From 48880c65d1e1f4711e5e5cee328bd8fe876af5dd Mon Sep 17 00:00:00 2001 From: Greg Wilkins Date: Tue, 31 Aug 2021 08:56:27 +1000 Subject: [PATCH] Alternate fix for #6497 Signed-off-by: Greg Wilkins --- .../eclipse/jetty/server/AllowedResourceAliasChecker.java | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/jetty-server/src/main/java/org/eclipse/jetty/server/AllowedResourceAliasChecker.java b/jetty-server/src/main/java/org/eclipse/jetty/server/AllowedResourceAliasChecker.java index 0882eb03e09b..d10fb622fb55 100644 --- a/jetty-server/src/main/java/org/eclipse/jetty/server/AllowedResourceAliasChecker.java +++ b/jetty-server/src/main/java/org/eclipse/jetty/server/AllowedResourceAliasChecker.java @@ -111,17 +111,17 @@ public boolean check(String pathInContext, Resource resource) } } - protected boolean check(String pathInContext, Path path) throws Exception + protected boolean check(String pathInContext, Path path) { // Allow any aliases (symlinks, 8.3, casing, etc.) so long as // the resulting real file is allowed. - return isAllowed(path.toRealPath(FOLLOW_LINKS)); + return isAllowed(getRealPath(path)); } protected boolean isAllowed(Path path) { // If the resource doesn't exist we cannot determine whether it is protected so we assume it is. - if (Files.exists(path)) + if (path != null && Files.exists(path)) { // Walk the path parent links looking for the base resource, but failing if any steps are protected while (path != null)