diff --git a/application/src/main/java/run/halo/app/theme/config/ThemeWebFluxConfigurer.java b/application/src/main/java/run/halo/app/theme/config/ThemeWebFluxConfigurer.java index e066be10d..bcdb9eaa7 100644 --- a/application/src/main/java/run/halo/app/theme/config/ThemeWebFluxConfigurer.java +++ b/application/src/main/java/run/halo/app/theme/config/ThemeWebFluxConfigurer.java @@ -80,6 +80,9 @@ public class ThemeWebFluxConfigurer implements WebFluxConfigurer { var assetsPath = themeRoot.resolve(themeName + "/templates/assets/" + resourcePaths); FileUtils.checkDirectoryTraversal(themeRoot, assetsPath); var location = new FileSystemResource(assetsPath); + if (!location.isReadable()) { + return Mono.empty(); + } return Mono.just(location); } diff --git a/application/src/test/java/run/halo/app/config/WebFluxConfigTest.java b/application/src/test/java/run/halo/app/config/WebFluxConfigTest.java index 2aeec5cab..e60e2870c 100644 --- a/application/src/test/java/run/halo/app/config/WebFluxConfigTest.java +++ b/application/src/test/java/run/halo/app/config/WebFluxConfigTest.java @@ -144,4 +144,14 @@ class WebFluxConfigTest { } } + @Nested + class StaticResourcesTest { + + @Test + void shouldRespond404WhenThemeResourceNotFound() { + webClient.get().uri("/themes/fake-theme/assets/favicon.ico") + .exchange() + .expectStatus().isNotFound(); + } + } } \ No newline at end of file