This is an automated email from the ASF dual-hosted git repository.
rmaucher pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/11.0.x by this push:
new 646fca3a14 Validate resource paths to avoid exceptions
646fca3a14 is described below
commit 646fca3a14003f0a0c1bf80196271ff2d7129804
Author: remm <[email protected]>
AuthorDate: Mon Aug 31 14:06:37 2026 +0200
Validate resource paths to avoid exceptions
Returning a resource not found is better here.
---
java/org/apache/catalina/valves/rewrite/ResolverImpl.java | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
b/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
index 028d026077..a2f8c67e45 100644
--- a/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
+++ b/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
@@ -392,6 +392,12 @@ public class ResolverImpl extends Resolver {
@Override
public boolean resolveResource(int type, String name) {
+ if (name == null || !name.startsWith("/")) {
+ return false;
+ }
+ if (org.apache.tomcat.util.http.RequestUtil.normalize(name) == null) {
+ return false;
+ }
WebResourceRoot resources = request.getContext().getResources();
WebResource resource = resources.getResource(name);
if (!resource.exists()) {
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
