Decode static resource path with UriUtils

See gh-33859
spring-projects · Nov 12, 2024 · cbe2f36 · cbe2f36
1 parent 9dabfdf
commit cbe2f36
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 24 deletions.
diff --git a/...webflux/src/main/java/org/springframework/web/reactive/resource/ResourceHandlerUtils.java b/...webflux/src/main/java/org/springframework/web/reactive/resource/ResourceHandlerUtils.java
@@ -196,23 +196,23 @@ public static boolean isInvalidPath(String path) {
 	}
 
 	private static boolean isInvalidEncodedPath(String path) {
-		if (path.contains("%")) {
-			String decodedPath = decode(path);
-			if (decodedPath.contains("%")) {
-				decodedPath = decode(decodedPath);
-			}
-			if (isInvalidPath(decodedPath)) {
-				return true;
-			}
-			decodedPath = normalizeInputPath(decodedPath);
-			return isInvalidPath(decodedPath);
+		String decodedPath = decode(path);
+		if (decodedPath.contains("%")) {
+			decodedPath = decode(decodedPath);
 		}
-		return false;
+		if (!StringUtils.hasText(decodedPath)) {
+			return true;
+		}
+		if (isInvalidPath(decodedPath)) {
+			return true;
+		}
+		decodedPath = normalizeInputPath(decodedPath);
+		return isInvalidPath(decodedPath);
 	}
 
 	private static String decode(String path) {
 		try {
-			return URLDecoder.decode(path, StandardCharsets.UTF_8);
+			return UriUtils.decode(path, StandardCharsets.UTF_8);
 		}
 		catch (Exception ex) {
 			return "";

diff --git a/...g-webmvc/src/main/java/org/springframework/web/servlet/resource/ResourceHandlerUtils.java b/...g-webmvc/src/main/java/org/springframework/web/servlet/resource/ResourceHandlerUtils.java
@@ -32,6 +32,7 @@
 import org.springframework.util.ResourceUtils;
 import org.springframework.util.StringUtils;
 import org.springframework.web.context.support.ServletContextResource;
+import org.springframework.web.util.UriUtils;
 
 /**
  * Resource handling utility methods to share common logic between
@@ -201,23 +202,23 @@ public static boolean isInvalidPath(String path) {
 	 * @return {@code true} if the path is invalid, {@code false} otherwise
 	 */
 	private static boolean isInvalidEncodedPath(String path) {
-		if (path.contains("%")) {
-			String decodedPath = decode(path);
-			if (decodedPath.contains("%")) {
-				decodedPath = decode(decodedPath);
-			}
-			if (isInvalidPath(decodedPath)) {
-				return true;
-			}
-			decodedPath = normalizeInputPath(decodedPath);
-			return isInvalidPath(decodedPath);
+		String decodedPath = decode(path);
+		if (decodedPath.contains("%")) {
+			decodedPath = decode(decodedPath);
 		}
-		return false;
+		if (!StringUtils.hasText(decodedPath)) {
+			return true;
+		}
+		if (isInvalidPath(decodedPath)) {
+			return true;
+		}
+		decodedPath = normalizeInputPath(decodedPath);
+		return isInvalidPath(decodedPath);
 	}
 
 	private static String decode(String path) {
 		try {
-			return URLDecoder.decode(path, StandardCharsets.UTF_8);
+			return UriUtils.decode(path, StandardCharsets.UTF_8);
 		}
 		catch (Exception ex) {
 			return "";