This is an automated email from the ASF dual-hosted git repository. lukaszlenart pushed a commit to branch WW-5640-webjars-support in repository https://gitbox.apache.org/repos/asf/struts.git
commit 852268f007306338b13a8d13fc7a167621c69093 Author: Lukasz Lenart <[email protected]> AuthorDate: Wed Jul 1 11:54:02 2026 +0200 WW-5640 fix: address final review (log level, resolveUrl traversal test, javadoc) Co-Authored-By: Claude Opus 4.8 <[email protected]> --- core/src/main/java/org/apache/struts2/components/WebJar.java | 4 ++-- .../org/apache/struts2/webjars/DefaultWebJarUrlProviderTest.java | 6 ++++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/core/src/main/java/org/apache/struts2/components/WebJar.java b/core/src/main/java/org/apache/struts2/components/WebJar.java index 2041fe390..c18538a42 100644 --- a/core/src/main/java/org/apache/struts2/components/WebJar.java +++ b/core/src/main/java/org/apache/struts2/components/WebJar.java @@ -39,7 +39,7 @@ import java.util.Optional; * * <b>Examples</b> * <pre> - * <link rel="stylesheet" href="<s:webjar path="bootstrap/css/bootstrap.min.css"/>"> + * <link rel="stylesheet" href="<s:webjar path="bootstrap/css/bootstrap.min.css" />" /> * <@s.webjar path="jquery/jquery.min.js"/> * </pre> */ @@ -80,7 +80,7 @@ public class WebJar extends ContextBean { try { writer.write(url.get()); } catch (IOException e) { - LOG.info("Could not write WebJar URL for path '{}'", path, e); + LOG.error("Could not write WebJar URL for path '{}'", path, e); } } } diff --git a/core/src/test/java/org/apache/struts2/webjars/DefaultWebJarUrlProviderTest.java b/core/src/test/java/org/apache/struts2/webjars/DefaultWebJarUrlProviderTest.java index 6f207eee6..6d8d2d37e 100644 --- a/core/src/test/java/org/apache/struts2/webjars/DefaultWebJarUrlProviderTest.java +++ b/core/src/test/java/org/apache/struts2/webjars/DefaultWebJarUrlProviderTest.java @@ -69,6 +69,12 @@ public class DefaultWebJarUrlProviderTest { assertThat(provider.resolveResourcePath("../jquery/jquery.min.js")).isEmpty(); } + @Test + public void resolveUrlRejectsTraversal() { + assertThat(provider.resolveUrl("jquery/../../../etc/passwd", request)).isEmpty(); + assertThat(provider.resolveUrl("../jquery/jquery.min.js", request)).isEmpty(); + } + @Test public void allowlistBlocksNonListedWebjar() { provider.setAllowlist("bootstrap");
