Merge pull request #88 from cip4/sec4

Sec4

Author: rainer-prosi

src/main/java/org/cip4/jdfutility/server/JettyServer.java

@@ -506,9 +506,9 @@ public MyResourceHandler(final String strip)
 	/**
 	 * @return
 	 */
-	protected org.cip4.jdfutility.server.MyResourceHandler createResourceHandler()
+	protected ResourceHandler createResourceHandler()
 	{
-		final org.cip4.jdfutility.server.MyResourceHandler resourceHandler = new org.cip4.jdfutility.server.MyResourceHandler(context, getHome());
+		final ResourceHandler resourceHandler = new org.cip4.jdfutility.server.MyResourceHandler(context, getHome());
 		resourceHandler.setResourceBase(".");
 		resourceHandler.setDirAllowed(false);
 		return resourceHandler;

src/main/java/org/cip4/jdfutility/server/MyResourceHandler.java

@@ -37,12 +37,12 @@
 
 package org.cip4.jdfutility.server;
 
-import java.io.File;
-import java.util.ArrayList;
 import java.util.Collection;
+import java.util.HashSet;
 
 import org.cip4.jdflib.util.StringUtil;
 import org.eclipse.jetty.server.handler.ResourceHandler;
+import org.eclipse.jetty.util.resource.EmptyResource;
 import org.eclipse.jetty.util.resource.Resource;
 
 /**
@@ -55,14 +55,14 @@ public class MyResourceHandler extends ResourceHandler
 {
 
 	private final String home;
-	private final Collection<File> whiteList;
+	private final Collection<String> whiteList;
 
 	public MyResourceHandler(final String strip, final String home)
 	{
 		super();
 		this.strip = StringUtil.getNonEmpty(strip);
 		this.home = home;
-		whiteList = new ArrayList<>();
+		whiteList = new HashSet<>();
 	}
 
 	private final String strip;
@@ -84,9 +84,9 @@ public Resource getResource(String url)
 			else if (!whiteList.isEmpty())
 			{
 				final String base = StringUtil.token(url, 0, "/");
-				if (!whiteList.contains(new File(base)))
+				if (!whiteList.contains(base.toLowerCase()))
 				{
-					return null;
+					return EmptyResource.INSTANCE;
 				}
 			}
 
@@ -105,7 +105,7 @@ else if (!whiteList.isEmpty())
 	 */
 	public void addBase(final String base)
 	{
-		whiteList.add(new File(base));
+		whiteList.add(base.toLowerCase());
 	}
 
 	@Override

src/test/java/org/cip4/jdfutility/server/JettyServerTest.java

@@ -2,7 +2,7 @@
  * The CIP4 Software License, Version 1.0
  *
  *
- * Copyright (c) 2001-2023 The International Cooperation for the Integration of Processes in Prepress, Press and Postpress (CIP4). All rights reserved.
+ * Copyright (c) 2001-2024 The International Cooperation for the Integration of Processes in Prepress, Press and Postpress (CIP4). All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
  *
@@ -46,6 +46,7 @@
 import org.cip4.jdfutility.JDFUtilityTestBase;
 import org.cip4.jdfutility.exe.HTTPDump;
 import org.cip4.jdfutility.server.JettyServer.JettySSLData;
+import org.eclipse.jetty.util.resource.EmptyResource;
 import org.junit.jupiter.api.Test;
 
 class JettyServerTest extends JDFUtilityTestBase
@@ -169,28 +170,23 @@ public synchronized void testIsRunning() throws InterruptedException
 	@Test
 	public void testResHandler() throws InterruptedException
 	{
-		final HTTPDump ns = new HTTPDump();
-		ns.setPort(getPort());
 		final MyResourceHandler rh = new MyResourceHandler("foo", "dummy");
 		assertNull(rh.getResource("nix"));
 	}
 
 	@Test
 	public void testResHandlerWL() throws InterruptedException
 	{
-		final HTTPDump ns = new HTTPDump();
-		ns.setPort(getPort());
 		final MyResourceHandler rh = new MyResourceHandler("foo", "dummy");
 		rh.addBase("boo");
-		assertNull(rh.getResource("foo/nix"));
-		assertNull(rh.getResource("foo/boo"));
+		assertEquals(EmptyResource.INSTANCE, rh.getResource("/foo/nix"));
+		assertEquals(EmptyResource.INSTANCE, rh.getResource("/foo/boo"));
+		assertEquals(null, rh.getResource("/boo"));
 	}
 
 	@Test
 	public void testResHandlerString() throws InterruptedException
 	{
-		final HTTPDump ns = new HTTPDump();
-		ns.setPort(getPort());
 		final MyResourceHandler rh = new MyResourceHandler("foo", "bar");
 		assertNotNull(rh.toString());
 	}