This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new ce42926080 Review "Resolve JspC resources whose path contains
URI-illegal chars..."
ce42926080 is described below
commit ce42926080fe769e7ba06a1027ba46d55d2cd613
Author: Mark Thomas <[email protected]>
AuthorDate: Fri Nov 6 10:20:58 2026 +0000
Review "Resolve JspC resources whose path contains URI-illegal chars..."
Fix the same issue for resources from resource JARs
Co-authored by: Claude / Sonnet 5.5
---
.../apache/jasper/servlet/JspCServletContext.java | 6 ++-
.../jasper/servlet/TestJspCServletContext.java | 53 ++++++++++++++++++++++
2 files changed, 58 insertions(+), 1 deletion(-)
diff --git a/java/org/apache/jasper/servlet/JspCServletContext.java
b/java/org/apache/jasper/servlet/JspCServletContext.java
index cf6a5f543f..8f5ac4661c 100644
--- a/java/org/apache/jasper/servlet/JspCServletContext.java
+++ b/java/org/apache/jasper/servlet/JspCServletContext.java
@@ -343,7 +343,11 @@ public class JspCServletContext implements ServletContext {
for (URL jarUrl : resourceJARs) {
try (Jar jar = JarFactory.newInstance(jarUrl)) {
if (jar.exists(jarPath)) {
- return new URI(jar.getURL(jarPath)).toURL();
+ // The entry name is a decoded path. Encode it so
+ // that names containing characters that are not
+ // permitted in a URI, such as a space, can be used
+ // to build the URL.
+ return new
URI(jar.getURL(encodePath(jarPath))).toURL();
}
} catch (IOException | URISyntaxException ioe) {
// Ignore
diff --git a/test/org/apache/jasper/servlet/TestJspCServletContext.java
b/test/org/apache/jasper/servlet/TestJspCServletContext.java
index fa8f03c3dd..3446cd8120 100644
--- a/test/org/apache/jasper/servlet/TestJspCServletContext.java
+++ b/test/org/apache/jasper/servlet/TestJspCServletContext.java
@@ -27,6 +27,8 @@ import java.nio.file.Files;
import java.util.Collection;
import java.util.Iterator;
import java.util.Set;
+import java.util.jar.JarEntry;
+import java.util.jar.JarOutputStream;
import javax.servlet.descriptor.JspConfigDescriptor;
import javax.servlet.descriptor.JspPropertyGroupDescriptor;
@@ -182,6 +184,57 @@ public class TestJspCServletContext {
}
}
+ @Test
+ public void testGetResourceFromResourceJarWithUriIllegalCharacters()
throws Exception {
+ // Resources in a resource JAR whose entry name contains characters
+ // that are not permitted in a URI must also be resolved.
+ File docBase =
Files.createTempDirectory("jspc-illegal-chars-jar").toFile();
+ try {
+ File webInf = new File(docBase, "WEB-INF");
+ File lib = new File(webInf, "lib");
+ Files.createDirectories(lib.toPath());
+ Files.write(new File(webInf, "web.xml").toPath(),
+ ("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" +
+ "<web-app xmlns=\"https://jakarta.ee/xml/ns/jakartaee\";
version=\"6.0\"/>\n").getBytes(
+ StandardCharsets.UTF_8));
+ try (JarOutputStream jos = new JarOutputStream(
+ Files.newOutputStream(new File(lib,
"resources.jar").toPath()))) {
+ jos.putNextEntry(new JarEntry("META-INF/web-fragment.xml"));
+ jos.write(("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" +
+ "<web-fragment
xmlns=\"https://jakarta.ee/xml/ns/jakartaee\"; version=\"6.0\"/>\n")
+ .getBytes(StandardCharsets.UTF_8));
+ jos.closeEntry();
+ // The directory entry is what identifies this as a resource
JAR
+ jos.putNextEntry(new JarEntry("META-INF/resources/"));
+ jos.closeEntry();
+ jos.putNextEntry(new JarEntry("META-INF/resources/my
file.jsp"));
+ jos.write("<jsp/>".getBytes(StandardCharsets.UTF_8));
+ jos.closeEntry();
+ jos.putNextEntry(new
JarEntry("META-INF/resources/unicode-ü.jsp"));
+ jos.write("<jsp/>".getBytes(StandardCharsets.UTF_8));
+ jos.closeEntry();
+ }
+ JspCServletContext context = new JspCServletContext(
+ null, docBase.toURI().toURL(), null, false, false);
+
+ URL url = context.getResource("/my file.jsp");
+ Assert.assertNotNull(url);
+ try (InputStream is = url.openStream(); ByteArrayOutputStream out
= new ByteArrayOutputStream()) {
+ int read;
+ byte[] buf = new byte[1024];
+ while ((read = is.read(buf)) >= 0) {
+ out.write(buf, 0, read);
+ }
+ Assert.assertEquals("<jsp/>",
+ new String(out.toByteArray(), StandardCharsets.UTF_8));
+ }
+ Assert.assertNotNull(context.getResource("/unicode-ü.jsp"));
+ } finally {
+ deleteRecursively(docBase);
+ }
+ }
+
+
private static void deleteRecursively(File file) {
File[] children = file.listFiles();
if (children != null) {
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
