Browse Source

Merge pull request #25415 from thenx-wei/master

* gh-25415:
  Simplify PathResourceLookupFunction
pull/25452/head
Arjen Poutsma 6 years ago
parent
commit
74d3044641
  1. 11
      spring-webmvc/src/main/java/org/springframework/web/servlet/function/PathResourceLookupFunction.java

11
spring-webmvc/src/main/java/org/springframework/web/servlet/function/PathResourceLookupFunction.java

@ -110,10 +110,7 @@ class PathResourceLookupFunction implements Function<ServerRequest, Optional<Res @@ -110,10 +110,7 @@ class PathResourceLookupFunction implements Function<ServerRequest, Optional<Res
return true;
}
}
if (path.contains("..") && StringUtils.cleanPath(path).contains("../")) {
return true;
}
return false;
return path.contains("..") && StringUtils.cleanPath(path).contains("../");
}
private boolean isResourceUnderLocation(Resource resource) throws IOException {
@ -144,10 +141,8 @@ class PathResourceLookupFunction implements Function<ServerRequest, Optional<Res @@ -144,10 +141,8 @@ class PathResourceLookupFunction implements Function<ServerRequest, Optional<Res
if (!resourcePath.startsWith(locationPath)) {
return false;
}
if (resourcePath.contains("%") && StringUtils.uriDecode(resourcePath, StandardCharsets.UTF_8).contains("../")) {
return false;
}
return true;
return !resourcePath.contains("%") ||
!StringUtils.uriDecode(resourcePath, StandardCharsets.UTF_8).contains("../");
}

Loading…
Cancel
Save