fix(theme): exclude JSP and similar server-side files from static themes - #3466
Merged
Merged
Conversation
A static theme is plain files served as they are, but nothing kept a theme archive from carrying a .jsp file. Such a file was extracted with the rest of the theme, and the servlet container could then treat it as a JSP page rather than as a theme file. - StaticThemeInstaller refuses an archive with a .jsp, .jspx or .jspf entry (EXTRACT_FAILED), for both ZIP upload and the Maven repository install, before anything is moved into the themes directory. - StaticThemeFilter answers 404 for those extensions under /themes/, for any method and whichever theme is active, so such a file already on disk is never handed to the JSP servlet. It checks the path the container decoded, which is the one the container maps to a servlet.
marevol
added a commit
that referenced
this pull request
Sep 23, 2026
… command line (#3473) The admin screen's theme installer refuses an archive carrying a .jsp, .jspx or .jspf entry (#3466), but `fess-setup install theme` extracted such an archive and installed it. Fess already answers 404 for those extensions under /themes/, so this brings the command-line path in line with the admin screen rather than closing an open hole. - ThemeInstaller checks the extracted files in the staging directory, after the manifest check and before anything installed is moved aside, and fails with a message naming the offending file; the staging directory is removed and fess-setup exits non-zero. - The extension list and the case-insensitive match mirror StaticThemeInstaller. The check is reimplemented in the setup package because fess-setup.jar runs with only the JDK on its class path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
A static theme is plain files (HTML, JS, CSS, images, JSON) served as they are. Nothing kept a theme archive from also carrying a
.jspfile, though. Such a file was extracted with the rest of the theme, and the servlet container could then treat it as a JSP page rather than as a theme file.What changes
StaticThemeInstallerrefuses an archive that has a.jsp,.jspxor.jspfentry, withEXTRACT_FAILED, before anything is moved into the themes directory. This covers both the ZIP upload and the install from a Maven repository, which go throughinstallZip.StaticThemeFilteranswers 404 for those extensions under/themes/, whatever the method and whichever theme is active. A file already on disk from an earlier install is therefore never handed to the JSP servlet. The check uses the servlet path and path info the container decoded, which is the path the container maps to a servlet.Verification
mvn test -Dtest=StaticThemeFilterTest,StaticThemeInstaller*Test,ThemeArtifactHelperTest,AdminThemeActionTest,StaticThemeResponderTest,BundledBootstrapThemeTest: 286 tests passed.x.jsp,sub/x.jspx,inc/x.jspfandX.JSP; nothing is left in the themes directory.;paramrequest path..jspfile:.jspfile placed on disk directly, a request for that file under/themes/returns 404. The theme'sindex.html, the bootstrap theme's assets and/are still served.