xaccefy commented on PR #2836: URL: https://github.com/apache/shiro/pull/2836#issuecomment-5263614041
@lprimak thanks for the patience! Reworked the fix: `getPathWithinApplication` now fails closed (throws `IllegalStateException` when the path cannot be normalized) instead of returning "/", so a traversal request can never fall through to the unfiltered container chain. Kept your catch-all fallback as defense in depth and added a test for it, plus a POC test reproducing the original bypass. Pushed the updated branch - ready for review. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
