[jira] [Created] (WW-5645) Remove redundant URL decode and harden path handling in static content serving

["Arun Manni (Jira)" <ji...@apache.org>]

Arun Manni created WW-5645:
------------------------------

             Summary: Remove redundant URL decode and harden path handling in static content serving
                 Key: WW-5645
                 URL: https://issues.apache.org/jira/browse/WW-5645
             Project: Struts 2
          Issue Type: Improvement
          Components: Core
    Affects Versions: 7.2.1
            Reporter: Arun Manni


buildPath() in DefaultStaticContentLoader applies URLDecoder.decode() to 
resource paths that the servlet container has already decoded. This 
redundant decode serves no purpose and conflicts with the servlet spec's 
path handling contract.

This patch removes the unnecessary decode, adds a shared 
Validator.containsMalformedPathSegment() utility that rejects malformed 
path segments (dot-dot sequences, backslash separators, and 
percent-encoded forms), applies it in both the static content and WebJar 
serving paths, documents the encoding contract on 
RequestUtils.getServletPath(), and adds test coverage.

PR: https://github.com/apache/struts/pull/1777



--
This message was sent by Atlassian Jira
(v8.20.10#820010)