private boolean isRequestForbidden ( StringBuffer path ) { boolean requestIsForbidden = false ; String matchString = path . toString ( ) ; //PM82876 Start // The fileName or dirName can have .. , check and fail for ".." in path only which can allow to serve from different location. if ( WCCustomProperties . ALLOW_DOTS_IN_NAME ) { if ( matchString . indexOf ( ".." ) > - 1 ) { if ( ( matchString . indexOf ( "/../" ) > - 1 ) || ( matchString . indexOf ( "\\..\\" ) > - 1 ) || matchString . startsWith ( "../" ) || matchString . endsWith ( "/.." ) || matchString . startsWith ( "..\\" ) || matchString . endsWith ( "\\.." ) ) { requestIsForbidden = true ; if ( com . ibm . ejs . ras . TraceComponent . isAnyTracingEnabled ( ) && logger . isLoggable ( Level . FINE ) ) logger . logp ( Level . FINE , CLASS_NAME , "isRequestForbidden" , "bad path :" + matchString ) ; } } if ( ( ! requestIsForbidden && ( matchString . endsWith ( "\\" ) || matchString . endsWith ( "." ) || matchString . endsWith ( "/" ) ) ) ) { requestIsForbidden = true ; } } else { //PM82876 End /** * Do not allow ".." to appear in a path as it allows one to serve files from anywhere within * the file system. * Also check to see if the path or URI ends with '/', '\', or '.' . * PQ44346 - Allow files on DFS to be served. */ if ( ( matchString . lastIndexOf ( ".." ) != - 1 && ( ! matchString . startsWith ( "/..." ) ) ) || matchString . endsWith ( "\\" ) // PK23475 use matchString instead of RequestURI because RequestURI is not decoded // || req.getRequestURI().endsWith(".") || matchString . endsWith ( "." ) // PK22928 // || req.getRequestURI().endsWith("/")){ || matchString . endsWith ( "/" ) ) //PK22928 { requestIsForbidden = true ; } } if ( com . ibm . ejs . ras . TraceComponent . isAnyTracingEnabled ( ) && logger . isLoggable ( Level . FINE ) ) logger . logp ( Level . FINE , CLASS_NAME , "isRequestForbidden" , "returning :" + requestIsForbidden + ", matchstring :" + matchString ) ; return requestIsForbidden ; }
returns true if request is forbidden because it contains .. etc .