opened
giflw
username_0
Hi

I was using v2.5.0, but static files content-type header was missing.

Then I switched to 2.5.2, but my static files wasn't loading, and I get traversal directory warning from StaticFilesConfiguration.

Switching to 2.5.1 solve both problems.
Error with static files in version 2.5.2
issue
created
tipsy
username_1
Unix?
comment
created
perwendel
username_2
That sucks! What OS are you using? I verified functionality in Windows and Linux. All information you provide is helpful!
comment
created
giflw
username_0
Windows 8, Java 8 Oracle
comment
created
perwendel
username_2
Is it possible to describe your use? Is it internal or external static file location? What does the path look like? What exactly is not working?
comment
created
giflw
username_0
I'm using external files, with a folder named 'tools' and registered paths '/tools', '/tools/:id'. There are resources, like images, acessible from '/tools/1/image.pg'. The imagem is supposed to load, as there are no route matching the pattern, but I receive the traversal director warning and the imagem doesn't load.
comment
created
giflw
username_0
I had a /* route too
comment
created
perwendel
username_2
ok, thanks, I'll try to reproduce
comment
created
perwendel
username_2
@username_0 
I did the following test:

```
import static spark.Spark.get;
import static spark.Spark.staticFiles;

public class StaticResources {

    public static void main(String[] args) {

        String directoryRoot = System.getProperty("java.io.tmpdir") + "external\\";
        System.out.println(directoryRoot);

        staticFiles.externalLocation(directoryRoot);

        get("/tools", (request, response) -> "Hello Tools!");
        get("/tools/:id", (request, response) -> "Hello Tools: " + request.params(":id") + "!");
        get("/*", (request, response) -> "Hello Everyone else!");
    }
}
```
directoryRoot = C:\Users\<myusername>\AppData\Local\Temp\external\

Where I created a subfolder in the folder with path directory root name `tools` and a folder in that folder named `1` and a file in that folder name `image.png`.

`http://localhost:4567/tools/1/image.png` - returned the image
`http://localhost:4567/tools` - returned "Hello Tools!"
`http://localhost:4567/tools/hammer` - returned "Hello Tools: hammer!"
`http://localhost:4567/tools/hammer/ish - returned "Hello Everyone else!"

Is this test analog to what didn't work for you? If so can you try this out and see if it fails?
comment
created
giflw
username_0
This is analog to what I did, but the image wasn't returned. I'll try this code as soon as I can.
comment
created
perwendel
username_2
Thanks
comment
created
giflw
username_0
Hi

I tested your code, and its worked. But, when I run my app, the error persist. I was debuggin and found in `spark.utils.StringUtils`, line 401, the following code:

```
if (trimmed.startsWith("/")) {
    trimmed = trimmed.substring(1);
}
```

But just before it, on line 397, there is another if:

```
if (trimmed.endsWith("/") || trimmed.endsWith("\\")) {
       trimmed = trimmed.substring(0, trimmed.length() - 1);
}
```

The first one checks for `/` and `\\`, but the second one just checks for `/`. I don't know if this is a problem or not.
comment
created
giflw
username_0
I made some fore tests and debugging, and I found the solution, but don't know exaclty the source.

First: I'm running on Windows, and paths commonly starts with `C:\` or other letter.

Second: I registererd the external path using `*nix` path.

The code to make the issue arise:

```
import static spark.Spark.*;

public class StaticResources {

    public static void main(String[] args) {

        String directoryRoot = "/Users/c101054/AppData/Local/Temp/external/";

        System.out.println("Win path: " + System.getProperty("java.io.tmpdir") + "external\\");
        System.out.println("*nix like path:" + directoryRoot);

        staticFiles.externalLocation(directoryRoot);

        get("/*", (request, response) -> "Hello Everyone else!");
    }
}
```
The sysout:
```
Win path: C:\Users\c101054\AppData\Local\Temp\external\
*nix like path:/Users/c101054/AppData/Local/Temp/external/
[qtp556411854-19] WARN spark.staticfiles.StaticFilesConfiguration - external directory traversal detection for path: /tools/1/haka.gif
```

As Java can handle `*nix` like paths on Windows, I always preffer that approach, as I develop sometimes on Windows (my work computer), sometimes on Linux (my personal computer), but production machines are linux (besides that, it seems more clear to me :smile:).

Just a note, all 3 paths bellow results in the same for Java File class:

- /Users/c101054/AppData/Local/Temp/external/
- /c:/Users/c101054/AppData/Local/Temp/external/
- C:\Users\c101054\AppData\Local\Temp\external\

So, from that, I would propose to transfor all paths to Unix like to make the traversal test. Propably the first part `/c:` can add some more problems in the future, in the case of multipartition system. Using internally a `*nix` syntax can be usefull, as one always know how paths are representerd internally, independently of S.O.
comment
created
giflw
username_0
To transform Windows paths to *nix like:

- Get the absolute Windows path, with partition letter
- Replace all `\` by `/`
- Add a `/` to the beggining

After that all paths will have the same layout, but when registering an external location to Spark, this transformation needs to be done, and Spark will have to check if the S.O. is Windows to apply that.
comment
created
giflw
username_0
Pull request: #706 
Is a work in progress, as I need to verify the traversal check
comment
created
TuxGamer
username_3
I had the same issue. My external call looked like:
`Spark.staticFiles.externalLocation("./public/");`
but changing it to
`Spark.staticFiles.externalLocation("public/");`
fixed it for me.

OS: Ubuntu 16.04,
Java: OpenJDK 1.8u111
Spark version: 2.5.2
comment
created
perwendel
username_2
I'll have a look at the PR. Thanks
comment
created
perwendel
username_2
Fixed
comment
closed
perwendel
username_2
issue