From 6e3dc633f03cf734fa8480c9a27bb37bba739de3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9bastien=20Deleuze?= Date: Mon, 6 Jul 2026 18:15:11 +0200 Subject: [PATCH] Reject backslashes in SpringTemplateLoader template names Closes gh-37054 --- .../ui/freemarker/SpringTemplateLoader.java | 3 + .../freemarker/SpringTemplateLoaderTests.java | 55 +++++++++++++++++++ 2 files changed, 58 insertions(+) create mode 100644 spring-context-support/src/test/java/org/springframework/ui/freemarker/SpringTemplateLoaderTests.java diff --git a/spring-context-support/src/main/java/org/springframework/ui/freemarker/SpringTemplateLoader.java b/spring-context-support/src/main/java/org/springframework/ui/freemarker/SpringTemplateLoader.java index 0ea01d1afe8..cf77794e610 100644 --- a/spring-context-support/src/main/java/org/springframework/ui/freemarker/SpringTemplateLoader.java +++ b/spring-context-support/src/main/java/org/springframework/ui/freemarker/SpringTemplateLoader.java @@ -72,6 +72,9 @@ public class SpringTemplateLoader implements TemplateLoader { if (logger.isDebugEnabled()) { logger.debug("Looking for FreeMarker template with name [" + name + "]"); } + if (name.indexOf('\\') != -1) { + return null; + } Resource resource = this.resourceLoader.getResource(this.templateLoaderPath + name); return (resource.exists() ? resource : null); } diff --git a/spring-context-support/src/test/java/org/springframework/ui/freemarker/SpringTemplateLoaderTests.java b/spring-context-support/src/test/java/org/springframework/ui/freemarker/SpringTemplateLoaderTests.java new file mode 100644 index 00000000000..5e7a127575e --- /dev/null +++ b/spring-context-support/src/test/java/org/springframework/ui/freemarker/SpringTemplateLoaderTests.java @@ -0,0 +1,55 @@ +/* + * Copyright 2002-present the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.ui.freemarker; + +import java.io.File; +import java.nio.file.Files; +import java.nio.file.Path; + +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.io.TempDir; + +import org.springframework.core.io.DefaultResourceLoader; + +import static org.assertj.core.api.Assertions.assertThat; + +/** + * Tests for {@link SpringTemplateLoader}. + * + * @author Sébastien Deleuze + */ +class SpringTemplateLoaderTests { + + @Test + void findTemplateSourceResolvesTemplateInsidePath(@TempDir Path tempDir) throws Exception { + Path templates = Files.createDirectory(tempDir.resolve("templates")); + Files.writeString(templates.resolve("hello.ftl"), "Hello"); + SpringTemplateLoader loader = new SpringTemplateLoader(new DefaultResourceLoader(), + "file:" + templates.toAbsolutePath() + File.separator); + assertThat(loader.findTemplateSource("hello.ftl")).isNotNull(); + } + + @Test + void findTemplateSourceRejectsBackslash(@TempDir Path tempDir) throws Exception { + Path templates = Files.createDirectory(tempDir.resolve("templates")); + Files.writeString(tempDir.resolve("other.txt"), "other"); + SpringTemplateLoader loader = new SpringTemplateLoader(new DefaultResourceLoader(), + "file:" + templates.toAbsolutePath() + File.separator); + assertThat(loader.findTemplateSource("..\\other.txt")).isNull(); + } + +}