Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-07-14 14:23:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix StrictHttpFirewall rules

Browse Source 
Fixes: gh-5093
This commit is contained in:
Rob Winch 2018-03-08 21:29:31 -06:00
parent 93118f4e91
commit 5854f00977
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java
View File

@ -340,7 +340,7 @@ public class StrictHttpFirewall implements HttpFirewall {
return true; return true;
} }
if (path.indexOf("//") > 0) { if (path.indexOf("//") > -1) {
return false; return false;
} }

3
web/src/test/java/org/springframework/security/web/firewall/StrictHttpFirewallTests.java
View File

@ -26,7 +26,8 @@ import static org.assertj.core.api.Assertions.fail;
*/ */
public class StrictHttpFirewallTests { public class StrictHttpFirewallTests {
public String[] unnormalizedPaths = { "/..", "/./path/", "/path/path/.", "/path/path//.", "./path/../path//.", public String[] unnormalizedPaths = { "/..", "/./path/", "/path/path/.", "/path/path//.", "./path/../path//.",
"./path", ".//path", ".", "/path//" }; "./path", ".//path", ".", "//path", "//path/path", "//path//path", "/path//path" };
private StrictHttpFirewall firewall = new StrictHttpFirewall(); private StrictHttpFirewall firewall = new StrictHttpFirewall();