When the selenium server is started with the -userExtensions switch, a 403 Error does not appear when directly accessing "
http://localhost:4444/selenium-server" in the browser.
Instead the contents of the file system are exposed. So far, only able to replicate when using the -userExtensions switch.
Found in both 0.9.0 and 0.9.2.
STEPS TO REPRODUCE
1. Run java -jar selenium-server.jar -userExtensions user-extensions.js.
2. Open browser, paste
http://localhost:4444/selenium-server into a browser address bar. The contents of the file system will display. Expecting the below error message instead.
3. Stop java client.
4. Run java -jar selenium-server.jar.
5. Repeat step 2, expected 403 error appears.
EXPECTED ERROR
HTTP ERROR: 403
Forbidden for Proxy
RequestURI=/selenium-server/
$ java -classpath selenium-server.jar org.openqa.selenium.server.SeleniumServer 2>/dev/null &
$ wget http://localhost:4444/selenium-server
gives 403
$ java -classpath /tmp:selenium-server.jar org.openqa.selenium.server.SeleniumServer 2>/dev/null &
$ wget http://localhost:4444/selenium-server
gives 200 and a list of files.
All it takes is *one* directory in the classpath. Maybe that's the intended behavior?