undertow/CVE-2019-10184-pre.patch

24 lines
1.3 KiB
Diff
Raw Normal View History

From 16833ca1ea7e2235e40129078f94f935b3f7e446 Mon Sep 17 00:00:00 2001
From: Stuart Douglas <stuart.w.douglas@gmail.com>
Date: Thu, 15 Sep 2016 09:50:02 +1000
Subject: [PATCH] UNDERTOW-837 Incorrect welcome file rewrite outside of the
root directory
---
.../io/undertow/servlet/handlers/ServletInitialHandler.java | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/servlet/src/main/java/io/undertow/servlet/handlers/ServletInitialHandler.java b/servlet/src/main/java/io/undertow/servlet/handlers/ServletInitialHandler.java
index 3873ea6c32..0e8e3ecb15 100644
--- a/servlet/src/main/java/io/undertow/servlet/handlers/ServletInitialHandler.java
+++ b/servlet/src/main/java/io/undertow/servlet/handlers/ServletInitialHandler.java
@@ -170,7 +170,7 @@ public void handleRequest(final HttpServerExchange exchange) throws Exception {
//this can only happen if the path ends with a /
//otherwise there would be a redirect instead
exchange.setRelativePath(info.getRewriteLocation());
- exchange.setRequestPath(exchange.getRequestPath() + info.getRewriteLocation());
+ exchange.setRequestPath(exchange.getResolvedPath() + info.getRewriteLocation());
}
final HttpServletResponseImpl response = new HttpServletResponseImpl(exchange, servletContext);