httpsgithu
diff --git a/‎TODO‎
Lines changed: 1 addition & 1 deletion b/‎TODO‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎jooby/src/main/java/io/jooby/Router.java‎
Lines changed: 2 additions & 0 deletions b/‎jooby/src/main/java/io/jooby/Router.java‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎tests/src/test/java/io/jooby/Issue1639.java‎
Lines changed: 58 additions & 0 deletions b/‎tests/src/test/java/io/jooby/Issue1639.java‎
Lines changed: 58 additions & 0 deletions
diff --git a/‎tests/src/test/resources/static/js/index.js‎
Lines changed: 1 addition & 0 deletions b/‎tests/src/test/resources/static/js/index.js‎
Lines changed: 1 addition & 0 deletions
@@ -2,7 +2,7 @@
 
 - Remove Router.assets(String) to force user to say from where asset should read
 - Add check to ClassPathAssetSource and reject root classpath access
-
+- Added tests for checking invalid access: Issue1639
 
 * MVC: QueryParam annotation vs PathParam try to figure it out them and make optional (update open api)
 * MVC: introduce BodyParam
 
@@ -598,6 +598,8 @@ interface Match {
    * - file-system if the source folder exists in the current user directory
    * - or fallback to classpath when file-system folder doesn't exist.
    *
+   * NOTE: This method choose file-system or classpath, it doesn't merge them.
+   *
    * @param pattern Path pattern.
    * @param source File-System folder when exists, or fallback to a classpath folder.
    * @return A route.
 
@@ -0,0 +1,58 @@
+package io.jooby;
+
+import io.jooby.junit.ServerTest;
+import io.jooby.junit.ServerTestRunner;
+
+import java.nio.file.Path;
+import java.nio.file.Paths;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+public class Issue1639 {
+
+  @ServerTest
+  public void shouldNotAccessToClassFromFileSystemAsset(ServerTestRunner runner) {
+    runner.define(app -> {
+      app.assets("/static/?*", userdir("src", "test", "resources", "static"));
+    }).ready(client -> {
+      client.get("/static/js/index.js", rsp -> {
+        assertEquals("(function () { console.log('index.js');});", rsp.body().string().trim());
+      });
+
+      client.get("/static/io/jooby/Issue1639.js.class", rsp -> {
+        assertEquals(404, rsp.code());
+      });
+
+      client.get("/static/io/jooby/Issue1639.class", rsp -> {
+        assertEquals(404, rsp.code());
+      });
+    });
+  }
+
+  @ServerTest
+  public void shouldNotAccessToClassFromCpAssetSource(ServerTestRunner runner) {
+    runner.define(app -> {
+      app.assets("/static/?*", "/static");
+    }).ready(client -> {
+      client.get("/static/js/index.js", rsp -> {
+        assertEquals("(function () { console.log('index.js');});", rsp.body().string().trim());
+      });
+
+      client.get("/static/../io/jooby/Issue1639.class", rsp -> {
+        assertEquals(404, rsp.code());
+      });
+
+      client.get("/static/..%252fio/jooby/Issue1639.class", rsp -> {
+        assertEquals(404, rsp.code());
+      });
+    });
+  }
+
+  private static Path userdir(String... segments) {
+    Path path = Paths.get(System.getProperty("user.dir"));
+    for (String segment : segments) {
+      path = path.resolve(segment);
+    }
+    return path;
+  }
+}
@@ -0,0 +1 @@
+(function () { console.log('index.js');});
Original file line number	Diff line number	Diff line change
`@@ -598,6 +598,8 @@ interface Match {`
`598`	`598`	`* - file-system if the source folder exists in the current user directory`
`599`	`599`	`* - or fallback to classpath when file-system folder doesn't exist.`
`600`	`600`	`*`
	`601`	`+ * NOTE: This method choose file-system or classpath, it doesn't merge them.`
	`602`	`+ *`
`601`	`603`	`* @param pattern Path pattern.`
`602`	`604`	`* @param source File-System folder when exists, or fallback to a classpath folder.`
`603`	`605`	`* @return A route.`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+(function () { console.log('index.js');});`