The GitHub Actions job "Validate and test" on pekko-http.git/reject-parent-segments-get-from-resource has succeeded. Run started by GitHub user pjfanning (triggered by pjfanning).
Head commit for run: 1ba6b2ca59c57fd4d4f5d8cc94ff934fb49ce99b / PJ Fanning <[email protected]> fix: reject unsafe resource names in getFromResource Motivation: `getFromResource` passes the resource name to the class loader as given, so a name built from request input, for example `getFromResource(s"public/$name")`, can resolve to a resource outside the intended prefix through a `..` segment. #1263 documented this; 2.0.0 can reject such names by default instead. Modification: Reject a resource name that contains a `..` segment, a backslash or a NUL character, logging a warning that names the new `pekko.http.routing.reject-unsafe-resource-names` setting (default `on`). Setting it to `off` restores the 1.x behaviour, for the whole application or for part of a route via `withSettings`. Add the setting to the Scala and Java `RoutingSettings`, update the scaladoc, the directive page and the migration guide, and add MiMa filters for the new abstract settings members. Result: `getFromResource` no longer resolves `..` segments by default; a `.` segment and ordinary names are still served. Tests: sbt "http-tests/testOnly org.apache.pekko.http.scaladsl.server.directives.FileAndResourceDirectivesSpec" sbt "http/mimaReportBinaryIssues" References: Follow-up to #1263 Report URL: https://github.com/apache/pekko-http/actions/runs/42474460341 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
