Arun Manni created WW-5645:
------------------------------
Summary: Remove redundant URL decode and harden path handling in
static content serving
Key: WW-5645
URL: https://issues.apache.org/jira/browse/WW-5645
Project: Struts 2
Issue Type: Improvement
Components: Core
Affects Versions: 7.2.1
Reporter: Arun Manni
buildPath() in DefaultStaticContentLoader applies URLDecoder.decode() to
resource paths that the servlet container has already decoded. This
redundant decode serves no purpose and conflicts with the servlet spec's
path handling contract.
This patch removes the unnecessary decode, adds a shared
Validator.containsMalformedPathSegment() utility that rejects malformed
path segments (dot-dot sequences, backslash separators, and
percent-encoded forms), applies it in both the static content and WebJar
serving paths, documents the encoding contract on
RequestUtils.getServletPath(), and adds test coverage.
PR: https://github.com/apache/struts/pull/1777
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
