Hsnmohd opened a new pull request, #907:
URL: https://github.com/apache/httpcomponents-client/pull/907
**Dot-segment path parameters escape their segment in RestInvocationHandler**
`URIBuilder.appendPathSegments` encodes `/` and `%` in a `@PathParam` value
but leaves `.` and `..` as literal dot segments, so
`@Path("/api/accounts/{id}/profile")` called with `id = ".."` sends `GET
/api/accounts/../profile`, which resolves to `/api/profile` under RFC 3986
dot-segment removal (the same issue Retrofit fixed as CVE-2018-1000850).
Rejected the two values next to the existing null check; percent-encoding the
dots would not help since normalization treats `%2E` as `.`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
