This is an automated email from the ASF dual-hosted git repository.
rmaucher pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new 3319ae9086 Validate resource paths to avoid exceptions
3319ae9086 is described below
commit 3319ae9086c2c2378092528e3c5b83c599e3a592
Author: remm <[email protected]>
AuthorDate: Mon Aug 31 14:06:37 2026 +0200
Validate resource paths to avoid exceptions
Returning a resource not found is better here.
---
java/org/apache/catalina/valves/rewrite/ResolverImpl.java | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
b/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
index c3794df54a..957defdfbd 100644
--- a/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
+++ b/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
@@ -379,6 +379,12 @@ public class ResolverImpl extends Resolver {
@Override
public boolean resolveResource(int type, String name) {
+ if (name == null || !name.startsWith("/")) {
+ return false;
+ }
+ if (org.apache.tomcat.util.http.RequestUtil.normalize(name) == null) {
+ return false;
+ }
WebResourceRoot resources = request.getContext().getResources();
WebResource resource = resources.getResource(name);
if (!resource.exists()) {
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
