Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Normalize static resource path early

Browse Source 
Rather than leaving it to the Resource implementation, and
potentially normalizing twice, we apply it once as part of the
initial processPath checks.

Closes gh-33689
This commit is contained in:
rstoyanchev
2024-10-14 12:55:18 +01:00
parent 32962894a0
commit 3bfbe30a78
6 changed files with 72 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
spring-webflux/src/test/java/org/springframework/web/reactive/resource/ResourceWebHandlerTests.java
View File

@@ -670,7 +670,6 @@ class ResourceWebHandlerTests {
testInvalidPath("/../.." + secretPath, handler);
testInvalidPath("/%2E%2E/testsecret/secret.txt", handler);
testInvalidPath("/%2E%2E/testsecret/secret.txt", handler);
testInvalidPath("%2F%2F%2E%2E%2F%2F%2E%2E" + secretPath, handler);
}
private void testInvalidPath(String requestPath, ResourceWebHandler handler) {
@@ -705,7 +704,6 @@ class ResourceWebHandlerTests {
testResolvePathWithTraversal(method, "/url:" + secretPath);
testResolvePathWithTraversal(method, "////../.." + secretPath);
testResolvePathWithTraversal(method, "/%2E%2E/testsecret/secret.txt");
testResolvePathWithTraversal(method, "%2F%2F%2E%2E%2F%2Ftestsecret/secret.txt");
testResolvePathWithTraversal(method, "url:" + secretPath);
// The following tests fail with a MalformedURLException on Windows