Author: markt
Date: Wed Sep 2 20:39:00 2015
New Revision: 1700896
URL: http://svn.apache.org/r1700896
Log:
More normalization edge cases
Modified:
tomcat/trunk/java/org/apache/tomcat/util/http/RequestUtil.java
tomcat/trunk/test/org/apache/tomcat/util/http/TestRequestUtil.java
Modified: tomcat/trunk/java/org/apache/tomcat/util/http/RequestUtil.java
URL:
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/tomcat/util/http/RequestUtil.java?rev=1700896&r1=1700895&r2=1700896&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/tomcat/util/http/RequestUtil.java (original)
+++ tomcat/trunk/java/org/apache/tomcat/util/http/RequestUtil.java Wed Sep 2
20:39:00 2015
@@ -67,14 +67,6 @@ public class RequestUtil {
if (!normalized.startsWith("/"))
normalized = "/" + normalized;
- if (normalized.equals("/.")) {
- return "/";
- }
-
- if (normalized.equals("/..")) {
- return null; // Trying to go outside our context
- }
-
// Resolve occurrences of "//" in the normalized path
while (true) {
int index = normalized.indexOf("//");
@@ -106,6 +98,14 @@ public class RequestUtil {
normalized = normalized.substring(0, index2) +
normalized.substring(index + 3);
}
+ if (normalized.equals("/.")) {
+ return "/";
+ }
+
+ if (normalized.equals("/..")) {
+ return null; // Trying to go outside our context
+ }
+
// Return the normalized path that we have completed
return normalized;
}
Modified: tomcat/trunk/test/org/apache/tomcat/util/http/TestRequestUtil.java
URL:
http://svn.apache.org/viewvc/tomcat/trunk/test/org/apache/tomcat/util/http/TestRequestUtil.java?rev=1700896&r1=1700895&r2=1700896&view=diff
==============================================================================
--- tomcat/trunk/test/org/apache/tomcat/util/http/TestRequestUtil.java
(original)
+++ tomcat/trunk/test/org/apache/tomcat/util/http/TestRequestUtil.java Wed Sep
2 20:39:00 2015
@@ -87,6 +87,36 @@ public class TestRequestUtil {
doTestNormalize("..", null);
}
+ @Test
+ public void testNormalize14() {
+ doTestNormalize("//..", null);
+ }
+
+ @Test
+ public void testNormalize15() {
+ doTestNormalize("//../", null);
+ }
+
+ @Test
+ public void testNormalize16() {
+ doTestNormalize("/./..", null);
+ }
+
+ @Test
+ public void testNormalize17() {
+ doTestNormalize("/./../", null);
+ }
+
+ @Test
+ public void testNormalize18() {
+ doTestNormalize("/a/../..", null);
+ }
+
+ @Test
+ public void testNormalize19() {
+ doTestNormalize("/a/../../", null);
+ }
+
private void doTestNormalize(String input, String expected) {
assertEquals(expected,RequestUtil.normalize(input));
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
