From f53d01b00ae2ce1c59d07e24328ad05078404fb1 Mon Sep 17 00:00:00 2001
From: Brian Clozel <bclozel@pivotal.io>
Date: Tue, 1 Dec 2015 14:47:23 +0100
Subject: [PATCH] Do not rewrite relative links with FixedVersionStrategy

Prior to this change, the resource handling FixedVersionStrategy would
be applied on all links that match the configured pattern. This is
problematic for relative links and can lead to rewritten links such as
"/fixedversion/../css/main.css" which breaks.

This commit prevents that Strategy from being applied to such links.
Of course, one should avoid to use that VersionStrategy with relative
links, but this change aims at not breaking existing links even if it
means not prefixing the version as expected.

Issue: SPR-13727
(cherry picked from commit c226753)
---
 .../resource/AbstractVersionStrategy.java        | 14 ++++++++++----
 .../resource/FixedVersionStrategyTests.java      | 16 ++++++++++++----
 2 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/resource/AbstractVersionStrategy.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/resource/AbstractVersionStrategy.java
index ebd4e73c57..8de6dabdc4 100644
--- a/spring-webmvc/src/main/java/org/springframework/web/servlet/resource/AbstractVersionStrategy.java
+++ b/spring-webmvc/src/main/java/org/springframework/web/servlet/resource/AbstractVersionStrategy.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2014 the original author or authors.
+ * Copyright 2002-2015 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -100,7 +100,13 @@ public abstract class AbstractVersionStrategy implements VersionStrategy {
 
 		@Override
 		public String addVersion(String path, String version) {
-			return (this.prefix.endsWith("/") || path.startsWith("/") ? this.prefix + path : this.prefix + "/" + path);
+			if (path.startsWith(".")) {
+				return path;
+			}
+			else {
+				return (this.prefix.endsWith("/") || path.startsWith("/") ?
+						this.prefix + path : this.prefix + "/" + path);
+			}
 		}
 	}
 
@@ -118,7 +124,7 @@ public abstract class AbstractVersionStrategy implements VersionStrategy {
 			Matcher matcher = pattern.matcher(requestPath);
 			if (matcher.find()) {
 				String match = matcher.group(1);
-				return match.contains("-") ? match.substring(match.lastIndexOf("-") + 1) : match;
+				return (match.contains("-") ? match.substring(match.lastIndexOf("-") + 1) : match);
 			}
 			else {
 				return null;
@@ -134,7 +140,7 @@ public abstract class AbstractVersionStrategy implements VersionStrategy {
 		public String addVersion(String requestPath, String version) {
 			String baseFilename = StringUtils.stripFilenameExtension(requestPath);
 			String extension = StringUtils.getFilenameExtension(requestPath);
-			return baseFilename + "-" + version + "." + extension;
+			return (baseFilename + "-" + version + "." + extension);
 		}
 	}
 
diff --git a/spring-webmvc/src/test/java/org/springframework/web/servlet/resource/FixedVersionStrategyTests.java b/spring-webmvc/src/test/java/org/springframework/web/servlet/resource/FixedVersionStrategyTests.java
index 8eeb0ab0ee..dcccaf2b92 100644
--- a/spring-webmvc/src/test/java/org/springframework/web/servlet/resource/FixedVersionStrategyTests.java
+++ b/spring-webmvc/src/test/java/org/springframework/web/servlet/resource/FixedVersionStrategyTests.java
@@ -1,11 +1,11 @@
 /*
- * Copyright 2002-2014 the original author or authors.
+ * Copyright 2002-2015 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
- *  http://www.apache.org/licenses/LICENSE-2.0
+ *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
@@ -13,6 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+
 package org.springframework.web.servlet.resource;
 
 import org.junit.Before;
@@ -21,7 +22,8 @@ import org.junit.Test;
 import static org.junit.Assert.*;
 
 /**
- * Unit tests for {@link org.springframework.web.servlet.resource.FixedVersionStrategy}
+ * Unit tests for {@link org.springframework.web.servlet.resource.FixedVersionStrategy}.
+ *
  * @author Brian Clozel
  */
 public class FixedVersionStrategyTests {
@@ -57,7 +59,13 @@ public class FixedVersionStrategyTests {
 
 	@Test
 	public void addVersion() throws Exception {
-		assertEquals(this.version + "/" + this.path, this.strategy.addVersion(this.path, this.version));
+		assertEquals(this.version + "/" + this.path, this.strategy.addVersion("/" + this.path, this.version));
+	}
+
+	@Test  // SPR-13727
+	public void addVersionRelativePath() throws Exception {
+		String relativePath = "../" + this.path;
+		assertEquals(relativePath, this.strategy.addVersion(relativePath, this.version));
 	}
 
 }