Skip to content

Commit d007e7b

Browse files
committed
Fix a bug in the removeDots implementation.
Motivation: HttpUtils#removeDots does not properly handle the C. rule of section 5.2.4 of RFC3986. When the output buffer does not contain a / it should discard the entire content of the buffer. Changes: When handling rule C in HttpUtils#removeDots, discard the output buffer when no / is present.
1 parent 03b51c6 commit d007e7b

File tree

2 files changed

+70
-6
lines changed

2 files changed

+70
-6
lines changed

src/main/java/io/vertx/core/http/impl/HttpUtils.java

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -406,16 +406,12 @@ public static String removeDots(CharSequence path) {
406406
// preserve last slash
407407
i += 3;
408408
int pos = obuf.lastIndexOf("/");
409-
if (pos != -1) {
410-
obuf.delete(pos, obuf.length());
411-
}
409+
obuf.setLength(pos == -1 ? 0 : pos);
412410
} else if (matches(path, i, "/..", true)) {
413411
path = "/";
414412
i = 0;
415413
int pos = obuf.lastIndexOf("/");
416-
if (pos != -1) {
417-
obuf.delete(pos, obuf.length());
418-
}
414+
obuf.setLength(pos == -1 ? 0 : pos);
419415
} else if (matches(path, i, ".", true) || matches(path, i, "..", true)) {
420416
break;
421417
} else {
Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
/*
2+
* Copyright (c) 2011-2023 Contributors to the Eclipse Foundation
3+
*
4+
* This program and the accompanying materials are made available under the
5+
* terms of the Eclipse Public License 2.0 which is available at
6+
* http://www.eclipse.org/legal/epl-2.0, or the Apache License, Version 2.0
7+
* which is available at https://www.apache.org/licenses/LICENSE-2.0.
8+
*
9+
* SPDX-License-Identifier: EPL-2.0 OR Apache-2.0
10+
*/
11+
package io.vertx.core.impl;
12+
13+
import io.vertx.core.http.impl.HttpUtils;
14+
import org.junit.Test;
15+
16+
import static org.junit.Assert.assertEquals;
17+
18+
public class HttpUtilsTest {
19+
20+
@Test
21+
public void testRemoveDotSegmentsRuleA() {
22+
assertDotSegments("", "../");
23+
assertDotSegments("", "./");
24+
25+
assertDotSegments("foo", "../foo");
26+
assertDotSegments("foo", "./foo");
27+
}
28+
29+
@Test
30+
public void testRemoveDotSegmentsRuleB() {
31+
assertDotSegments("/", "/./");
32+
assertDotSegments("/", "/.");
33+
34+
assertDotSegments("/foo", "/./foo");
35+
}
36+
37+
@Test
38+
public void testRemoveDotSegmentsRuleC() {
39+
assertDotSegments("/", "/../");
40+
assertDotSegments("/foo", "/../foo");
41+
assertDotSegments("/", "/..");
42+
assertDotSegments("/", "/foo/../");
43+
assertDotSegments("/", "/foo/..");
44+
assertDotSegments("/", "foo/../");
45+
assertDotSegments("/", "foo/..");
46+
assertDotSegments("/foo/", "/foo/bar/../");
47+
assertDotSegments("/foo/", "/foo/bar/..");
48+
assertDotSegments("foo/", "foo/bar/../");
49+
assertDotSegments("foo/", "foo/bar/..");
50+
}
51+
52+
@Test
53+
public void testRemoveDotSegmentsRuleD() {
54+
assertDotSegments("", ".");
55+
assertDotSegments("", "..");
56+
}
57+
58+
@Test
59+
public void testRemoveDotSegmentsRuleE() {
60+
assertDotSegments("/foo", "/foo");
61+
assertDotSegments("foo", "foo");
62+
}
63+
64+
private static void assertDotSegments(String expected, String test) {
65+
String actual = HttpUtils.removeDots(test);
66+
assertEquals(expected, actual);
67+
}
68+
}

0 commit comments

Comments
 (0)