Skip to content
This repository has been archived by the owner on Oct 23, 2024. It is now read-only.

[SECURITY] Fix Partial Path Traversal Vulnerability #3375

Closed
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -56,8 +56,7 @@ public Resolution resource() throws IOException{
return new ErrorResolution(HttpServletResponse.SC_NOT_FOUND,"Resource not found");
}
//check if the file requested is in the path of the component
String check = file.getCanonicalPath();
if (!check.startsWith(comp.getPath())){
if (!file.getCanonicalFile().toPath().startsWith(comp.getPath())){
return new ErrorResolution(HttpServletResponse.SC_FORBIDDEN,"Not allowed to access file");
}

Expand Down