volosied commented on PR #1044: URL: https://github.com/apache/myfaces/pull/1044#issuecomment-5282494545
Hi, I removed some of the comments and simplified the implementation where possible. However, the fix ended up being more involved because there are several edge cases where a simpler approach would break existing behavior and tests. The main goal was to ensure that only valid Facelet resources within the application can be processed, while preventing access to other resources such as XML configuration files or arbitrary files. Simply blocking absolute paths is not sufficient, since behavior depends on how the resource is resolved, its location, and the URL scheme used by the container. On the surface this looks like a straightforward issue, but in practice there are a number of legitimate resource resolution scenarios that need to continue working. The implementation tries to strike a balance between addressing the security concern and preserving existing functionality. I will run TCK testing once more time, but this should be good unless you have any other concerns. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
