I switched to 2.5.2, but my static files wasn't loading, and I get traversal directory warning from StaticFilesConfiguration.

[perwendel]

That sucks! What OS are you using? I verified functionality in Windows and Linux. All information you provide is helpful!

[giflw]

Windows 8, Java 8 Oracle

[perwendel]

Is it possible to describe your use? Is it internal or external static file location? What does the path look like? What exactly is not working?

[giflw]

I'm using external files, with a folder named 'tools' and registered paths '/tools', '/tools/:id'. There are resources, like images, acessible from '/tools/1/image.pg'. The imagem is supposed to load, as there are no route matching the pattern, but I receive the traversal director warning and the imagem doesn't load.

[giflw]

I had a /* route too

[perwendel]

ok, thanks, I'll try to reproduce

[perwendel]

@giflw
I did the following test:

import static spark.Spark.get;
import static spark.Spark.staticFiles;

public class StaticResources {

    public static void main(String[] args) {

        String directoryRoot = System.getProperty("java.io.tmpdir") + "external\\";
        System.out.println(directoryRoot);

        staticFiles.externalLocation(directoryRoot);

        get("/tools", (request, response) -> "Hello Tools!");
        get("/tools/:id", (request, response) -> "Hello Tools: " + request.params(":id") + "!");
        get("/*", (request, response) -> "Hello Everyone else!");
    }
}

directoryRoot = C:\Users\AppData\Local\Temp\external\

Where I created a subfolder in the folder with path directory root name tools and a folder in that folder named 1 and a file in that folder name image.png.

http://localhost:4567/tools/1/image.png - returned the image
http://localhost:4567/tools - returned "Hello Tools!"
http://localhost:4567/tools/hammer - returned "Hello Tools: hammer!"
http://localhost:4567/tools/hammer/ish - returned "Hello Everyone else!"

Is this test analog to what didn't work for you? If so can you try this out and see if it fails?

[giflw]

This is analog to what I did, but the image wasn't returned. I'll try this code as soon as I can.

[perwendel]

Thanks

[giflw]

Hi

I tested your code, and its worked. But, when I run my app, the error persist. I was debuggin and found in spark.utils.StringUtils, line 401, the following code:

if (trimmed.startsWith("/")) {
    trimmed = trimmed.substring(1);
}

But just before it, on line 397, there is another if:

if (trimmed.endsWith("/") || trimmed.endsWith("\\")) {
       trimmed = trimmed.substring(0, trimmed.length() - 1);
}

The first one checks for / and \\, but the second one just checks for /. I don't know if this is a problem or not.

[giflw]

I made some fore tests and debugging, and I found the solution, but don't know exaclty the source.

First: I'm running on Windows, and paths commonly starts with C:\ or other letter.

Second: I registererd the external path using *nix path.

The code to make the issue arise:

import static spark.Spark.*;

public class StaticResources {

    public static void main(String[] args) {

        String directoryRoot = "/Users/USERNAME/AppData/Local/Temp/external/";

        System.out.println("Win path: " + System.getProperty("java.io.tmpdir") + "external\\");
        System.out.println("*nix like path:" + directoryRoot);

        staticFiles.externalLocation(directoryRoot);

        get("/*", (request, response) -> "Hello Everyone else!");
    }
}

The sysout:

Win path: C:\Users\USERNAME\AppData\Local\Temp\external\
*nix like path:/Users/USERNAME/AppData/Local/Temp/external/
[qtp556411854-19] WARN spark.staticfiles.StaticFilesConfiguration - external directory traversal detection for path: /tools/1/image.gif

As Java can handle *nix like paths on Windows, I always preffer that approach, as I develop sometimes on Windows (my work computer), sometimes on Linux (my personal computer), but production machines are linux (besides that, it seems more clear to me :smile:).

Just a note, all 3 paths bellow results in the same for Java File class:

• /Users/USERNAME/AppData/Local/Temp/external/
• c:/Users/USERNAME/AppData/Local/Temp/external/
• C:\Users\USERNAME\AppData\Local\Temp\external\

So, from that, I would propose to transfor all paths to Unix like to make the traversal test. Propably the first part /c: can add some more problems in the future, in the case of multipartition system. Using internally a *nix syntax can be usefull, as one always know how paths are representerd internally, independently of S.O.

[giflw]

To transform Windows paths to *nix like:

• Get the absolute Windows path, with partition letter
• Replace all \ by /
• Add a / to the beggining

After that all paths will have the same layout, but when registering an external location to Spark, this transformation needs to be done, and Spark will have to check if the S.O. is Windows to apply that.

[giflw]

Pull request: #706

[TuxGamer]

I had the same issue. My external call looked like:
Spark.staticFiles.externalLocation("./public/");
but changing it to
Spark.staticFiles.externalLocation("public/");
fixed it for me.

OS: Ubuntu 16.04,
Java: OpenJDK 1.8u111
Spark version: 2.5.2

[perwendel]

I'll have a look at the PR. Thanks

[perwendel]

Fixed