spring/spring-framework
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-framework.git synced 2026-09-17 16:39:29 +00:00
Code Issues Projects Releases Wiki Activity

Reinstate invalid resource location checks

Browse Source 
This checks was removed previously because the location was considered
as invalid in #36695, but they were later reinstated in #36692.

This commit also reinstates the check that prevents static resource
resolution in those locations.

Closes gh-37063
This commit is contained in:
Brian Clozel
2026-07-17 13:41:38 +02:00
parent 12d71c9a9b
commit 5ac20a8104
2 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
spring-webflux/src/main/java/org/springframework/web/reactive/resource/ResourceHandlerUtils.java
+9
View File
@@ -19,6 +19,7 @@ package org.springframework.web.reactive.resource;
import java.io.IOException;
import java.net.URLDecoder;
import java.nio.charset.StandardCharsets;
import java.util.Locale;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
@@ -182,6 +183,14 @@ public abstract class ResourceHandlerUtils {
* @return {@code true} if the path is invalid, {@code false} otherwise
*/
public static boolean isInvalidPath(String path) {
String pathLowerCase = path.toLowerCase(Locale.ROOT);
if (pathLowerCase.contains("web-inf") || pathLowerCase.contains("meta-inf")) {
if (logger.isWarnEnabled()) {
logger.warn(LogFormatUtils.formatValue(
"Path with \"WEB-INF\" or \"META-INF\": [" + path + "]", -1, true));
}
return true;
}
if (path.contains(":/")) {
String relativePath = (path.charAt(0) == '/' ? path.substring(1) : path);
if (ResourceUtils.isUrl(relativePath) || relativePath.startsWith("url:")) {