Skip to content

Fix incomplete path traversal check in FileResponse (nwu + nwu2)#1749

Closed
Copilot wants to merge 3 commits intot8from
copilot/sub-pr-1747
Closed

Fix incomplete path traversal check in FileResponse (nwu + nwu2)#1749
Copilot wants to merge 3 commits intot8from
copilot/sub-pr-1747

Conversation

Copy link
Contributor

Copilot AI commented Mar 9, 2026

The .. traversal guard only checked ../ (forward slash), missing ..\ (Windows backslash separator). While the canonical path comparison is the authoritative defense, the explicit check should be comprehensive on all platforms.

Changes

  • src/com/nwu/httpd/responses/FileResponse.java and src/com/nwu2/httpd/responses/FileResponse.java
    • Added || relativeUri.indexOf(".." + File.separator) >= 0 to block backslash-based traversal sequences
    • Updated error message from "Won't serve ../ for security reasons.""Won't serve .. paths for security reasons." to be platform-agnostic
// Before
if (relativeUri.startsWith("..") || relativeUri.endsWith("..")
        || relativeUri.indexOf("../") >= 0)

// After
if (relativeUri.startsWith("..") || relativeUri.endsWith("..")
        || relativeUri.indexOf("../") >= 0
        || relativeUri.indexOf(".." + File.separator) >= 0)

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Copilot AI mentioned this pull request Mar 9, 2026
Merged
…onse.java (nwu and nwu2)

Co-authored-by: nmaguiar <11761746+nmaguiar@users.noreply.github.com>
Copilot AI changed the title [WIP] Address feedback from review on pull request T8 Fix incomplete path traversal check in FileResponse (nwu + nwu2) Mar 9, 2026
@nmaguiar nmaguiar marked this pull request as ready for review March 9, 2026 10:32
@nmaguiar nmaguiar closed this Mar 9, 2026
@nmaguiar nmaguiar deleted the copilot/sub-pr-1747 branch March 9, 2026 10:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants