You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by bd...@apache.org on 2015/12/11 15:30:27 UTC

svn commit: r1719430 - in /sling/trunk/bundles/commons/resourcebuilder/src: main/java/org/apache/sling/resourcebuilder/impl/ResourceBuilderImpl.java test/java/org/apache/sling/resourcebuilder/impl/ResourceBuilderImplTest.java

Author: bdelacretaz
Date: Fri Dec 11 14:30:27 2015
New Revision: 1719430

URL: http://svn.apache.org/viewvc?rev=1719430&view=rev
Log:
SLING-5356 - reject .. in paths

Modified:
    sling/trunk/bundles/commons/resourcebuilder/src/main/java/org/apache/sling/resourcebuilder/impl/ResourceBuilderImpl.java
    sling/trunk/bundles/commons/resourcebuilder/src/test/java/org/apache/sling/resourcebuilder/impl/ResourceBuilderImplTest.java

Modified: sling/trunk/bundles/commons/resourcebuilder/src/main/java/org/apache/sling/resourcebuilder/impl/ResourceBuilderImpl.java
URL: http://svn.apache.org/viewvc/sling/trunk/bundles/commons/resourcebuilder/src/main/java/org/apache/sling/resourcebuilder/impl/ResourceBuilderImpl.java?rev=1719430&r1=1719429&r2=1719430&view=diff
==============================================================================
--- sling/trunk/bundles/commons/resourcebuilder/src/main/java/org/apache/sling/resourcebuilder/impl/ResourceBuilderImpl.java (original)
+++ sling/trunk/bundles/commons/resourcebuilder/src/main/java/org/apache/sling/resourcebuilder/impl/ResourceBuilderImpl.java Fri Dec 11 14:30:27 2015
@@ -77,6 +77,9 @@ public class ResourceBuilderImpl impleme
         if(relativePath.startsWith("/")) {
             throw new IllegalArgumentException("Path is not relative:" + relativePath);
         }
+        if(relativePath.contains("..")) {
+            throw new IllegalArgumentException("Path contains invalid pattern '..': " + relativePath);
+        }
         
         final String fullPath = currentParent.getPath() + "/" + relativePath;
         final String parentPath = ResourceUtil.getParent(fullPath);

Modified: sling/trunk/bundles/commons/resourcebuilder/src/test/java/org/apache/sling/resourcebuilder/impl/ResourceBuilderImplTest.java
URL: http://svn.apache.org/viewvc/sling/trunk/bundles/commons/resourcebuilder/src/test/java/org/apache/sling/resourcebuilder/impl/ResourceBuilderImplTest.java?rev=1719430&r1=1719429&r2=1719430&view=diff
==============================================================================
--- sling/trunk/bundles/commons/resourcebuilder/src/test/java/org/apache/sling/resourcebuilder/impl/ResourceBuilderImplTest.java (original)
+++ sling/trunk/bundles/commons/resourcebuilder/src/test/java/org/apache/sling/resourcebuilder/impl/ResourceBuilderImplTest.java Fri Dec 11 14:30:27 2015
@@ -189,6 +189,11 @@ public class ResourceBuilderImplTest {
         getBuilder(testRootPath).resource("/absolute");
     }
     
+    @Test(expected=IllegalArgumentException.class)
+    public void aboveParentFails() throws Exception {
+        getBuilder(testRootPath).resource("../foo");
+    }
+    
     @Test
     public void simpleTree() throws Exception {
         getBuilder(testRootPath)