From 98ad23bef8e2e04143f8f5b201380543a8d8c0c3 Mon Sep 17 00:00:00 2001
From: Juergen Hoeller <jhoeller@pivotal.io>
Date: Tue, 27 Mar 2018 17:04:59 +0200
Subject: [PATCH] Consistent logging of encoded path evaluation failure

Issue: SPR-16616
---
 .../web/reactive/resource/PathResourceResolver.java        | 7 ++++++-
 .../web/servlet/resource/PathResourceResolver.java         | 7 ++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/spring-webflux/src/main/java/org/springframework/web/reactive/resource/PathResourceResolver.java b/spring-webflux/src/main/java/org/springframework/web/reactive/resource/PathResourceResolver.java
index 37bcff4b23..404607542d 100644
--- a/spring-webflux/src/main/java/org/springframework/web/reactive/resource/PathResourceResolver.java
+++ b/spring-webflux/src/main/java/org/springframework/web/reactive/resource/PathResourceResolver.java
@@ -193,7 +193,12 @@ public class PathResourceResolver extends AbstractResourceResolver {
 			// Use URLDecoder (vs UriUtils) to preserve potentially decoded UTF-8 chars...
 			try {
 				String decodedPath = URLDecoder.decode(resourcePath, "UTF-8");
-				return (decodedPath.contains("../") || decodedPath.contains("..\\"));
+				if (decodedPath.contains("../") || decodedPath.contains("..\\")) {
+					if (logger.isTraceEnabled()) {
+						logger.trace("Ignoring invalid resource path with escape sequences [" + resourcePath + "]");
+					}
+					return true;
+				}
 			}
 			catch (UnsupportedEncodingException ex) {
 				// Should never happen...
diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/resource/PathResourceResolver.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/resource/PathResourceResolver.java
index 41f3ffebf2..43a8397650 100644
--- a/spring-webmvc/src/main/java/org/springframework/web/servlet/resource/PathResourceResolver.java
+++ b/spring-webmvc/src/main/java/org/springframework/web/servlet/resource/PathResourceResolver.java
@@ -284,7 +284,12 @@ public class PathResourceResolver extends AbstractResourceResolver {
 			// Use URLDecoder (vs UriUtils) to preserve potentially decoded UTF-8 chars...
 			try {
 				String decodedPath = URLDecoder.decode(resourcePath, "UTF-8");
-				return (decodedPath.contains("../") || decodedPath.contains("..\\"));
+				if (decodedPath.contains("../") || decodedPath.contains("..\\")) {
+					if (logger.isTraceEnabled()) {
+						logger.trace("Ignoring invalid resource path with escape sequences [" + resourcePath + "]");
+					}
+					return true;
+				}
 			}
 			catch (UnsupportedEncodingException ex) {
 				// Should never happen...