WW-5645 Canonicalise static content paths and remove redundant URL decode#1777

Merged

lukaszlenart merged 19 commits into

apache:mainfrom

arunmanni-ai:harden-static-content-traversal

Jul 14, 2026

Commits on Jul 12, 2026

Fix missing closing brace in StaticContentLoader causing compile failure
arunmanni-ai
authored
Use per-segment matching in containsMalformedPathSegment to avoid false positives
arunmanni-ai
authored
Remove redundant dot-segment check now handled by containsMalformedPathSegment
arunmanni-ai
authored
Fix indentation on validateStaticContentPath closing brace
arunmanni-ai
authored
Remove unused encoding field and setter from DefaultStaticContentLoader
arunmanni-ai
authored
Replace denylist with path canonicalisation in Validator
arunmanni-ai
authored
Wire canonicalisePath into static content serving
arunmanni-ai
authored
Wire canonicalisePath into WebJar URL provider
arunmanni-ai
authored
Update tests for canonicalise approach and remove unused setEncoding call
arunmanni-ai
authored

Commits on Jul 13, 2026