[
https://issues.apache.org/jira/browse/WW-5645?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Arun Manni updated WW-5645:
---------------------------
Description:
buildPath() in DefaultStaticContentLoader applies URLDecoder.decode() to
resource paths that the servlet container has already decoded. This redundant
decode serves no purpose and conflicts with the servlet spec's path handling
contract.
This patch removes the unnecessary decode and the now-unused encoding
field/setter, adds a Validator.canonicalisePath() utility that normalises the
path (resolves . and .., converts \ to /) and returns Optional.empty() when the
resolved path escapes above root, wires the canonical path through both
findStaticResource() and the WebJar split() so downstream lookups use the
normalised form, documents the encoding contract on
RequestUtils.getServletPath(), and adds test coverage.
was:
buildPath() in DefaultStaticContentLoader applies URLDecoder.decode() to
resource paths that the servlet container has already decoded. This redundant
decode serves no purpose and conflicts with the servlet spec's path handling
contract.
This patch removes the unnecessary decode and the now-unused encoding
field/setter, adds a Validator.canonicalisePath() utility that normalises the
path (resolves . and .., converts \ to /) and returns Optional.empty() when the
resolved path escapes above root, wires the canonical path through both
findStaticResource() and the WebJar split() so downstream lookups use the
normalised form, documents the encoding contract on
RequestUtils.getServletPath(), and adds test coverage.
PR: https://github.com/apache/struts/pull/1777
> Canonicalise static content paths and remove redundant URL decode
> -----------------------------------------------------------------
>
> Key: WW-5645
> URL: https://issues.apache.org/jira/browse/WW-5645
> Project: Struts 2
> Issue Type: Improvement
> Components: Core
> Affects Versions: 7.2.1
> Reporter: Arun Manni
> Priority: Minor
> Fix For: 7.3.0
>
> Time Spent: 50m
> Remaining Estimate: 0h
>
> buildPath() in DefaultStaticContentLoader applies URLDecoder.decode() to
> resource paths that the servlet container has already decoded. This redundant
> decode serves no purpose and conflicts with the servlet spec's path handling
> contract.
> This patch removes the unnecessary decode and the now-unused encoding
> field/setter, adds a Validator.canonicalisePath() utility that normalises the
> path (resolves . and .., converts \ to /) and returns Optional.empty() when
> the resolved path escapes above root, wires the canonical path through both
> findStaticResource() and the WebJar split() so downstream lookups use the
> normalised form, documents the encoding contract on
> RequestUtils.getServletPath(), and adds test coverage.
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
