[
https://issues.apache.org/jira/browse/WW-5645?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Arun Manni updated WW-5645:
---------------------------
Description:
buildPath() in DefaultStaticContentLoader applies URLDecoder.decode() to
resource paths that the servlet container has already decoded. This redundant
decode serves no purpose and conflicts with the servlet spec's path handling
contract.
This patch removes the unnecessary decode and the now-unused encoding
field/setter, adds a Validator.canonicalisePath() utility that normalises the
path (resolves . and .., converts \ to /) and returns Optional.empty() when the
resolved path escapes above root, wires the canonical path through both
findStaticResource() and the WebJar split() so downstream lookups use the
normalised form, documents the encoding contract on
RequestUtils.getServletPath(), and adds test coverage.
PR: https://github.com/apache/struts/pull/1777
was:
buildPath() in DefaultStaticContentLoader applies URLDecoder.decode() to
resource paths that the servlet container has already decoded. This
redundant decode serves no purpose and conflicts with the servlet spec's
path handling contract.
This patch removes the unnecessary decode, adds a shared
Validator.containsMalformedPathSegment() utility that rejects malformed
path segments (dot-dot sequences, backslash separators, and
percent-encoded forms), applies it in both the static content and WebJar
serving paths, documents the encoding contract on
RequestUtils.getServletPath(), and adds test coverage.
PR: https://github.com/apache/struts/pull/1777
> Canonicalise static content paths and remove redundant URL decode
> -----------------------------------------------------------------
>
> Key: WW-5645
> URL: https://issues.apache.org/jira/browse/WW-5645
> Project: Struts 2
> Issue Type: Improvement
> Components: Core
> Affects Versions: 7.2.1
> Reporter: Arun Manni
> Priority: Minor
> Fix For: 7.3.0
>
> Time Spent: 50m
> Remaining Estimate: 0h
>
> buildPath() in DefaultStaticContentLoader applies URLDecoder.decode() to
> resource paths that the servlet container has already decoded. This redundant
> decode serves no purpose and conflicts with the servlet spec's path handling
> contract.
> This patch removes the unnecessary decode and the now-unused encoding
> field/setter, adds a Validator.canonicalisePath() utility that normalises the
> path (resolves . and .., converts \ to /) and returns Optional.empty() when
> the resolved path escapes above root, wires the canonical path through both
> findStaticResource() and the WebJar split() so downstream lookups use the
> normalised form, documents the encoding contract on
> RequestUtils.getServletPath(), and adds test coverage.
> PR: https://github.com/apache/struts/pull/1777
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
