This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new 7b3ba12c59 Follow-up to resource path validation - align with
WebResources
7b3ba12c59 is described below
commit 7b3ba12c597ec90eb7d2dbcfd55844fc885a6c06
Author: Mark Thomas <[email protected]>
AuthorDate: Tue Sep 1 13:53:11 2026 +0100
Follow-up to resource path validation - align with WebResources
---
java/org/apache/catalina/valves/rewrite/ResolverImpl.java | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
b/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
index 957defdfbd..cb6a54793f 100644
--- a/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
+++ b/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
@@ -16,6 +16,7 @@
*/
package org.apache.catalina.valves.rewrite;
+import java.io.File;
import java.io.IOException;
import java.nio.charset.Charset;
import java.security.cert.CertificateEncodingException;
@@ -35,6 +36,7 @@ import org.apache.catalina.WebResourceRoot;
import org.apache.catalina.connector.Request;
import org.apache.juli.logging.Log;
import org.apache.tomcat.util.http.FastHttpDateFormat;
+import org.apache.tomcat.util.http.RequestUtil;
import org.apache.tomcat.util.net.SSLSupport;
import org.apache.tomcat.util.net.jsse.PEMFile;
import org.apache.tomcat.util.net.openssl.ciphers.Cipher;
@@ -382,7 +384,7 @@ public class ResolverImpl extends Resolver {
if (name == null || !name.startsWith("/")) {
return false;
}
- if (org.apache.tomcat.util.http.RequestUtil.normalize(name) == null) {
+ if (RequestUtil.normalize(name, File.separatorChar == '\\') == null) {
return false;
}
WebResourceRoot resources = request.getContext().getResources();
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
