This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new 1d3cecb6ca Review "Resolve JspC resources whose path contains
URI-illegal chars..."
1d3cecb6ca is described below
commit 1d3cecb6ca3cd1099f21043ac4878314ab680337
Author: Mark Thomas <[email protected]>
AuthorDate: Fri Nov 6 10:20:58 2026 +0000
Review "Resolve JspC resources whose path contains URI-illegal chars..."
Fix the same issue for resources from resource JARs
Co-authored by: Claude / Sonnet 5.5
---
.../apache/jasper/servlet/JspCServletContext.java | 6 ++-
.../jasper/servlet/TestJspCServletContext.java | 48 ++++++++++++++++++++++
2 files changed, 53 insertions(+), 1 deletion(-)
diff --git a/java/org/apache/jasper/servlet/JspCServletContext.java
b/java/org/apache/jasper/servlet/JspCServletContext.java
index 1dfa97dda9..df3f928cb0 100644
--- a/java/org/apache/jasper/servlet/JspCServletContext.java
+++ b/java/org/apache/jasper/servlet/JspCServletContext.java
@@ -343,7 +343,11 @@ public class JspCServletContext implements ServletContext {
for (URL jarUrl : resourceJARs) {
try (Jar jar = JarFactory.newInstance(jarUrl)) {
if (jar.exists(jarPath)) {
- return new URI(jar.getURL(jarPath)).toURL();
+ // The entry name is a decoded path. Encode it so
+ // that names containing characters that are not
+ // permitted in a URI, such as a space, can be used
+ // to build the URL.
+ return new
URI(jar.getURL(encodePath(jarPath))).toURL();
}
} catch (IOException | URISyntaxException ioe) {
// Ignore
diff --git a/test/org/apache/jasper/servlet/TestJspCServletContext.java
b/test/org/apache/jasper/servlet/TestJspCServletContext.java
index 455b2e7cd2..95c2a8e6d2 100644
--- a/test/org/apache/jasper/servlet/TestJspCServletContext.java
+++ b/test/org/apache/jasper/servlet/TestJspCServletContext.java
@@ -24,6 +24,8 @@ import java.nio.file.Files;
import java.util.Collection;
import java.util.Iterator;
import java.util.Set;
+import java.util.jar.JarEntry;
+import java.util.jar.JarOutputStream;
import jakarta.servlet.descriptor.JspConfigDescriptor;
import jakarta.servlet.descriptor.JspPropertyGroupDescriptor;
@@ -206,6 +208,52 @@ public class TestJspCServletContext {
}
+ @Test
+ public void testGetResourceFromResourceJarWithUriIllegalCharacters()
throws Exception {
+ // Resources in a resource JAR whose entry name contains characters
+ // that are not permitted in a URI must also be resolved.
+ File docBase =
Files.createTempDirectory("jspc-illegal-chars-jar").toFile();
+ try {
+ File webInf = new File(docBase, "WEB-INF");
+ File lib = new File(webInf, "lib");
+ Files.createDirectories(lib.toPath());
+ Files.writeString(new File(webInf, "web.xml").toPath(),
+ "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" +
+ "<web-app xmlns=\"https://jakarta.ee/xml/ns/jakartaee\";
version=\"6.0\"/>\n",
+ StandardCharsets.UTF_8);
+ try (JarOutputStream jos = new JarOutputStream(
+ Files.newOutputStream(new File(lib,
"resources.jar").toPath()))) {
+ jos.putNextEntry(new JarEntry("META-INF/web-fragment.xml"));
+ jos.write(("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" +
+ "<web-fragment
xmlns=\"https://jakarta.ee/xml/ns/jakartaee\"; version=\"6.0\"/>\n")
+ .getBytes(StandardCharsets.UTF_8));
+ jos.closeEntry();
+ // The directory entry is what identifies this as a resource
JAR
+ jos.putNextEntry(new JarEntry("META-INF/resources/"));
+ jos.closeEntry();
+ jos.putNextEntry(new JarEntry("META-INF/resources/my
file.jsp"));
+ jos.write("<jsp/>".getBytes(StandardCharsets.UTF_8));
+ jos.closeEntry();
+ jos.putNextEntry(new
JarEntry("META-INF/resources/unicode-ü.jsp"));
+ jos.write("<jsp/>".getBytes(StandardCharsets.UTF_8));
+ jos.closeEntry();
+ }
+ JspCServletContext context = new JspCServletContext(
+ null, docBase.toURI().toURL(), null, false, false);
+
+ URL url = context.getResource("/my file.jsp");
+ Assert.assertNotNull(url);
+ try (InputStream is = url.openStream()) {
+ Assert.assertEquals("<jsp/>",
+ new String(is.readAllBytes(), StandardCharsets.UTF_8));
+ }
+ Assert.assertNotNull(context.getResource("/unicode-ü.jsp"));
+ } finally {
+ deleteRecursively(docBase);
+ }
+ }
+
+
private static void deleteRecursively(File file) {
File[] children = file.listFiles();
if (children != null) {
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
