On Fri, 31 Jul 2026 17:52:12 GMT, Joe Wang <[email protected]> wrote:
>> src/java.xml/share/classes/jdk/xml/internal/AccessRule.java line 436:
>>
>>> 434: if (isDirectory) {
>>> 435: // Path starts with this directory
>>> 436: return testPath.startsWith(pattern + "/") ||
>>> testPath.equals(pattern);
>>
>> Is startsWith sufficient here? I would assume testPath needs to be filtered
>> first for ".." and other dangerous elements.
>
> I added an opaque check at line 238 so that the match applies only to
> hierarchical URIs. Dot-segments are valid URI syntax so normalizing won't
> remove them, but the current prefix/exact-match logic already rejects them
> unless the pattern itself explicitly contains them.
I think this will need another set of eyes as allowing file:/dir/* should not
allow file:/dir/../foo.dtd.
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/32098#discussion_r3695010550
