#7692 Cannot load static resources in /VAADIN from JARs on GlassFish and some other servers

svn changeset:21445/svn branch:6.6

1 files changed, 17 insertions, 2 deletions

diff --git a/src/com/vaadin/terminal/gwt/server/AbstractApplicationServlet.java b/src/com/vaadin/terminal/gwt/server/AbstractApplicationServlet.java
index 526e85a8d8..1f880be2a3 100644
--- a/src/com/vaadin/terminal/gwt/server/AbstractApplicationServlet.java
+++ b/src/com/vaadin/terminal/gwt/server/AbstractApplicationServlet.java
@@ -1367,10 +1367,25 @@ public abstract class AbstractApplicationServlet extends HttpServlet implements
                 return false;
             }
             return true;
+        } else if ("file".equals(resourceUrl.getProtocol())) {
+            // Some servers such as GlassFish extract files from JARs. In such
+            // cases, the class loader sees them as file URLs.
+
+            // Check that the URL is in a VAADIN directory and does not contain
+            // "/../"
+            if (!resourceUrl.getPath().contains("/VAADIN/")
+                    || resourceUrl.getPath().contains("/../")) {
+                logger.info("Blocked attempted access to the file : "
+                        + resourceUrl);
+                return false;
+            }
+            logger.fine("Accepting access to a file using a class loader: "
+                    + resourceUrl);
+            return true;
         }
 
-        // when using the class loader fall-back, other protocols than jar: are
-        // not supported
+        // when using the class loader fall-back, other protocols than jar: and
+        // file: are not supported
         return false;
     }