This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/10.1.x by this push:
new 91c8e9ecac Follow-up to resource path validation - align with
WebResources
91c8e9ecac is described below
commit 91c8e9ecaccc55db0877ad2af8302916651e8e45
Author: Mark Thomas <[email protected]>
AuthorDate: Tue Sep 1 13:53:11 2026 +0100
Follow-up to resource path validation - align with WebResources
---
java/org/apache/catalina/valves/rewrite/ResolverImpl.java | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
b/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
index 8f78cb06a1..6c0d14e311 100644
--- a/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
+++ b/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
@@ -16,6 +16,7 @@
*/
package org.apache.catalina.valves.rewrite;
+import java.io.File;
import java.io.IOException;
import java.nio.charset.Charset;
import java.security.cert.CertificateEncodingException;
@@ -35,6 +36,7 @@ import org.apache.catalina.WebResourceRoot;
import org.apache.catalina.connector.Request;
import org.apache.juli.logging.Log;
import org.apache.tomcat.util.http.FastHttpDateFormat;
+import org.apache.tomcat.util.http.RequestUtil;
import org.apache.tomcat.util.net.SSLSupport;
import org.apache.tomcat.util.net.jsse.PEMFile;
import org.apache.tomcat.util.net.openssl.ciphers.Cipher;
@@ -433,7 +435,7 @@ public class ResolverImpl extends Resolver {
if (name == null || !name.startsWith("/")) {
return false;
}
- if (org.apache.tomcat.util.http.RequestUtil.normalize(name) == null) {
+ if (RequestUtil.normalize(name, File.separatorChar == '\\') == null) {
return false;
}
WebResourceRoot resources = request.getContext().getResources();
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
