[MGNLRES-60] Allow loading of file system resources from relative path Created: 24/May/13  Updated: 29/Mar/22  Resolved: 17/Jun/14

Status: Closed
Project: Magnolia Resources Module
Component/s: resourceLoaders
Affects Version/s: 1.4.3, 2.0
Fix Version/s: 1.5.11, 2.2.5, 2.3.1

Type: New Feature Priority: Neutral
Reporter: Nils Breunese Assignee: Roman Kovařík
Resolution: Fixed Votes: 0
Labels: next, support
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
causality
Template:
Acceptance criteria:
Empty
Team: Nucleus

 Description   

Following from SUPPORT-1942 which we opened, MGNLRES-52 introduced a feature to allow configuring filesystem resource loaders, as documented via DOCU-349.

This almost solves our use case, but sadly FileSystemResourceLoader currently doesn't allow using relative paths. Since our application has to work in many different environments, using absolute paths is not really an option.

I believe that if on line 76 of FileSystemResourceLoader (version 1.5.10) 'path' would be changed to 'file.getCanonicalPath()' the feature would still be secure, but would also allow using relative paths.



 Comments   
Comment by Nils Breunese [ 16/Jun/14 ]

Please use

if (StringUtils.startsWith(template.getCanonicalPath(), file.getCanonicalPath())) {

instead of the current

if (StringUtils.startsWith(template.getCanonicalPath(), path)) {

We are currently using a copy of FileSystemResourceLoader with this patch and now relative paths work, while this is still secure AFAIK.

Comment by Nils Breunese [ 16/Jun/14 ]

We are currently using magnolia-module-resources version 1.5.10, so we'd appreciate this fix in 1.5.x.

Generated at Mon Feb 12 06:46:59 CET 2024 using Jira 9.4.2#940002-sha1:46d1a51de284217efdcb32434eab47a99af2938b.