restrict SourcesPage to resources of the page's own package

wicket-examples/src/main/java/org/apache/wicket/examples/source/SourcesPage.java

@@ -101,6 +101,12 @@ public String getObject()
 			try
 			{
 				source = (name != null) ? name : sourceParam.toString();
+				if (!packagedResources.getObject().contains(source))
+				{
+					log.error("user is trying to access resource: {} which is not part of the package of {}",
+						source, getPageTargetClass().getName());
+					return "Unable to read the source for " + source;
+				}
 				resourceAsStream = getPageTargetClass().getResourceAsStream(source);
 				if (resourceAsStream == null)
 				{
@@ -198,7 +204,7 @@ private List<String> get(Class<?> scope)
 					}
 					else
 					{
-						String absolutePath = scope.getResource("").toExternalForm();
+						String absolutePath = resource.toExternalForm();
 						File basedir;
 						URI uri;
 						try
@@ -290,7 +296,7 @@ private class FilesBrowser extends WebMarkupContainer
 		private FilesBrowser(String id)
 		{
 			super(id);
-			ListView<String> lv = new ListView<String>("file", new PackagedResourcesModel())
+			ListView<String> lv = new ListView<String>("file", packagedResources)
 			{
 				@Override
 				protected void populateItem(final ListItem<String> item)
@@ -377,6 +383,12 @@ private CodePanel(String id)
 	 */
 	private String name;
 
+	/**
+	 * The resources of the package of the selected page. Doubles as the white list of what may be
+	 * displayed.
+	 */
+	private final PackagedResourcesModel packagedResources = new PackagedResourcesModel();
+
 	private transient Class<? extends Page> page;
 
 	/**

wicket-examples/src/test/java/org/apache/wicket/examples/source/SourcesPageTest.java

@@ -0,0 +1,68 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.wicket.examples.source;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import org.apache.wicket.examples.helloworld.HelloWorld;
+import org.apache.wicket.request.mapper.parameter.PageParameters;
+import org.apache.wicket.util.tester.WicketTestCase;
+import org.junit.jupiter.api.Test;
+
+/**
+ * Tests for {@link SourcesPage}.
+ */
+public class SourcesPageTest extends WicketTestCase
+{
+	private String render(String source)
+	{
+		PageParameters parameters = SourcesPage.generatePageParameters(HelloWorld.class, source);
+		tester.startPage(SourcesPage.class, parameters);
+		return tester.getLastResponseAsString();
+	}
+
+	/**
+	 * A resource of the package of the requested page is displayed.
+	 */
+	@Test
+	public void sourceOfThePackageIsDisplayed()
+	{
+		assertFalse(render("HelloWorld.html").contains("Unable to read the source for"));
+	}
+
+	/**
+	 * An absolute class path resource outside of the package of the requested page is refused.
+	 */
+	@Test
+	public void absoluteClassPathResourceIsRefused()
+	{
+		String response = render("/META-INF/NOTICE");
+		assertFalse(response.contains("Apache Software Foundation (http"));
+		assertTrue(response.contains("Unable to read the source for"));
+	}
+
+	/**
+	 * A parent directory reference is refused.
+	 */
+	@Test
+	public void parentDirectoryResourceIsRefused()
+	{
+		String response = render("../style.css");
+		assertTrue(response.contains("Unable to read the source for"));
+	}
+}