diff --git a/spring-webflux/src/main/java/org/springframework/web/reactive/function/server/PathResourceLookupFunction.java b/spring-webflux/src/main/java/org/springframework/web/reactive/function/server/PathResourceLookupFunction.java index d725a1e6aab1..22798eda937d 100644 --- a/spring-webflux/src/main/java/org/springframework/web/reactive/function/server/PathResourceLookupFunction.java +++ b/spring-webflux/src/main/java/org/springframework/web/reactive/function/server/PathResourceLookupFunction.java @@ -18,6 +18,7 @@ import java.io.IOException; import java.io.UncheckedIOException; +import java.io.UnsupportedEncodingException; import java.net.URLDecoder; import java.nio.charset.StandardCharsets; import java.util.function.Function; @@ -171,7 +172,7 @@ private boolean isInvalidEncodedInputPath(String path) { if (path.contains("%")) { try { // Use URLDecoder (vs UriUtils) to preserve potentially decoded UTF-8 chars - String decodedPath = URLDecoder.decode(path, StandardCharsets.UTF_8); + String decodedPath = URLDecoder.decode(path, "UTF-8"); if (isInvalidPath(decodedPath)) { return true; } @@ -180,7 +181,7 @@ private boolean isInvalidEncodedInputPath(String path) { return true; } } - catch (IllegalArgumentException ex) { + catch (IllegalArgumentException | UnsupportedEncodingException ex) { // May not be possible to decode... } } @@ -199,8 +200,8 @@ private boolean isResourceUnderLocation(Resource resource) throws IOException { resourcePath = resource.getURL().toExternalForm(); locationPath = StringUtils.cleanPath(this.location.getURL().toString()); } - else if (resource instanceof ClassPathResource classPathResource) { - resourcePath = classPathResource.getPath(); + else if (resource instanceof ClassPathResource) { + resourcePath = ((ClassPathResource) resource).getPath(); locationPath = StringUtils.cleanPath(((ClassPathResource) this.location).getPath()); } else { @@ -219,12 +220,12 @@ private boolean isInvalidEncodedResourcePath(String resourcePath) { if (resourcePath.contains("%")) { // Use URLDecoder (vs UriUtils) to preserve potentially decoded UTF-8 chars... try { - String decodedPath = URLDecoder.decode(resourcePath, StandardCharsets.UTF_8); + String decodedPath = URLDecoder.decode(resourcePath, "UTF-8"); if (decodedPath.contains("../") || decodedPath.contains("..\\")) { return true; } } - catch (IllegalArgumentException ex) { + catch (IllegalArgumentException | UnsupportedEncodingException ex) { // May not be possible to decode... } } diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/function/PathResourceLookupFunction.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/function/PathResourceLookupFunction.java index 82557b1c0fbd..83b4f8fe43fe 100644 --- a/spring-webmvc/src/main/java/org/springframework/web/servlet/function/PathResourceLookupFunction.java +++ b/spring-webmvc/src/main/java/org/springframework/web/servlet/function/PathResourceLookupFunction.java @@ -18,6 +18,7 @@ import java.io.IOException; import java.io.UncheckedIOException; +import java.io.UnsupportedEncodingException; import java.net.URLDecoder; import java.nio.charset.StandardCharsets; import java.util.Optional; @@ -164,7 +165,7 @@ private boolean isInvalidEncodedInputPath(String path) { if (path.contains("%")) { try { // Use URLDecoder (vs UriUtils) to preserve potentially decoded UTF-8 chars - String decodedPath = URLDecoder.decode(path, StandardCharsets.UTF_8); + String decodedPath = URLDecoder.decode(path, "UTF-8"); if (isInvalidPath(decodedPath)) { return true; } @@ -173,7 +174,7 @@ private boolean isInvalidEncodedInputPath(String path) { return true; } } - catch (IllegalArgumentException ex) { + catch (IllegalArgumentException | UnsupportedEncodingException ex) { // May not be possible to decode... } } @@ -196,8 +197,8 @@ else if (resource instanceof ClassPathResource) { resourcePath = ((ClassPathResource) resource).getPath(); locationPath = StringUtils.cleanPath(((ClassPathResource) this.location).getPath()); } - else if (resource instanceof ServletContextResource servletContextResource) { - resourcePath = servletContextResource.getPath(); + else if (resource instanceof ServletContextResource) { + resourcePath = ((ServletContextResource) resource).getPath(); locationPath = StringUtils.cleanPath(((ServletContextResource) this.location).getPath()); } else { @@ -216,12 +217,12 @@ private boolean isInvalidEncodedResourcePath(String resourcePath) { if (resourcePath.contains("%")) { // Use URLDecoder (vs UriUtils) to preserve potentially decoded UTF-8 chars... try { - String decodedPath = URLDecoder.decode(resourcePath, StandardCharsets.UTF_8); + String decodedPath = URLDecoder.decode(resourcePath, "UTF-8"); if (decodedPath.contains("../") || decodedPath.contains("..\\")) { return true; } } - catch (IllegalArgumentException ex) { + catch (IllegalArgumentException | UnsupportedEncodingException ex) { // May not be possible to decode... } }