Package org.codelibs.fess.theme

Class StaticThemeResponder

java.lang.Object
org.codelibs.fess.theme.StaticThemeResponder
public class StaticThemeResponder extends Object
Serves the HTML entry file and asset files of a resolved static theme directly to the servlet response.

This component is invoked by StaticThemeFilter, which resolves the active theme for the current virtual host and decides — based on the request URI — whether to serve the SPA entry HTML (serveIndex(jakarta.servlet.http.HttpServletRequest, jakarta.servlet.http.HttpServletResponse, org.codelibs.fess.theme.Theme, java.lang.String)) or a theme-relative static asset (serveAsset(jakarta.servlet.http.HttpServletRequest, jakarta.servlet.http.HttpServletResponse, org.codelibs.fess.theme.Theme, java.lang.String)). The filter writes the response in place (no RequestDispatcher forward), so the browser address bar keeps the original request URI.

Security: resolveAsset(Theme, String) enforces path-traversal protection by rejecting absolute paths and any path containing "..", re-checking the canonicalized result is still under the theme base directory, rejecting symlinks, and applying a filename denylist (see isBlockedFilename(String)). The entry file is subjected to the same filename denylist so a malicious manifest entry cannot serve internal files (e.g. theme.yml or .env) as HTML.

  • Constructor Summary

    Constructors
    Constructor
    Description
    StaticThemeResponder()
    Default constructor.

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    serveAsset(jakarta.servlet.http.HttpServletRequest req, jakarta.servlet.http.HttpServletResponse res, Theme theme, String assetPath)
    Streams a static asset from the given theme's base directory after validating the path.
    void
    serveIndex(jakarta.servlet.http.HttpServletRequest req, jakarta.servlet.http.HttpServletResponse res, Theme theme, String requestPath)
    Streams the entry HTML file of the given theme with no-cache semantics.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • StaticThemeResponder

      public StaticThemeResponder()
      Default constructor.

  • Method Details

    • serveIndex

      public void serveIndex(jakarta.servlet.http.HttpServletRequest req, jakarta.servlet.http.HttpServletResponse res, Theme theme, String requestPath) throws IOException
      Streams the entry HTML file of the given theme with no-cache semantics.

      When requestPath starts with /error, the response also carries:

      • X-Fess-Route: error — signals to the SPA that this is an error route.
      • X-Fess-Error-Code: <status> — the HTTP status code derived from the URI (e.g. 404 for /error/notFound).
      • <meta name="x-fess-error-code" content="<status>"> — the same status code injected as a meta tag into the HTML <head> so client-side JS can read it directly without relying on the HTTP header.
      • <meta name="x-fess-error-detail-key" content="..."> — when a safe message_key query parameter is present.
      Parameters:
      req - the current request (used to read the message_key parameter)
      res - the response to write to
      theme - the active theme whose entry file is served
      requestPath - the context-path-stripped request path (used for /error detection)
      Throws:
      IOException - if writing the response fails

    • serveAsset

      public void serveAsset(jakarta.servlet.http.HttpServletRequest req, jakarta.servlet.http.HttpServletResponse res, Theme theme, String assetPath) throws IOException
      Streams a static asset from the given theme's base directory after validating the path.
      Parameters:
      req - the current request (used for conditional-GET headers)
      res - the response to write to
      theme - the active theme whose base directory anchors the resolution
      assetPath - theme-relative asset path supplied by the filter
      Throws:
      IOException - if writing the response fails