From 9fcfcbe08af02f00d156c1afa18e5c43ae622972 Mon Sep 17 00:00:00 2001 From: Tara Drwenski Date: Thu, 19 Sep 2024 09:55:20 -0600 Subject: [PATCH] Allow two periods in file paths --- tds/src/main/java/thredds/util/TdsPathUtils.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tds/src/main/java/thredds/util/TdsPathUtils.java b/tds/src/main/java/thredds/util/TdsPathUtils.java index 52d6ded374..375c26931a 100644 --- a/tds/src/main/java/thredds/util/TdsPathUtils.java +++ b/tds/src/main/java/thredds/util/TdsPathUtils.java @@ -42,8 +42,8 @@ public static String extractPath(HttpServletRequest req, String removePrefix) { if (dataPath.startsWith("/")) dataPath = dataPath.substring(1); - if (dataPath.contains("..")) // LOOK what about escapes ?? - throw new IllegalArgumentException("path cannot contain '..'"); + if (dataPath.contains("../")) // LOOK what about escapes ?? + throw new IllegalArgumentException("path cannot contain '../'"); return dataPath; }