Preventing Directory Listing

server:
  port: 3000

spring:
  datasource:
    url: jdbc:sqlite:database.sqlite
    driver-class-name: org.sqlite.JDBC
  jpa:
    database-platform: org.hibernate.community.dialect.SQLiteDialect
    hibernate:
      ddl-auto: update
    show-sql: false
  web:
    # Vulnerable: Serving uploads directory as static resources
    # This exposes all files if an attacker knows or guesses filenames
    resources:
      static-locations: file:uploads/

app:
  jwt:
    secret: jwt-secret-key
  uploads:
    directory: uploads

package com.codesignal.pastebin.config;

import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class WebConfig implements WebMvcConfigurer {
    
    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        // Vulnerable: Serving entire uploads directory as static resources
        // This allows unrestricted access to all files in the uploads folder
        // Note: This doesn't enable directory listing by default, but does allow
        // direct access to any file if the attacker knows or guesses the filename
        registry.addResourceHandler("/uploads/**")
                .addResourceLocations("file:uploads/");
    }
}

# Get sensitive data from the uploads directory
curl http://localhost:3000/uploads/sensitive-data.txt

# Access potentially sensitive dotfiles
curl http://localhost:3000/uploads/.env

# Try common configuration file names
curl http://localhost:3000/uploads/config.yml
curl http://localhost:3000/uploads/database.sqlite

server:
  port: 3000

spring:
  datasource:
    url: jdbc:sqlite:database.sqlite
    driver-class-name: org.sqlite.JDBC
  jpa:
    database-platform: org.hibernate.community.dialect.SQLiteDialect
    hibernate:
      ddl-auto: update
    show-sql: false
  # Strategy 1: Remove vulnerable static resource configuration
  # Do not enable: spring.web.resources.static-locations

app:
  jwt:
    secret: jwt-secret-key
  uploads:
    directory: uploads

package com.codesignal.pastebin.config;

import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class WebConfig implements WebMvcConfigurer {
    
    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        // Strategy 1: Remove the vulnerable resource handler completely
        // The following configuration is removed or commented out:
        // registry.addResourceHandler("/uploads/**")
        //         .addResourceLocations("file:uploads/");
        
        // Only serve necessary frontend assets
        registry.addResourceHandler("/assets/**")
                .addResourceLocations(
                        "file:frontend/dist/assets/",
                        "file:/app/frontend/dist/assets/");
    }
}

package com.codesignal.pastebin.controller;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.core.io.FileSystemResource;
import org.springframework.core.io.Resource;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import java.io.File;
import java.util.Arrays;
import java.util.List;

@RestController
@RequestMapping("/uploads")
public class UploadsController {
    
    @Value("${app.uploads.directory:uploads}")
    private String uploadsDirectory;
    
    // Strategy 2: Serve only explicitly allowed files
    // Note: In a real application with user-uploaded files, you would:
    // - Validate files against a database of uploaded file records
    // - Check user permissions before serving files
    // - Use authentication to ensure only authorized users access files
    private final List<String> allowedFiles = Arrays.asList(
        "allowed-file.txt",
        "public-document.pdf"
    );
    
    @GetMapping("/{filename}")
    public ResponseEntity<Resource> getFile(@PathVariable String filename) {
        // Check if the file is in the allowed list
        if (!allowedFiles.contains(filename)) {
            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
        }
        
        File file = new File(uploadsDirectory, filename);
        
        if (!file.exists() || !file.isFile()) {
            return ResponseEntity.status(HttpStatus.NOT_FOUND).build();
        }
        
        Resource resource = new FileSystemResource(file);
        return ResponseEntity.ok()
                .contentType(MediaType.TEXT_PLAIN)
                .body(resource);
    }
}

package com.codesignal.pastebin.controller;

import com.codesignal.pastebin.util.ErrorResponse;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.core.io.FileSystemResource;
import org.springframework.core.io.Resource;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import java.io.File;
import java.util.Arrays;
import java.util.List;

@RestController
@RequestMapping("/uploads")
public class UploadsController {
    
    @Value("${app.uploads.directory:uploads}")
    private String uploadsDirectory;
    
    private final List<String> allowedFiles = Arrays.asList(
        "allowed-file.txt",
        "public-document.pdf"
    );
    
    @GetMapping("/{filename}")
    public ResponseEntity<?> getFile(@PathVariable String filename) {
        if (!allowedFiles.contains(filename)) {
            return ResponseEntity.status(HttpStatus.FORBIDDEN)
                    .body(new ErrorResponse("Access to this file is forbidden"));
        }
        
        File file = new File(uploadsDirectory, filename);
        
        if (!file.exists() || !file.isFile()) {
            return ResponseEntity.status(HttpStatus.NOT_FOUND)
                    .body(new ErrorResponse("File not found"));
        }
        
        Resource resource = new FileSystemResource(file);
        return ResponseEntity.ok()
                .contentType(MediaType.TEXT_PLAIN)
                .body(resource);
    }
    
    // Strategy 3: Add explicit error response for directory access attempts
    // This prevents information leakage and clearly communicates the policy
    @GetMapping("/")
    public ResponseEntity<ErrorResponse> handleDirectoryAccess() {
        return ResponseEntity.status(HttpStatus.FORBIDDEN)
                .body(new ErrorResponse("Directory listing is forbidden"));
    }
}