undertow/CVE-2019-10184-pre.patch
starlet-dx de7631dc7d Fix CVE-2017-12196,CVE-2019-10184 and CVE-2019-10212
(cherry picked from commit 329cb3a1e2aa3f6f9845ab228d2034edbb7a53f4)
2025-03-04 11:38:53 +08:00

24 lines
1.3 KiB
Diff

From 16833ca1ea7e2235e40129078f94f935b3f7e446 Mon Sep 17 00:00:00 2001
From: Stuart Douglas <stuart.w.douglas@gmail.com>
Date: Thu, 15 Sep 2016 09:50:02 +1000
Subject: [PATCH] UNDERTOW-837 Incorrect welcome file rewrite outside of the
root directory
---
.../io/undertow/servlet/handlers/ServletInitialHandler.java | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/servlet/src/main/java/io/undertow/servlet/handlers/ServletInitialHandler.java b/servlet/src/main/java/io/undertow/servlet/handlers/ServletInitialHandler.java
index 3873ea6c32..0e8e3ecb15 100644
--- a/servlet/src/main/java/io/undertow/servlet/handlers/ServletInitialHandler.java
+++ b/servlet/src/main/java/io/undertow/servlet/handlers/ServletInitialHandler.java
@@ -170,7 +170,7 @@ public void handleRequest(final HttpServerExchange exchange) throws Exception {
//this can only happen if the path ends with a /
//otherwise there would be a redirect instead
exchange.setRelativePath(info.getRewriteLocation());
- exchange.setRequestPath(exchange.getRequestPath() + info.getRewriteLocation());
+ exchange.setRequestPath(exchange.getResolvedPath() + info.getRewriteLocation());
}
final HttpServletResponseImpl response = new HttpServletResponseImpl(exchange, servletContext);