Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Simplified separator check within isInvalidEncodedPath

Browse Source 
Issue: SPR-16616
This commit is contained in:
Juergen Hoeller
2018-03-28 01:22:01 +02:00
parent 6e1cac9145
commit f046a066ec
2 changed files with 14 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
spring-webmvc/src/main/java/org/springframework/web/servlet/resource/PathResourceResolver.java
View File

@@ -285,13 +285,9 @@ public class PathResourceResolver extends AbstractResourceResolver {
// Use URLDecoder (vs UriUtils) to preserve potentially decoded UTF-8 chars... // Use URLDecoder (vs UriUtils) to preserve potentially decoded UTF-8 chars...
try { try {
String decodedPath = URLDecoder.decode(resourcePath, "UTF-8"); String decodedPath = URLDecoder.decode(resourcePath, "UTF-8");
int separatorIndex = decodedPath.indexOf("..") + 2; if (decodedPath.contains("../") || decodedPath.contains("..\\")) {
if (separatorIndex > 1 && separatorIndex < decodedPath.length()) { if (logger.isTraceEnabled()) {
char separator = decodedPath.charAt(separatorIndex); logger.trace("Ignoring invalid resource path with escape sequences [" + resourcePath + "]");
if (separator == '/' || separator == '\\') {
if (logger.isTraceEnabled()) {
logger.trace("Resolved resource path contains \"../\" after decoding: " + resourcePath);
}
} }
return true; return true;
} }

23
spring-webmvc/src/main/java/org/springframework/web/servlet/resource/ResourceHttpRequestHandler.java
View File

@@ -69,24 +69,23 @@ import org.springframework.web.util.UrlPathHelper;
* according to the guidelines of Page Speed, YSlow, etc. * according to the guidelines of Page Speed, YSlow, etc.
* *
* <p>The {@linkplain #setLocations "locations"} property takes a list of Spring * <p>The {@linkplain #setLocations "locations"} property takes a list of Spring
* {@link Resource} locations from which static resources are allowed to * {@link Resource} locations from which static resources are allowed to be served
* be served by this handler. Resources could be served from a classpath location, * by this handler. Resources could be served from a classpath location, e.g.
* e.g. "classpath:/META-INF/public-web-resources/", allowing convenient packaging * "classpath:/META-INF/public-web-resources/", allowing convenient packaging
* and serving of resources such as .js, .css, and others in jar files. * and serving of resources such as .js, .css, and others in jar files.
* *
* <p>This request handler may also be configured with a * <p>This request handler may also be configured with a
* {@link #setResourceResolvers(List) resourcesResolver} and * {@link #setResourceResolvers(List) resourcesResolver} and
* {@link #setResourceTransformers(List) resourceTransformer} chains to support * {@link #setResourceTransformers(List) resourceTransformer} chains to support
* arbitrary resolution and transformation of resources being served. By default a * arbitrary resolution and transformation of resources being served. By default
* {@link PathResourceResolver} simply finds resources based on the configured * a {@link PathResourceResolver} simply finds resources based on the configured
* "locations". An application can configure additional resolvers and * "locations". An application can configure additional resolvers and transformers
* transformers such as the {@link VersionResourceResolver} which can resolve * such as the {@link VersionResourceResolver} which can resolve and prepare URLs
* and prepare URLs for resources with a version in the URL. * for resources with a version in the URL.
* *
* <p>This handler also properly evaluates the {@code Last-Modified} header (if * <p>This handler also properly evaluates the {@code Last-Modified} header
* present) so that a {@code 304} status code will be returned as appropriate, * (if present) so that a {@code 304} status code will be returned as appropriate,
* avoiding unnecessary overhead for resources that are already cached by the * avoiding unnecessary overhead for resources that are already cached by the client.
* client.
* *
* @author Keith Donald * @author Keith Donald
* @author Jeremy Grelle * @author Jeremy Grelle