mattcasters commented on PR #8306:
URL: https://github.com/apache/hop/pull/8306#issuecomment-5648788681
Thanks for the thorough review, @bamaer! All four suggestions have been
addressed:
1. **Pragmatic CSP added**: Responses now include `Content-Security-Policy:
connect-src 'none'; form-action 'none'; base-uri 'none'`, blocking API
fetch/XHR escalation, form submission, and base URI tampering while keeping
in-page script execution intact for tab title extraction (`document.title`).
2. **Session fixation rotation fix**: Dropped the stored HTTP session ID in
`ExplorerFileLease` and derived it dynamically from
`uiSession.getHttpSession().getId()` at check time so that session ID rotations
on authentication don't cause 404s.
3. **Path decoding normalized**: Treated servlet request path info as
already decoded (per servlet spec) and removed redundant `URLDecoder.decode()`
passes. Escaped `%` as `%25` when resolving paths in HopVfs to properly handle
filenames containing `%` (e.g. `100% done.html` and `a%20b.html`).
4. **Anchored scheme prefix check**: Replaced the substring `contains(":")`
test in `sanitizeRelativePath` with an anchored prefix check on the first path
segment (`^[a-zA-Z]:.*` Windows drive or scheme prefix ending with `:`),
allowing valid Linux/macOS filenames containing colons like
`report:2026-09-11.html`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
