if (_isCaseInsensitive)
relPath = relPath.toLowerCase(Locale.ENGLISH);
filename = getServletContext().getRealPath(relPath);
Path path = _context.lookupNative(filename);
// only top-level requests are checked
if (cauchoReq == null || cauchoReq.getRequestDepth(0) != 0) {
}
else if (relPath.regionMatches(true, 0, "/web-inf", 0, 8)
&& (relPath.length() == 8
|| ! Character.isLetterOrDigit(relPath.charAt(8)))) {
res.sendError(HttpServletResponse.SC_NOT_FOUND);
return;
}
else if (relPath.regionMatches(true, 0, "/meta-inf", 0, 9)
&& (relPath.length() == 9
|| ! Character.isLetterOrDigit(relPath.charAt(9)))) {
res.sendError(HttpServletResponse.SC_NOT_FOUND);
return;
}
if (relPath.endsWith(".DS_store")) {
// MacOS-X security hole with trailing '.'
res.sendError(HttpServletResponse.SC_NOT_FOUND);
return;
}
else if (! CauchoSystem.isWindows() || relPath.length() == 0) {
}
else if (path.isDirectory()) {
}
else if (path.isWindowsInsecure()) {
// Windows security issues with trailing '.'
res.sendError(HttpServletResponse.SC_NOT_FOUND);
return;
}
// A null will cause problems.
for (int i = relPath.length() - 1; i >= 0; i--) {
char ch = relPath.charAt(i);
if (ch == 0) {
res.sendError(HttpServletResponse.SC_NOT_FOUND);
return;
}
}
ServletContext webApp = getServletContext();
String mimeType = webApp.getMimeType(relPath);
boolean isPathReadable = path.canRead();
Path jarPath = null;
if (! isPathReadable) {
String resource = "META-INF/resources" + relPath;
URL url = webApp.getClassLoader().getResource(resource);