Skip to content

Commit f59ea61

Browse files
committed
Simplified separator check within isInvalidEncodedPath
Issue: SPR-16616
1 parent c60cefa commit f59ea61

File tree

1 file changed

+1
-10
lines changed

1 file changed

+1
-10
lines changed

spring-webmvc/src/main/java/org/springframework/web/servlet/resource/PathResourceResolver.java

+1-10
Original file line numberDiff line numberDiff line change
@@ -284,16 +284,7 @@ private boolean isInvalidEncodedPath(String resourcePath) {
284284
// Use URLDecoder (vs UriUtils) to preserve potentially decoded UTF-8 chars...
285285
try {
286286
String decodedPath = URLDecoder.decode(resourcePath, "UTF-8");
287-
int separatorIndex = decodedPath.indexOf("..") + 2;
288-
if (separatorIndex > 1 && separatorIndex < decodedPath.length()) {
289-
char separator = decodedPath.charAt(separatorIndex);
290-
if (separator == '/' || separator == '\\') {
291-
if (logger.isTraceEnabled()) {
292-
logger.trace("Resolved resource path contains \"../\" after decoding: " + resourcePath);
293-
}
294-
}
295-
return true;
296-
}
287+
return (decodedPath.contains("../") || decodedPath.contains("..\\"));
297288
}
298289
catch (UnsupportedEncodingException ex) {
299290
// Should never happen...

0 commit comments

Comments
 (0)