From 1a0b577bfcb9adf57ee9c1c10c3af9f3159ec76c Mon Sep 17 00:00:00 2001 From: rstoyanchev Date: Mon, 14 Oct 2024 15:50:44 +0100 Subject: [PATCH] Do not support relative static resource paths Closes gh-33687 --- .../web/reactive/resource/ResourceHandlerUtils.java | 2 +- .../web/reactive/resource/ResourceWebHandlerTests.java | 1 + .../web/servlet/resource/ResourceHandlerUtils.java | 2 +- .../web/servlet/resource/ResourceHttpRequestHandlerTests.java | 1 + 4 files changed, 4 insertions(+), 2 deletions(-) diff --git a/spring-webflux/src/main/java/org/springframework/web/reactive/resource/ResourceHandlerUtils.java b/spring-webflux/src/main/java/org/springframework/web/reactive/resource/ResourceHandlerUtils.java index 0c8e148f43..f4ff1f04ec 100644 --- a/spring-webflux/src/main/java/org/springframework/web/reactive/resource/ResourceHandlerUtils.java +++ b/spring-webflux/src/main/java/org/springframework/web/reactive/resource/ResourceHandlerUtils.java @@ -140,7 +140,7 @@ public abstract class ResourceHandlerUtils { return true; } } - if (path.contains("..") && StringUtils.cleanPath(path).contains("../")) { + if (path.contains("../")) { if (logger.isWarnEnabled()) { logger.warn(LogFormatUtils.formatValue( "Path contains \"../\" after call to StringUtils#cleanPath: [" + path + "]", -1, true)); diff --git a/spring-webflux/src/test/java/org/springframework/web/reactive/resource/ResourceWebHandlerTests.java b/spring-webflux/src/test/java/org/springframework/web/reactive/resource/ResourceWebHandlerTests.java index 4d4fd8426a..d0a7e9a813 100644 --- a/spring-webflux/src/test/java/org/springframework/web/reactive/resource/ResourceWebHandlerTests.java +++ b/spring-webflux/src/test/java/org/springframework/web/reactive/resource/ResourceWebHandlerTests.java @@ -687,6 +687,7 @@ class ResourceWebHandlerTests { testResolvePathWithTraversal(method, "../testsecret/secret.txt"); testResolvePathWithTraversal(method, "test/../../testsecret/secret.txt"); + testResolvePathWithTraversal(method, "/testsecret/test/../secret.txt"); testResolvePathWithTraversal(method, ":/../../testsecret/secret.txt"); location = new UrlResource(getClass().getResource("./test/")); diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/resource/ResourceHandlerUtils.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/resource/ResourceHandlerUtils.java index c88071e9e0..178a1e32fa 100644 --- a/spring-webmvc/src/main/java/org/springframework/web/servlet/resource/ResourceHandlerUtils.java +++ b/spring-webmvc/src/main/java/org/springframework/web/servlet/resource/ResourceHandlerUtils.java @@ -140,7 +140,7 @@ public abstract class ResourceHandlerUtils { return true; } } - if (path.contains("..") && StringUtils.cleanPath(path).contains("../")) { + if (path.contains("../")) { if (logger.isWarnEnabled()) { logger.warn(LogFormatUtils.formatValue( "Path contains \"../\" after call to StringUtils#cleanPath: [" + path + "]", -1, true)); diff --git a/spring-webmvc/src/test/java/org/springframework/web/servlet/resource/ResourceHttpRequestHandlerTests.java b/spring-webmvc/src/test/java/org/springframework/web/servlet/resource/ResourceHttpRequestHandlerTests.java index 28db86a979..5a4343c420 100644 --- a/spring-webmvc/src/test/java/org/springframework/web/servlet/resource/ResourceHttpRequestHandlerTests.java +++ b/spring-webmvc/src/test/java/org/springframework/web/servlet/resource/ResourceHttpRequestHandlerTests.java @@ -643,6 +643,7 @@ class ResourceHttpRequestHandlerTests { testInvalidPath("../testsecret/secret.txt"); testInvalidPath("test/../../testsecret/secret.txt"); testInvalidPath(":/../../testsecret/secret.txt"); + testInvalidPath("/testsecret/test/../secret.txt"); Resource location = new UrlResource(ResourceHttpRequestHandlerTests.class.getResource("./test/")); this.handler.setLocations(List.of(location));