On Sat, 1 Aug 2026 07:29:08 GMT, Alan Bateman <[email protected]> wrote:
>> I added an opaque check at line 238 so that the match applies only to >> hierarchical URIs. Dot-segments are valid URI syntax so normalizing won't >> remove them, but the current prefix/exact-match logic already rejects them >> unless the pattern itself explicitly contains them. > > I think this will need another set of eyes as allowing file:/dir/* should not > allow file:/dir/../foo.dtd. Makes sense. Added path normalization to fix the issue. ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/32098#discussion_r3706656605
