private void doGet(String target, HttpServletRequest request, HttpServletResponse response)
throws IOException {
if (target.equals("/")) {
setHandled(request);
JsonObject config = makeConfig();
PageUtil.sendJsonAndHtml("config", config, "frontpage.html", response, logger);
return;
}
if (target.equals("/dev_mode_on.js")) {
setHandled(request);
JsonObject config = makeConfig();
PageUtil
.sendJsonAndJavaScript("__gwt_codeserver_config", config, "dev_mode_on.js", response,
logger);
return;
}
// Recompile on request from the bookmarklet.
// This is a GET because a bookmarklet can call it from a different origin (JSONP).
if (target.startsWith("/recompile/")) {
setHandled(request);
String moduleName = target.substring("/recompile/".length());
ModuleState moduleState = modules.get(moduleName);
if (moduleState == null) {
response.sendError(HttpServletResponse.SC_NOT_FOUND);
logger.log(TreeLogger.WARN, "not found: " + target);
return;
}
// We are passing properties from an unauthenticated GET request directly to the compiler.
// This should be safe, but only because these are binding properties. For each binding
// property, you can only choose from a set of predefined values. So all an attacker can do is
// cause a spurious recompile, resulting in an unexpected permutation being loaded later.
//
// It would be unsafe to allow a configuration property to be changed.
boolean ok = moduleState.recompile(getBindingProperties(request));
JsonObject config = makeConfig();
config.put("status", ok ? "ok" : "failed");
sendJsonpPage(config, request, response);
return;
}
if (target.startsWith("/log/")) {