From 0259a37c441eb1faa32c75fa4fdd56d5627cc20f Mon Sep 17 00:00:00 2001 From: Anna Koskinen Date: Mon, 5 Jul 2021 12:32:11 +0300 Subject: [PATCH] fix: add JavaDoc warning to avoid using ResponseWriter for directories (#12337) * fix: add JavaDoc warning to avoid using ResponseWriter for directories (#12324) Cherry-picked from: https://github.com/vaadin/flow/pull/11112 --- server/src/main/java/com/vaadin/server/VaadinServlet.java | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/server/src/main/java/com/vaadin/server/VaadinServlet.java b/server/src/main/java/com/vaadin/server/VaadinServlet.java index fc8aaeaac2..58320ecb0a 100644 --- a/server/src/main/java/com/vaadin/server/VaadinServlet.java +++ b/server/src/main/java/com/vaadin/server/VaadinServlet.java @@ -943,6 +943,13 @@ public class VaadinServlet extends HttpServlet implements Constants { /** * Writes the contents of the given resourceUrl in the response. Can be * overridden to add/modify response headers and similar. + *

+ * WARNING: note that this should not be used for a {@code resourceUrl} that + * represents a directory! For security reasons, the directory contents + * should not be ever written into the {@code response}, and the + * implementation which is used for setting the content length relies on + * {@link URLConnection#getContentLength()} method which returns incorrect + * values for directories. * * @param request * The request for the resource -- 2.39.5