pjfanning commented on PR #1218: URL: https://github.com/apache/pekko-http/pull/1218#issuecomment-5478773185
Updated after review: rebased onto main and pushed 1144ef34a addressing the findings. - `checkIsSafeDescendant` now catches `InvalidPathException`/`IOException` and treats such paths as not contained — previously a Windows segment like `a<b` (or `%00` on any platform, pre-existing) escaped as a 500 instead of the clean rejection, skipping the traversal warning. New directional test uses a `%00` segment; verified failing with the fix stashed. - The scaladoc above `safeDirectoryChildPath` now states the element-wise containment contract instead of the string-prefix semantics the fix removed, and notes that Windows canonicalization does not resolve NTFS symlinks/junctions — that link-escape class remains open there (pre-existing, `Path.toRealPath` would be the principled follow-up). - Symlink spec fixture no longer writes content nothing asserts on. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
