Improve static resource path check

rstoyanchev · rstoyanchev · commit 269742589ba9 · 2016-06-28T16:50:32.000-04:00
diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/resource/ResourceHttpRequestHandler.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/resource/ResourceHttpRequestHandler.java
@@ -371,7 +371,7 @@ protected boolean isInvalidPath(String path) {
 				return true;
 			}
 		}
-		if (path.contains("../")) {
+		if (path.contains("..")) {
 			path = StringUtils.cleanPath(path);
 			if (path.contains("../")) {
 				if (logger.isTraceEnabled()) {

Original file line number	Diff line number	Diff line change
`@@ -371,7 +371,7 @@ protected boolean isInvalidPath(String path) {`
`371`	`371`	`return true;`
`372`	`372`	`}`
`373`	`373`	`}`
`374`		`- if (path.contains("../")) {`
	`374`	`+ if (path.contains("..")) {`
`375`	`375`	`path = StringUtils.cleanPath(path);`
`376`	`376`	`if (path.contains("../")) {`
`377`	`377`	`if (logger.isTraceEnabled()) {`