Can Directory Listing and Welcome File List coexist?

classic Classic list List threaded Threaded
8 messages Options
Reply | Threaded
Open this post in threaded view
|

Can Directory Listing and Welcome File List coexist?

Igal Sapir
Hello,

I have the following in web.xml:

  - A servlet named Lucee, mapped to by URI pattern "*.cfm"
  - A default servlet from Tomcat, with init-param listings=true
  - A welcome-file of "index.cfm"

My expectation is that for a request to a given directory, if a file named
index.cfm exists then it would be passed to the Lucee servlet, and if not,
the Directory Listings will be displayed.

Instead, requests to a given directory are forwarded to Lucee, which return
a 404.

Is it possible to configure Tomcat so that it would check if the file
exists before matching the URI pattern of the welcome file?  This (as all
Directory Listings, I would hope) is for a Development setup so it's OK if
the check adds a few more microseconds to the request.

Thanks,

Igal
Reply | Threaded
Open this post in threaded view
|

Re: Can Directory Listing and Welcome File List coexist?

Christopher Schultz-2
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Igal,

On 7/30/20 13:49, Igal Sapir wrote:

> Hello,
>
> I have the following in web.xml:
>
> - A servlet named Lucee, mapped to by URI pattern "*.cfm" - A
> default servlet from Tomcat, with init-param listings=true - A
> welcome-file of "index.cfm"
>
> My expectation is that for a request to a given directory, if a
> file named index.cfm exists then it would be passed to the Lucee
> servlet, and if not, the Directory Listings will be displayed.

This is what I would expect as well. I believe this is how httpd
works, for example. I believe the default welcome-file list includes
index.jsp and that's how the JSP servlet is invoked. So this really
should be working.

> Instead, requests to a given directory are forwarded to Lucee,
> which return a 404.

So Lucee sees a request to /foo/bar instead of /foo/bar/index.cfm?

What does the original request look like -- what is the URL being
requested by the user-agent?

Can you post your exact config?

> Is it possible to configure Tomcat so that it would check if the
> file exists before matching the URI pattern of the welcome file?

??

> This (as all Directory Listings, I would hope) is for a
> Development setup so it's OK if the check adds a few more
> microseconds to the request.

Resources can be configured to cache file-check misses (I think!), so
it would be pretty fast if you needed it to be.

- -chris
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl8jD1QACgkQHPApP6U8
pFjfWBAAj10KspESQkhIcfOKAdFFTHrXbyxmFH6PBlvqusaZ2e/TTpf69wxN8Evp
f2x2VNuUaE58LLKQGusey0V1a0lGtETHVAcZWiZeY57yiWV9AYkdW88LJY4aXGyr
TZE5PT12VTt7Dr6xAL7Jc9kjLy2oBp+X0a0cP+XVUVsmvwt5vS0t5l/5qpskR9Fn
MvpA0PFeQerUt83849AZ1PfMcqnQZz8ufjCfRixA8J3E7ztTkEZ4CnH90pAbve1W
LBi89ks4DigMJnTJzEbyucCQjqbNj+hbZju7nvPNYPiGTvtdqbjMGMLb+MPr0O9D
c+i2fPgBaysJrYXnLWTLMulE3yeq6M/cA8IEmYQ8tApIchQy8yklvaEjRTHyuI+A
c5VevIygXT0xZj+vJDvACpDRxvfOtWmPwlx8KOOVkKHSBD98BPObg4lf2BgrdOvM
gBe32NXWWK+/yWjNrd3a24f+a5NC6KEa1CZjMUh1mSt7JsvYU0tT4HTU8r2aGics
/t/vkyzAdxz7zzssEBSi0dS9bO738Bp8KTqwu6q4TVlrQsDT60hUJ3lPKTIf7omI
tg18UBONNHF4lpbgDjlk6ypIf9xjJmbwKHRDlWWY/yJmHATe2lghYvMus/TEHEin
/QusGjCKwmwSO85i1QmGRcn3Oqw97AYSkOLdwSd3dIDQMARQaLY=
=Qdek
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: Can Directory Listing and Welcome File List coexist?

Mark Thomas-2
In reply to this post by Igal Sapir
On July 30, 2020 5:49:41 PM UTC, Igal Sapir <[hidden email]> wrote:

>Hello,
>
>I have the following in web.xml:
>
>  - A servlet named Lucee, mapped to by URI pattern "*.cfm"
>  - A default servlet from Tomcat, with init-param listings=true
>  - A welcome-file of "index.cfm"
>
>My expectation is that for a request to a given directory, if a file
>named
>index.cfm exists then it would be passed to the Lucee servlet, and if
>not,
>the Directory Listings will be displayed.
>
>Instead, requests to a given directory are forwarded to Lucee, which
>return
>a 404.
>
>Is it possible to configure Tomcat so that it would check if the file
>exists before matching the URI pattern of the welcome file?  This (as
>all
>Directory Listings, I would hope) is for a Development setup so it's OK
>if
>the check adds a few more microseconds to the request.
>
>Thanks,
>
>Igal

Look at the resourceOnlyServlets attribute on Context.

Mark

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: Can Directory Listing and Welcome File List coexist?

Igal Sapir
In reply to this post by Christopher Schultz-2
Chris,

On Thu, Jul 30, 2020 at 11:20 AM Christopher Schultz <
[hidden email]> wrote:

>
> On 7/30/20 13:49, Igal Sapir wrote:
> > Hello,
> >
> > I have the following in web.xml:
> >
> > - A servlet named Lucee, mapped to by URI pattern "*.cfm" - A
> > default servlet from Tomcat, with init-param listings=true - A
> > welcome-file of "index.cfm"
> >
> > My expectation is that for a request to a given directory, if a
> > file named index.cfm exists then it would be passed to the Lucee
> > servlet, and if not, the Directory Listings will be displayed.
>
> This is what I would expect as well. I believe this is how httpd
> works, for example. I believe the default welcome-file list includes
> index.jsp and that's how the JSP servlet is invoked. So this really
> should be working.
>

That's what I thought.  I wonder if Lucee should do something differently
here?  But then again I expect Lucee to never see this request in the first
place.


>
> > Instead, requests to a given directory are forwarded to Lucee,
> > which return a 404.
>
> So Lucee sees a request to /foo/bar instead of /foo/bar/index.cfm?
>
> What does the original request look like -- what is the URL being
> requested by the user-agent?
>

I have the following file structure:

$ tree /test/LuceeDebugWebapp/webapp/
/test/LuceeDebugWebapp/webapp/
├── dir
│   └── hello.txt
├── index.cfm

The dir subdirectory does not have a welcome page, so I'm using Google
Chrome to go to http://localhost:48080/dir/ and expecting to see a
directory listing with hello.txt.  Instead I get a 404 from Lucee, and in
the error message the statement:

  Page /dir/index.cfm [/test/LuceeDebugWebapp/webapp/dir/index.cfm] not
found

curl calls show the same:

calling / or /index.cfm returns the expected 200 OK as expected

$ curl -I http://localhost:48080/
HTTP/1.1 200
Content-Type: text/html;charset=UTF-8
Content-Length: 5774
Date: Thu, 30 Jul 2020 19:14:32 GMT

$ curl -I http://localhost:48080/index.cfm
HTTP/1.1 200
Content-Type: text/html;charset=UTF-8
Content-Length: 5774
Date: Thu, 30 Jul 2020 19:14:40 GMT

calling /dir without a trailing slash returns a 302 to /dir/ as expected

$ curl -I http://localhost:48080/dir
HTTP/1.1 302
Location: /dir/
Transfer-Encoding: chunked
Date: Thu, 30 Jul 2020 19:12:36 GMT

calling /dir/ returns a 404 -- NOT EXPECTED

$ curl -I http://localhost:48080/dir/
HTTP/1.1 404
Content-Type: text/html;charset=UTF-8
Content-Length: 6875
Date: Thu, 30 Jul 2020 19:13:27 GMT


>
> Can you post your exact config?
>

Effective web.xml pasted below [1]


>
> > Is it possible to configure Tomcat so that it would check if the
> > file exists before matching the URI pattern of the welcome file?
>
> ??
>
> > This (as all Directory Listings, I would hope) is for a
> > Development setup so it's OK if the check adds a few more
> > microseconds to the request.
>
> Resources can be configured to cache file-check misses (I think!), so
> it would be pretty fast if you needed it to be.
>

Awesome, though I would not expose directory listings in a non-dev
environment.

Here are a few more details on this specific setup, even though I've seen
this with standard Tomcat deployments, and can set up one for sanity check:

- This is an Embedded Tomcat
- I point to web.xml with context.setAltDDName()
- I call tomcat.setAddDefaultWebXmlToWebapp(false) to prevent the unneeded
loading of JSP etc

Also, if this seems to be a bug then I'd be happy to look deeper into it
and solve it.  I just thought that maybe I was doing something wrong.

Thank you,

Igal

[1]
INFO: Effective web.xml:
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
         version="4.0"
         metadata-complete="true">

  <servlet>
    <servlet-name>default</servlet-name>

<servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
    <init-param>
      <param-name>listings</param-name>
      <param-value>true</param-value>
    </init-param>
    <init-param>
      <param-name>debug</param-name>
      <param-value>0</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
  </servlet>
  <servlet>
    <servlet-name>CFMLServlet</servlet-name>
    <servlet-class>lucee.loader.servlet.CFMLServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
  </servlet>
  <servlet>
    <servlet-name>RESTServlet</servlet-name>
    <servlet-class>lucee.loader.servlet.RestServlet</servlet-class>
    <load-on-startup>2</load-on-startup>
  </servlet>

  <servlet-mapping>
    <servlet-name>CFMLServlet</servlet-name>
    <url-pattern>*.cfm</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>CFMLServlet</servlet-name>
    <url-pattern>*.cfc</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>RESTServlet</servlet-name>
    <url-pattern>%2Frest%2F*</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>default</servlet-name>
    <url-pattern>%2F</url-pattern>
  </servlet-mapping>

  <session-config>
    <cookie-config>
    </cookie-config>
  </session-config>

  <welcome-file-list>
    <welcome-file/>
    <welcome-file>index.cfm</welcome-file>
    <welcome-file>index.html</welcome-file>
    <welcome-file>index.htm</welcome-file>
  </welcome-file-list>

  <request-character-encoding>UTF-8</request-character-encoding>
  <response-character-encoding>UTF-8</response-character-encoding>
</web-app>


>
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
>
> iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl8jD1QACgkQHPApP6U8
> pFjfWBAAj10KspESQkhIcfOKAdFFTHrXbyxmFH6PBlvqusaZ2e/TTpf69wxN8Evp
> f2x2VNuUaE58LLKQGusey0V1a0lGtETHVAcZWiZeY57yiWV9AYkdW88LJY4aXGyr
> TZE5PT12VTt7Dr6xAL7Jc9kjLy2oBp+X0a0cP+XVUVsmvwt5vS0t5l/5qpskR9Fn
> MvpA0PFeQerUt83849AZ1PfMcqnQZz8ufjCfRixA8J3E7ztTkEZ4CnH90pAbve1W
> LBi89ks4DigMJnTJzEbyucCQjqbNj+hbZju7nvPNYPiGTvtdqbjMGMLb+MPr0O9D
> c+i2fPgBaysJrYXnLWTLMulE3yeq6M/cA8IEmYQ8tApIchQy8yklvaEjRTHyuI+A
> c5VevIygXT0xZj+vJDvACpDRxvfOtWmPwlx8KOOVkKHSBD98BPObg4lf2BgrdOvM
> gBe32NXWWK+/yWjNrd3a24f+a5NC6KEa1CZjMUh1mSt7JsvYU0tT4HTU8r2aGics
> /t/vkyzAdxz7zzssEBSi0dS9bO738Bp8KTqwu6q4TVlrQsDT60hUJ3lPKTIf7omI
> tg18UBONNHF4lpbgDjlk6ypIf9xjJmbwKHRDlWWY/yJmHATe2lghYvMus/TEHEin
> /QusGjCKwmwSO85i1QmGRcn3Oqw97AYSkOLdwSd3dIDQMARQaLY=
> =Qdek
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [hidden email]
> For additional commands, e-mail: [hidden email]
>
>
Reply | Threaded
Open this post in threaded view
|

Re: Can Directory Listing and Welcome File List coexist?

Igal Sapir
In reply to this post by Mark Thomas-2
Mark,

On Thu, Jul 30, 2020 at 12:14 PM Mark Thomas <[hidden email]> wrote:

> On July 30, 2020 5:49:41 PM UTC, Igal Sapir <[hidden email]> wrote:
> >Hello,
> >
> >I have the following in web.xml:
> >
> >  - A servlet named Lucee, mapped to by URI pattern "*.cfm"
> >  - A default servlet from Tomcat, with init-param listings=true
> >  - A welcome-file of "index.cfm"
> >
> >My expectation is that for a request to a given directory, if a file
> >named
> >index.cfm exists then it would be passed to the Lucee servlet, and if
> >not,
> >the Directory Listings will be displayed.
> >
> >Instead, requests to a given directory are forwarded to Lucee, which
> >return
> >a 404.
> >
> >Is it possible to configure Tomcat so that it would check if the file
> >exists before matching the URI pattern of the welcome file?  This (as
> >all
> >Directory Listings, I would hope) is for a Development setup so it's OK
> >if
> >the check adds a few more microseconds to the request.
> >
> >Thanks,
> >
> >Igal
>
> Look at the resourceOnlyServlets attribute on Context.
>

Calling context.getResourceOnlyServlets() returns "jsp".

Should I set it explicitly to something else?

Thank you,

Igal



>
> Mark
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [hidden email]
> For additional commands, e-mail: [hidden email]
>
>
Reply | Threaded
Open this post in threaded view
|

Re: Can Directory Listing and Welcome File List coexist?

Igal Sapir
Mark,

On Thu, Jul 30, 2020 at 12:21 PM Igal Sapir <[hidden email]> wrote:

> Mark,
>
> On Thu, Jul 30, 2020 at 12:14 PM Mark Thomas <[hidden email]> wrote:
>
>> On July 30, 2020 5:49:41 PM UTC, Igal Sapir <[hidden email]> wrote:
>> >Hello,
>> >
>> >I have the following in web.xml:
>> >
>> >  - A servlet named Lucee, mapped to by URI pattern "*.cfm"
>> >  - A default servlet from Tomcat, with init-param listings=true
>> >  - A welcome-file of "index.cfm"
>> >
>> >My expectation is that for a request to a given directory, if a file
>> >named
>> >index.cfm exists then it would be passed to the Lucee servlet, and if
>> >not,
>> >the Directory Listings will be displayed.
>> >
>> >Instead, requests to a given directory are forwarded to Lucee, which
>> >return
>> >a 404.
>> >
>> >Is it possible to configure Tomcat so that it would check if the file
>> >exists before matching the URI pattern of the welcome file?  This (as
>> >all
>> >Directory Listings, I would hope) is for a Development setup so it's OK
>> >if
>> >the check adds a few more microseconds to the request.
>> >
>> >Thanks,
>> >
>> >Igal
>>
>> Look at the resourceOnlyServlets attribute on Context.
>>
>
> Calling context.getResourceOnlyServlets() returns "jsp".
>
> Should I set it explicitly to something else?
>

I see the JavaDoc comment.  I will add the CFMLServlet and try it out.

Thanks!

Igal


>
> Thank you,
>
> Igal
>
>
>
>>
>> Mark
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: [hidden email]
>> For additional commands, e-mail: [hidden email]
>>
>>
Reply | Threaded
Open this post in threaded view
|

Re: Can Directory Listing and Welcome File List coexist?

Igal Sapir
On Thu, Jul 30, 2020 at 12:25 PM Igal Sapir <[hidden email]> wrote:

> Mark,
>
> On Thu, Jul 30, 2020 at 12:21 PM Igal Sapir <[hidden email]> wrote:
>
>> Mark,
>>
>> On Thu, Jul 30, 2020 at 12:14 PM Mark Thomas <[hidden email]> wrote:
>>
>>> On July 30, 2020 5:49:41 PM UTC, Igal Sapir <[hidden email]> wrote:
>>> >Hello,
>>> >
>>> >I have the following in web.xml:
>>> >
>>> >  - A servlet named Lucee, mapped to by URI pattern "*.cfm"
>>> >  - A default servlet from Tomcat, with init-param listings=true
>>> >  - A welcome-file of "index.cfm"
>>> >
>>> >My expectation is that for a request to a given directory, if a file
>>> >named
>>> >index.cfm exists then it would be passed to the Lucee servlet, and if
>>> >not,
>>> >the Directory Listings will be displayed.
>>> >
>>> >Instead, requests to a given directory are forwarded to Lucee, which
>>> >return
>>> >a 404.
>>> >
>>> >Is it possible to configure Tomcat so that it would check if the file
>>> >exists before matching the URI pattern of the welcome file?  This (as
>>> >all
>>> >Directory Listings, I would hope) is for a Development setup so it's OK
>>> >if
>>> >the check adds a few more microseconds to the request.
>>> >
>>> >Thanks,
>>> >
>>> >Igal
>>>
>>> Look at the resourceOnlyServlets attribute on Context.
>>>
>>
>> Calling context.getResourceOnlyServlets() returns "jsp".
>>
>> Should I set it explicitly to something else?
>>
>
> I see the JavaDoc comment.  I will add the CFMLServlet and try it out.
>

Calling context.getResourceOnlyServlets("CFMLServlet") solves the issue.

Brilliant!  Thanks Mark and Chris,

Igal
Reply | Threaded
Open this post in threaded view
|

Re: Can Directory Listing and Welcome File List coexist?

Igal Sapir
On Thu, Jul 30, 2020 at 12:30 PM Igal Sapir <[hidden email]> wrote:

> On Thu, Jul 30, 2020 at 12:25 PM Igal Sapir <[hidden email]> wrote:
>
>> Mark,
>>
>> On Thu, Jul 30, 2020 at 12:21 PM Igal Sapir <[hidden email]> wrote:
>>
>>> Mark,
>>>
>>> On Thu, Jul 30, 2020 at 12:14 PM Mark Thomas <[hidden email]> wrote:
>>>
>>>> On July 30, 2020 5:49:41 PM UTC, Igal Sapir <[hidden email]> wrote:
>>>> >Hello,
>>>> >
>>>> >I have the following in web.xml:
>>>> >
>>>> >  - A servlet named Lucee, mapped to by URI pattern "*.cfm"
>>>> >  - A default servlet from Tomcat, with init-param listings=true
>>>> >  - A welcome-file of "index.cfm"
>>>> >
>>>> >My expectation is that for a request to a given directory, if a file
>>>> >named
>>>> >index.cfm exists then it would be passed to the Lucee servlet, and if
>>>> >not,
>>>> >the Directory Listings will be displayed.
>>>> >
>>>> >Instead, requests to a given directory are forwarded to Lucee, which
>>>> >return
>>>> >a 404.
>>>> >
>>>> >Is it possible to configure Tomcat so that it would check if the file
>>>> >exists before matching the URI pattern of the welcome file?  This (as
>>>> >all
>>>> >Directory Listings, I would hope) is for a Development setup so it's OK
>>>> >if
>>>> >the check adds a few more microseconds to the request.
>>>> >
>>>> >Thanks,
>>>> >
>>>> >Igal
>>>>
>>>> Look at the resourceOnlyServlets attribute on Context.
>>>>
>>>
>>> Calling context.getResourceOnlyServlets() returns "jsp".
>>>
>>> Should I set it explicitly to something else?
>>>
>>
>> I see the JavaDoc comment.  I will add the CFMLServlet and try it out.
>>
>
> Calling context.getResourceOnlyServlets("CFMLServlet") solves the issue.
>

I meant setResourceOnlyServlets("CFMLServlet") obviously ;)

Igal


>
> Brilliant!  Thanks Mark and Chris,
>
> Igal
>
>