package org.wso2.carbon.wsdl2form;

import org.apache.axis2.context.ConfigurationContext;
import org.apache.http.protocol.HTTP;
import org.wso2.carbon.core.transports.CarbonHttpRequest;
import org.wso2.carbon.core.transports.CarbonHttpResponse;
import org.wso2.carbon.core.transports.HttpGetRequestProcessor;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.BufferedInputStream;
import java.io.BufferedOutputStream;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import java.io.OutputStream;

/**
 * This class helps to load needed Resources for the Tryit page. When FE/BE is separated we cannot
 * access the JavaScript files and images required for the proper operation of Tryit. This Request
 * Processor is used to load any needed content from BE to FE. We can load any content from
 * wsdl2form's resources using
 * ?wsdl2form&resource=foo.js&type=js or
 * ?wsdl2form&resource=bar.jpg&type=image
 */
public class WSDL2FormRequestProcessor implements HttpGetRequestProcessor {

    public void process(CarbonHttpRequest request, CarbonHttpResponse response,
                        ConfigurationContext configurationContext) throws Exception {
        OutputStream responseStream = response.getOutputStream();
        String resource = request.getParameter("resource");
        String contentType = request.getParameter("contentType");

        ClassLoader classLoader = WSDL2FormRequestProcessor.class.getClassLoader();

        InputStream resourceStream = classLoader.getResourceAsStream(resource);

        if (contentType != null && !contentType.equals("")) {
            response.addHeader(HTTP.CONTENT_TYPE, contentType);
        }
        if (resourceStream != null) {
            int n;
            byte[] b = new byte[1024];
            while ((n = resourceStream.read(b)) > 0) {
                responseStream.write(b, 0, n);
            }
            resourceStream.close();
        }
    }
}

@@ -83,16 +83,101 @@
 ontext;%0A
+import org.apache.commons.logging.Log;%0Aimport org.apache.commons.logging.LogFactory;%0A
 import o
@@ -403,88 +403,44 @@
 java
-x.servlet.http.HttpServletRequest;%0Aimport javax.servlet.http.HttpServletResponse
+.io.File;%0Aimport java.io.IOException
 ;%0Aim
@@ -452,24 +452,16 @@
 java.io.
-Buffered
 InputStr
@@ -484,16 +484,8 @@
 .io.
-Buffered
 Outp
@@ -510,126 +510,85 @@
 ava.
-io.ByteArrayInputStream;%0Aimport java.io.ByteArrayOutputStream;%0Aimport java.io.InputStream;%0Aimport java.io.OutputStream
+util.Enumeration;%0Aimport java.util.jar.JarEntry;%0Aimport java.util.jar.JarFile
 ;%0A%0A/
@@ -1075,16 +1075,146 @@
 ssor %7B%0A%0A
+    private static Log log = LogFactory.getLog(WSDL2FormRequestProcessor.class);%0A    private static final int BAD_REQUEST = 400;%0A%0A
     publ
@@ -1560,24 +1560,358 @@
 entType%22);%0A%0A
+        if (isEmptyString(resource)) %7B%0A            response.setStatus(BAD_REQUEST);%0A            return;%0A        %7D%0A        if (!isResourceFoundInJar(resource)) %7B%0A            log.warn(%22Resource %22 + resource + %22 was not found in JAR file %22 + getJarFilePath());%0A            response.setStatus(BAD_REQUEST);%0A            return;%0A        %7D%0A%0A
         Clas
@@ -1982,17 +1982,16 @@
 ader();%0A
-%0A
         
@@ -2062,17 +2062,16 @@
 ource);%0A
-%0A
         
@@ -2461,11 +2461,1115 @@
  %7D%0A    %7D
+%0A%0A    private boolean isResourceFoundInJar(String resource) %7B%0A        JarFile jarFile = null;%0A        File jarFilePath = getJarFilePath();%0A%0A        try %7B%0A            jarFile = new JarFile(jarFilePath);%0A            final Enumeration%3CJarEntry%3E entries = jarFile.entries();%0A            while (entries.hasMoreElements()) %7B%0A                final String name = entries.nextElement().getName();%0A                if (resource.equals(name)) %7B%0A                    return true;%0A                %7D%0A            %7D%0A        %7D catch (IOException e) %7B%0A            log.error(%22Could not read JAR file %22 + jarFilePath.toString(), e);%0A        %7D finally %7B%0A            if (jarFile != null) %7B%0A                try %7B%0A                    jarFile.close();%0A                %7D catch (IOException ignore) %7B%0A                %7D%0A            %7D%0A        %7D%0A        return false;%0A    %7D%0A%0A    private File getJarFilePath() %7B%0A        return new File(getClass().getProtectionDomain().getCodeSource().getLocation().getPath());%0A    %7D%0A%0A    private boolean isEmptyString(String value) %7B%0A        return ((value == null) %7C%7C value.trim().length() == 0);%0A    %7D
 %0A%7D%0A

Fix the issue where user can read arbitary files from the server