@@ -0,0 +1,1476 @@
+// Copyright 2010 The Apache Software Foundation%0A//%0A// Licensed under the Apache License, Version 2.0 (the %22License%22);%0A// you may not use this file except in compliance with the License.%0A// You may obtain a copy of the License at%0A//%0A// http://www.apache.org/licenses/LICENSE-2.0%0A//%0A// Unless required by applicable law or agreed to in writing, software%0A// distributed under the License is distributed on an %22AS IS%22 BASIS,%0A// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.%0A// See the License for the specific language governing permissions and%0A// limitations under the License.%0A%0Apackage org.apache.tapestry5.internal.services.assets;%0A%0Aimport java.io.IOException;%0A%0Aimport org.apache.tapestry5.ioc.test.TestBase;%0Aimport org.testng.annotations.DataProvider;%0Aimport org.testng.annotations.Test;%0A%0Apublic class ContextAssetRequestHandlerTest extends TestBase%0A%7B%0A    @DataProvider%0A    public Object%5B%5D%5B%5D invalid_paths()%0A    %7B%0A        return new Object%5B%5D%5B%5D%0A        %7B%0A        %7B %22web-Inf/classes/hibernate.cfg.xml%22 %7D,%0A        %7B %22Meta-Inf/MANIFEST.mf%22 %7D,%0A        %7B %22Index.tml%22 %7D,%0A        %7B %22folder/FolderIndex.TML%22 %7D %7D;%0A    %7D%0A%0A    @Test(dataProvider = %22invalid_paths%22)%0A    public void ensure_assets_are_rejected(String path) throws IOException%0A    %7B%0A        ContextAssetRequestHandler handler = new ContextAssetRequestHandler(null, null);%0A%0A        assertFalse(handler.handleAssetRequest(null, null, path), %22Handler should return false for invalid path.%22);%0A    %7D%0A%7D%0A

Add tests to validate that ContextAssetRequestHandler screens out access to WEB-INF, META-INF and .tml files.