Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove support for relative paths in static resource handling #33687

Closed
rstoyanchev opened this issue Oct 11, 2024 · 0 comments
Closed

Remove support for relative paths in static resource handling #33687

rstoyanchev opened this issue Oct 11, 2024 · 0 comments
Assignees
@rstoyanchev
Labels
in: web Issues in web modules (web, webmvc, webflux, websocket) type: enhancement A general enhancement
Milestone
6.2.0-RC2

Comments

@rstoyanchev
Copy link
Contributor

Following thes updates to URL parsing in #33639, it's clear that with the WhatWg URL Living Standard spec, there is no good reason to expect URL paths that are not normalized. Those have been a source of security issues, and while we have protections against them in static resource handling, and they are also rejected by the Spring Security firewall, we can now drop support for them altogether going forward.
@rstoyanchev rstoyanchev added in: web Issues in web modules (web, webmvc, webflux, websocket) type: enhancement A general enhancement labels Oct 11, 2024
@rstoyanchev rstoyanchev added this to the 6.2.0-RC2 milestone Oct 11, 2024
@rstoyanchev rstoyanchev self-assigned this Oct 11, 2024
@rstoyanchev rstoyanchev mentioned this issue Oct 11, 2024
Closed
rstoyanchev added a commit that referenced this issue Oct 14, 2024
@rstoyanchev
Update valid path checks for double encoding
7d3a3d3 
See gh-33687
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@rstoyanchev rstoyanchev

Labels
in: web Issues in web modules (web, webmvc, webflux, websocket) type: enhancement A general enhancement
Projects
None yet
Milestone
6.2.0-RC2
Development

No branches or pull requests
1 participant
@rstoyanchev