| 26 | } |
| 27 | |
| 28 | public void execute(final TSDB tsdb, final HttpQuery query) |
| 29 | throws IOException { |
| 30 | final String uri = query.request().getUri(); |
| 31 | if ("/favicon.ico".equals(uri)) { |
| 32 | query.sendFile(tsdb.getConfig().getDirectoryName("tsd.http.staticroot") |
| 33 | + "/favicon.ico", 31536000 /*=1yr*/); |
| 34 | return; |
| 35 | } |
| 36 | if (uri.length() < 3) { // Must be at least 3 because of the "/s/". |
| 37 | throw new BadRequestException("URI too short <code>" + uri + "</code>"); |
| 38 | } |
| 39 | // Cheap security check to avoid directory traversal attacks. |
| 40 | // TODO(tsuna): This is certainly not sufficient. |
| 41 | if (uri.indexOf("..", 3) > 0) { |
| 42 | throw new BadRequestException("Malformed URI <code>" + uri + "</code>"); |
| 43 | } |
| 44 | final int questionmark = uri.indexOf('?', 3); |
| 45 | final int pathend = questionmark > 0 ? questionmark : uri.length(); |
| 46 | query.sendFile(tsdb.getConfig().getDirectoryName("tsd.http.staticroot") |
| 47 | + uri.substring(2, pathend), // Drop the "/s" |
| 48 | uri.contains("nocache") ? 0 : 31536000 /*=1yr*/); |
| 49 | } |
| 50 | } |