On Thu, 30 Jul 2026 06:20:27 GMT, Joe Wang <[email protected]> wrote:
> Refer to the CSR, this is the implementation for the Resource.Access property. > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai). src/java.xml/share/classes/jdk/xml/internal/AccessRule.java line 436: > 434: if (isDirectory) { > 435: // Path starts with this directory > 436: return testPath.startsWith(pattern + "/") || > testPath.equals(pattern); Is startsWith sufficient here? I would assume testPath needs to be filtered first for ".." and other dangerous elements. ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/32098#discussion_r3683171104
