arunmanni-ai commented on PR #1777: URL: https://github.com/apache/struts/pull/1777#issuecomment-4952417268
I replaced the denylist with a canonicalise-then-verify approach. containsMalformedPathSegment is now canonicalisePath, which normalises the path (resolves . and .., converts \ to /) and returns Optional.empty() if it escapes above root. Both findStaticResource and the WebJar split() now use the canonical form for downstream lookups. Dropped the %2e denylist and its test, and removed the now-dead setEncoding call from the test setUp. All four points addressed -- ready for review when you get a chance. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
