This is an automated email from the ASF dual-hosted git repository.
rmaucher pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/10.1.x by this push:
new bee542eff7 Validate resource paths to avoid exceptions
bee542eff7 is described below
commit bee542eff73e26f96d7d31a7a1d9ab00c5560a8f
Author: remm <[email protected]>
AuthorDate: Mon Aug 31 14:06:37 2026 +0200
Validate resource paths to avoid exceptions
Returning a resource not found is better here.
---
java/org/apache/catalina/valves/rewrite/ResolverImpl.java | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
b/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
index 8f5ddffb58..8f78cb06a1 100644
--- a/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
+++ b/java/org/apache/catalina/valves/rewrite/ResolverImpl.java
@@ -430,6 +430,12 @@ public class ResolverImpl extends Resolver {
@Override
public boolean resolveResource(int type, String name) {
+ if (name == null || !name.startsWith("/")) {
+ return false;
+ }
+ if (org.apache.tomcat.util.http.RequestUtil.normalize(name) == null) {
+ return false;
+ }
WebResourceRoot resources = request.getContext().getResources();
WebResource resource = resources.getResource(name);
if (!resource.exists()) {
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
