|
|
|
|
@ -110,10 +110,7 @@ class PathResourceLookupFunction implements Function<ServerRequest, Optional<Res
@@ -110,10 +110,7 @@ class PathResourceLookupFunction implements Function<ServerRequest, Optional<Res
|
|
|
|
|
return true; |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
if (path.contains("..") && StringUtils.cleanPath(path).contains("../")) { |
|
|
|
|
return true; |
|
|
|
|
} |
|
|
|
|
return false; |
|
|
|
|
return path.contains("..") && StringUtils.cleanPath(path).contains("../"); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
private boolean isResourceUnderLocation(Resource resource) throws IOException { |
|
|
|
|
@ -144,10 +141,8 @@ class PathResourceLookupFunction implements Function<ServerRequest, Optional<Res
@@ -144,10 +141,8 @@ class PathResourceLookupFunction implements Function<ServerRequest, Optional<Res
|
|
|
|
|
if (!resourcePath.startsWith(locationPath)) { |
|
|
|
|
return false; |
|
|
|
|
} |
|
|
|
|
if (resourcePath.contains("%") && StringUtils.uriDecode(resourcePath, StandardCharsets.UTF_8).contains("../")) { |
|
|
|
|
return false; |
|
|
|
|
} |
|
|
|
|
return true; |
|
|
|
|
return !resourcePath.contains("%") || |
|
|
|
|
!StringUtils.uriDecode(resourcePath, StandardCharsets.UTF_8).contains("../"); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|