Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #25415 from thenx-wei/master

Browse Source 
* gh-25415:
  Simplify PathResourceLookupFunction
This commit is contained in:
Arjen Poutsma
2020-07-20 11:11:14 +02:00
parent 88394bff66 24b1caf434
commit 74d3044641
1 changed files with 3 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
spring-webmvc/src/main/java/org/springframework/web/servlet/function/PathResourceLookupFunction.java
View File

@@ -110,10 +110,7 @@ class PathResourceLookupFunction implements Function<ServerRequest, Optional<Res
return true;
}
}
if (path.contains("..") && StringUtils.cleanPath(path).contains("../")) {
return true;
}
return false;
return path.contains("..") && StringUtils.cleanPath(path).contains("../");
}
private boolean isResourceUnderLocation(Resource resource) throws IOException {
@@ -144,10 +141,8 @@ class PathResourceLookupFunction implements Function<ServerRequest, Optional<Res
if (!resourcePath.startsWith(locationPath)) {
return false;
}
if (resourcePath.contains("%") && StringUtils.uriDecode(resourcePath, StandardCharsets.UTF_8).contains("../")) {
return false;
}
return true;
return !resourcePath.contains("%") ||
!StringUtils.uriDecode(resourcePath, StandardCharsets.UTF_8).contains("../");
}