From 0232945aeee03488c824f6016ee7b381a95cedf2 Mon Sep 17 00:00:00 2001 From: Olga Maciaszek-Sharma Date: Tue, 19 Jan 2021 10:43:14 +0100 Subject: [PATCH] Add checking for "#". Add logging. --- .../zuul/filters/pre/PreDecorationFilter.java | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/spring-cloud-netflix-zuul/src/main/java/org/springframework/cloud/netflix/zuul/filters/pre/PreDecorationFilter.java b/spring-cloud-netflix-zuul/src/main/java/org/springframework/cloud/netflix/zuul/filters/pre/PreDecorationFilter.java index d38f8e7aa..6b073063c 100755 --- a/spring-cloud-netflix-zuul/src/main/java/org/springframework/cloud/netflix/zuul/filters/pre/PreDecorationFilter.java +++ b/spring-cloud-netflix-zuul/src/main/java/org/springframework/cloud/netflix/zuul/filters/pre/PreDecorationFilter.java @@ -224,10 +224,24 @@ public class PreDecorationFilter extends ZuulFilter { return forwardURI; } - private boolean insecurePath(String uri) { - return uri.contains("../"); + private boolean insecurePath(String path) { + if (StringUtils.isEmpty(path)) { + return false; + } + boolean isInvalid = path.contains(".."); + if (isInvalid && log.isWarnEnabled()) { + log.warn("Path contains \"..\""); + } + if (!isInvalid) { + isInvalid = path.contains("#"); + if (isInvalid && log.isWarnEnabled()) { + log.warn("Path contains \"#\""); + } + } + return isInvalid; } + private void addProxyHeaders(RequestContext ctx, Route route) { HttpServletRequest request = ctx.getRequest(); String host = toHostHeader(request);