Simplified separator check within isInvalidEncodedPath

Issue: SPR-16616

spring-webmvc/src/main/java/org/springframework/web/servlet/resource/PathResourceResolver.java

@@ -285,13 +285,9 @@ public class PathResourceResolver extends AbstractResourceResolver {
 			// Use URLDecoder (vs UriUtils) to preserve potentially decoded UTF-8 chars...
 			try {
 				String decodedPath = URLDecoder.decode(resourcePath, "UTF-8");
-				int separatorIndex = decodedPath.indexOf("..") + 2;
+				if (decodedPath.contains("../") || decodedPath.contains("..\\")) {
-				if (separatorIndex > 1 && separatorIndex < decodedPath.length()) {
+					if (logger.isTraceEnabled()) {
-					char separator = decodedPath.charAt(separatorIndex);
+						logger.trace("Ignoring invalid resource path with escape sequences [" + resourcePath + "]");
-					if (separator == '/' || separator == '\\') {
-						if (logger.isTraceEnabled()) {
-							logger.trace("Resolved resource path contains \"../\" after decoding: " + resourcePath);
-						}
 					}
 					return true;
 				}

spring-webmvc/src/main/java/org/springframework/web/servlet/resource/ResourceHttpRequestHandler.java

@@ -69,24 +69,23 @@ import org.springframework.web.util.UrlPathHelper;
  * according to the guidelines of Page Speed, YSlow, etc.
  *
  * <p>The {@linkplain #setLocations "locations"} property takes a list of Spring
- * {@link Resource} locations from which static resources are allowed to
+ * {@link Resource} locations from which static resources are allowed to be served
- * be served by this handler. Resources could be served from a classpath location,
+ * by this handler. Resources could be served from a classpath location, e.g.
- * e.g. "classpath:/META-INF/public-web-resources/", allowing convenient packaging
+ * "classpath:/META-INF/public-web-resources/", allowing convenient packaging
  * and serving of resources such as .js, .css, and others in jar files.
  *
  * <p>This request handler may also be configured with a
  * {@link #setResourceResolvers(List) resourcesResolver} and
  * {@link #setResourceTransformers(List) resourceTransformer} chains to support
- * arbitrary resolution and transformation of resources being served. By default a
+ * arbitrary resolution and transformation of resources being served. By default
- * {@link PathResourceResolver} simply finds resources based on the configured
+ * a {@link PathResourceResolver} simply finds resources based on the configured
- * "locations". An application can configure additional resolvers and
+ * "locations". An application can configure additional resolvers and transformers
- * transformers such as the {@link VersionResourceResolver} which can resolve
+ * such as the {@link VersionResourceResolver} which can resolve and prepare URLs
- * and prepare URLs for resources with a version in the URL.
+ * for resources with a version in the URL.
  *
- * <p>This handler also properly evaluates the {@code Last-Modified} header (if
+ * <p>This handler also properly evaluates the {@code Last-Modified} header
- * present) so that a {@code 304} status code will be returned as appropriate,
+ * (if present) so that a {@code 304} status code will be returned as appropriate,
- * avoiding unnecessary overhead for resources that are already cached by the
+ * avoiding unnecessary overhead for resources that are already cached by the client.
- * client.
  *
  * @author Keith Donald
  * @author Jeremy Grelle