This is an automated email from the ASF dual-hosted git repository.
rmaucher pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new 55a424d228 Validate resource paths to avoid exceptions
55a424d228 is described below
commit 55a424d228b7ad7b65c03689aebe6419c0df6738
Author: remm <[email protected]>
AuthorDate: Mon Aug 31 14:06:37 2026 +0200
Validate resource paths to avoid exceptions
Returning a resource not found is better here.
---
java/org/apache/catalina/valves/rewrite/ResolverImpl.java | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
b/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
index 5689d6476f..2ad556e853 100644
--- a/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
+++ b/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
@@ -434,6 +434,12 @@ public class ResolverImpl extends Resolver {
@Override
public boolean resolveResource(int type, String name) {
+ if (name == null || !name.startsWith("/")) {
+ return false;
+ }
+ if (org.apache.tomcat.util.http.RequestUtil.normalize(name) == null) {
+ return false;
+ }
WebResourceRoot resources = request.getContext().getResources();
WebResource resource = resources.getResource(name);
if (!resource.exists()) {
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
