[jira] [Work logged] (WW-5645) Remove redundant URL decode and harden path handling in static content serving

[ASF GitHub Bot (Jira)]

     [ 
https://issues.apache.org/jira/browse/WW-5645?focusedWorklogId=1029647&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1029647
 ]

ASF GitHub Bot logged work on WW-5645:
--------------------------------------

                Author: ASF GitHub Bot
            Created on: 12/Jul/26 17:06
            Start Date: 12/Jul/26 17:06
    Worklog Time Spent: 10m 
      Work Description: lukaszlenart commented on PR #1777:
URL: https://github.com/apache/struts/pull/1777#issuecomment-4952032504

   Thanks for the quick turnaround — both changes look good:
   
   - **Per-segment matching** (`cd51fc690`): `containsMalformedPathSegment` now 
walks segments with `equals("..")`/`equals(".")` instead of `contains("..")`, 
so the `foo..bar.js` false positive is gone. 👍
   - **WebJar consolidation** (`cace037c8`): dropping the duplicate segment 
loop in `split()` and relying on the shared helper keeps the behavior and gives 
a single source of truth. Also nice that `Locale` is now imported rather than 
inlined.
   
   Two optional nits, non-blocking:
   
   1. `encoding` (`DefaultStaticContentLoader#encoding`) is now dead — it's 
still `@Inject`'d but nothing reads it once the `URLDecoder.decode` is gone. 
Could be dropped along with `setEncoding`.
   2. The `}` closing `validateStaticContentPath` in 
`StaticContentLoader.Validator` is indented at 7 spaces instead of 8 — trivial 
formatting.
   
   Neither blocks; happy with the direction.
   




Issue Time Tracking
-------------------

    Worklog Id:     (was: 1029647)
    Time Spent: 0.5h  (was: 20m)

> Remove redundant URL decode and harden path handling in static content serving
> ------------------------------------------------------------------------------
>
>                 Key: WW-5645
>                 URL: https://issues.apache.org/jira/browse/WW-5645
>             Project: Struts 2
>          Issue Type: Improvement
>          Components: Core
>    Affects Versions: 7.2.1
>            Reporter: Arun Manni
>            Priority: Minor
>             Fix For: 7.3.0
>
>          Time Spent: 0.5h
>  Remaining Estimate: 0h
>
> buildPath() in DefaultStaticContentLoader applies URLDecoder.decode() to 
> resource paths that the servlet container has already decoded. This 
> redundant decode serves no purpose and conflicts with the servlet spec's 
> path handling contract.
> This patch removes the unnecessary decode, adds a shared 
> Validator.containsMalformedPathSegment() utility that rejects malformed 
> path segments (dot-dot sequences, backslash separators, and 
> percent-encoded forms), applies it in both the static content and WebJar 
> serving paths, documents the encoding contract on 
> RequestUtils.getServletPath(), and adds test coverage.
> PR: https://github.com/apache/struts/pull/1777



--
This message was sent by Atlassian Jira
(v8.20.10#820010)