lprimak commented on code in PR #2836:
URL: https://github.com/apache/shiro/pull/2836#discussion_r3778686917
##########
web/src/main/java/org/apache/shiro/web/util/WebUtils.java:
##########
@@ -116,9 +116,18 @@ private WebUtils() {
*
* @param request current HTTP request
* @return the path within the web application
+ * @throws IllegalStateException if the path cannot be normalized, e.g.
when it
+ * traverses above the root ({@code "/.."}). Callers must fail closed
instead of
+ * operating on a {@code null} path, which would otherwise bypass the
filter chain.
*/
public static String getPathWithinApplication(HttpServletRequest request) {
- return normalize(removeSemicolon(getServletPath(request) +
getPathInfo(request)));
+ String servletPath = getServletPath(request);
+ String pathInfo = getPathInfo(request);
+ String path = normalize(removeSemicolon(servletPath + pathInfo));
+ if (path == null) {
Review Comment:
also add `|| path.isEmpty()` here
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
