assets: requires classpath location/prefix fix #1694

Author: jknack

jooby/src/main/java/io/jooby/internal/FolderDiskAssetSource.java

@@ -25,8 +25,7 @@ public FolderDiskAssetSource(@Nonnull Path location) {
     if (resource.startsWith(location)) {
       if (Files.isRegularFile(resource)) {
         return Asset.create(resource);
-      }
-      if (Files.isDirectory(resource)) {
+      } else if (Files.isDirectory(resource)) {
         Path index = resource.resolve("index.html");
         if (Files.isRegularFile(index)) {
           return Asset.create(index);

tests/src/test/java/io/jooby/Issue1639.java

@@ -15,6 +15,12 @@ public void shouldNotAccessToClassFromFileSystemAsset(ServerTestRunner runner) {
     runner.define(app -> {
       app.assets("/static/?*", userdir("src", "test", "resources", "static"));
     }).ready(client -> {
+      client.get("/static/..%252ffiles/fileupload.js", rsp -> {
+        assertEquals(404, rsp.code());
+      });
+      client.get("/static/../files/fileupload.js", rsp -> {
+        assertEquals(404, rsp.code());
+      });
       client.get("/static/js/index.js", rsp -> {
         assertEquals("(function () { console.log('index.js');});", rsp.body().string().trim());
       });