arunmanni-ai commented on PR #1777: URL: https://github.com/apache/struts/pull/1777#issuecomment-4955128210
Hi @lukaszlenart, The CI failures are from two new tests I added for encoded traversal (`%2e%2e`) in `DefaultWebJarUrlProvider`. The `canonicalisePath()` method currently catches literal `..` but not percent-encoded variants. I'm planning to add a check at the top of `canonicalisePath()` to reject paths containing `%2e` (case-insensitive) before the segment splitting. This keeps `buildPath()` untouched and doesn't change its contract. Wanted to check with you first — does that approach align with the design intent, or would you prefer handling it differently? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
