Skip to content

Commit 614d883

Browse files
author
drighetto
committed
Debug UT
1 parent 9fdb902 commit 614d883

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

src/main/java/eu/righettod/SecurityUtils.java

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1176,10 +1176,13 @@ public static boolean isPathSafe(String path) {
11761176
if (path != null && !path.isEmpty()) {
11771177
//URL decode the path if case of data coming from a web context
11781178
String decodedPath = applyURLDecoding(path, decodingRoundThreshold);
1179+
//Remove any path escaping sequence
1180+
decodedPath = decodedPath.replace("\\/", "/").replace("\\\\", "\\");
11791181
//Ensure that no path traversal path is present
11801182
File f = new File(decodedPath);
11811183
String canonicalPath = f.getCanonicalPath();
11821184
String absolutePath = f.getAbsolutePath();
1185+
System.out.println("---");
11831186
System.out.printf("IN PATH : %s\n", path);
11841187
System.out.printf("DECODED PATH: %s\n", decodedPath);
11851188
System.out.printf("CANONICAL PATH: %s\n", canonicalPath);

0 commit comments

Comments
 (0)