arunmanni-ai opened a new pull request, #1777:
URL: https://github.com/apache/struts/pull/1777
The `buildPath()` method in `DefaultStaticContentLoader` applied
`URLDecoder.decode()` to resource paths that the servlet container
had already decoded. This redundant decode served no purpose and
conflicted with the servlet spec's path handling contract.
This patch:
- Removes the unnecessary `URLDecoder.decode()` call from `buildPath()`
- Adds a shared `Validator.containsMalformedPathSegment()` utility
that rejects dot-dot sequences, backslash separators, and
percent-encoded forms that have no place in normalised resource paths
- Applies the check in both the static content and WebJar serving paths
- Documents the encoding contract on `RequestUtils.getServletPath()`
- Adds test coverage for malformed path rejection
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
