You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2025/10/09 13:44:32 UTC
(tomcat) branch 11.0.x updated: Relax file name check since input can include paths
This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/11.0.x by this push:
new 251a934226 Relax file name check since input can include paths
251a934226 is described below
commit 251a934226036aed54a857ba49c0c94aa33b3bc9
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Thu Oct 9 14:44:03 2025 +0100
Relax file name check since input can include paths
---
.../apache/catalina/webresources/AbstractFileResourceSet.java | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/java/org/apache/catalina/webresources/AbstractFileResourceSet.java b/java/org/apache/catalina/webresources/AbstractFileResourceSet.java
index 63942002ce..c9265cf0db 100644
--- a/java/org/apache/catalina/webresources/AbstractFileResourceSet.java
+++ b/java/org/apache/catalina/webresources/AbstractFileResourceSet.java
@@ -188,13 +188,15 @@ public abstract class AbstractFileResourceSet extends AbstractResourceSet {
* Control characters (0x00-0x31) are not permitted and tend to be display strangely in log messages and
* similar.
*
- * '*', '/', '?', '\\' and '|' are also not allowed and, while they are not currently known to cause other
+ * '*', '?' and '|' are also not allowed and, while they are not currently known to cause other
* difficulties, they are checked here rather than wasting cycles trying to find an invalid file later.
*
- * Note: Characters listed in ASCII order.
+ * The file separators ('/' and '\\') are not allowed in file names but are not excluded here as paths are
+ * passed to this method.
+ *
+ * Note: Characters are listed in ASCII order.
*/
- if (c < 32 || c == '\"' || c == '*' || c == '/' || c == ':' || c == '<' || c == '>' || c == '?' || c == '\\'
- || c == '|') {
+ if (c < 32 || c == '\"' || c == '*' || c == ':' || c == '<' || c == '>' || c == '?' || c == '|') {
return true;
}
}
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org