Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Use Charset variants of URLEncoder and URLDecoder methods

Browse Source
This commit is contained in:
Christoph Dreis
2021-10-13 14:38:58 +02:00
committed by Juergen Hoeller
parent 2fba0bc272
commit 5c972fcc54
11 changed files with 27 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
spring-webmvc/src/main/java/org/springframework/web/servlet/resource/PathResourceResolver.java
View File

@@ -17,7 +17,6 @@
package org.springframework.web.servlet.resource;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.net.URLDecoder;
import java.nio.charset.Charset;
import java.nio.charset.StandardCharsets;
@@ -295,14 +294,14 @@ public class PathResourceResolver extends AbstractResourceResolver {
if (resourcePath.contains("%")) {
// Use URLDecoder (vs UriUtils) to preserve potentially decoded UTF-8 chars...
try {
String decodedPath = URLDecoder.decode(resourcePath, "UTF-8");
String decodedPath = URLDecoder.decode(resourcePath, StandardCharsets.UTF_8);
if (decodedPath.contains("../") || decodedPath.contains("..\\")) {
logger.warn("Resolved resource path contains encoded \"../\" or \"..\\\": " + resourcePath);
return true;
}
}
catch (IllegalArgumentException | UnsupportedEncodingException ex) {
// May not be possible to decode... | Should never happen...
catch (IllegalArgumentException ex) {
// May not be possible to decode...
}
}
return false;

8
spring-webmvc/src/main/java/org/springframework/web/servlet/resource/ResourceHttpRequestHandler.java
View File

@@ -17,9 +17,9 @@
package org.springframework.web.servlet.resource;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.net.URLDecoder;
import java.nio.charset.Charset;
import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
@@ -694,7 +694,7 @@ public class ResourceHttpRequestHandler extends WebContentGenerator
if (path.contains("%")) {
try {
// Use URLDecoder (vs UriUtils) to preserve potentially decoded UTF-8 chars
String decodedPath = URLDecoder.decode(path, "UTF-8");
String decodedPath = URLDecoder.decode(path, StandardCharsets.UTF_8);
if (isInvalidPath(decodedPath)) {
return true;
}
@@ -703,8 +703,8 @@ public class ResourceHttpRequestHandler extends WebContentGenerator
return true;
}
}
catch (IllegalArgumentException | UnsupportedEncodingException ex) {
// May not be possible to decode... | Should never happen...
catch (IllegalArgumentException ex) {
// May not be possible to decode...
}
}
return false;