The GitHub Actions job "Validate and test" on pekko-http.git/main has failed. Run started by GitHub user pjfanning (triggered by pjfanning).
Head commit for run: 204a2d587823f1642a7faa987cdc7cc20cd742bc / PJ Fanning <[email protected]> docs: warn that getFromResource does not filter its resource name (#1263) Motivation: `getFromResource` passes the resource name to the class loader as given. Its only guard is the trailing-slash check that stops directory resources being served; unlike `getFromResourceDirectory`, which routes the request path through `safeJoinPaths` and rejects `..` and separator characters, it applies no traversal filtering at all. An application that builds the name from request input, for example `getFromResource(s"public/$name")`, can therefore be made to resolve a resource outside the intended prefix against a directory-backed class loader. The scaladoc did not say so, and the contrast with the sibling directive makes that easy to miss. Modification: Document the behaviour on both the Scala and the Java DSL entry points, pointing at `getFromResourceDirectory` as the filtering alternative. Result: The trust boundary of the directive is stated where a caller reads it. Tests: Not run - docs only References: None - documents that getFromResource does not filter its resource name Report URL: https://github.com/apache/pekko-http/actions/runs/42470507792 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
