Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Use Charset variants of URLEncoder and URLDecoder methods

Browse Source
This commit is contained in:
Christoph Dreis
2021-10-13 14:38:58 +02:00
committed by Juergen Hoeller
parent 2fba0bc272
commit 5c972fcc54
11 changed files with 27 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
spring-webflux/src/main/java/org/springframework/web/reactive/resource/PathResourceResolver.java
View File

@@ -17,7 +17,6 @@
package org.springframework.web.reactive.resource;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.net.URLDecoder;
import java.nio.charset.StandardCharsets;
import java.util.Arrays;
@@ -199,14 +198,14 @@ public class PathResourceResolver extends AbstractResourceResolver {
if (resourcePath.contains("%")) {
// Use URLDecoder (vs UriUtils) to preserve potentially decoded UTF-8 chars...
try {
String decodedPath = URLDecoder.decode(resourcePath, "UTF-8");
String decodedPath = URLDecoder.decode(resourcePath, StandardCharsets.UTF_8);
if (decodedPath.contains("../") || decodedPath.contains("..\\")) {
logger.warn("Resolved resource path contains encoded \"../\" or \"..\\\": " + resourcePath);
return true;
}
}
catch (IllegalArgumentException | UnsupportedEncodingException ex) {
// Should never happen...
catch (IllegalArgumentException ex) {
// May not be possible to decode...
}
}
return false;

8
spring-webflux/src/main/java/org/springframework/web/reactive/resource/ResourceWebHandler.java
View File

@@ -17,8 +17,8 @@
package org.springframework.web.reactive.resource;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.net.URLDecoder;
import java.nio.charset.StandardCharsets;
import java.time.Instant;
import java.util.ArrayList;
import java.util.Collections;
@@ -534,7 +534,7 @@ public class ResourceWebHandler implements WebHandler, InitializingBean {
if (path.contains("%")) {
try {
// Use URLDecoder (vs UriUtils) to preserve potentially decoded UTF-8 chars
String decodedPath = URLDecoder.decode(path, "UTF-8");
String decodedPath = URLDecoder.decode(path, StandardCharsets.UTF_8);
if (isInvalidPath(decodedPath)) {
return true;
}
@@ -543,8 +543,8 @@ public class ResourceWebHandler implements WebHandler, InitializingBean {
return true;
}
}
catch (IllegalArgumentException | UnsupportedEncodingException ex) {
// Should never happen...
catch (IllegalArgumentException ex) {
// May not be possible to decode...
}
}
return false;