Prevent path injection using ".." in object URLs

[lolepezy]

No description provided.

[lolepezy]

I am not sure what is a better way to go around the

path.toFile().getCanonicalFile().toPath());

It looks quite ugly, but path.toRealPath and path.toAbsolutePath do not have the same effect.

[bjpbakker]

I am not sure what is a better way to go around the

path.toFile().getCanonicalFile().toPath());

It looks quite ugly, but path.toRealPath and path.toAbsolutePath do not have the same effect.

Probably the better way is to just normalize the paths. toRealPath has side effects by looking up actual FS paths, which is unwanted in these filters.

[ties]

I am not sure what is a better way to go around the

path.toFile().getCanonicalFile().toPath());

It looks quite ugly, but path.toRealPath and path.toAbsolutePath do not have the same effect.

Probably the better way is to just normalize the paths. toRealPath has side effects by looking up actual FS paths, which is unwanted in these filters.

From a quick google query, Path.normalize + Path.startsWith seem to be the way to go.