spring-projects / spring-projects/spring-security
spring-boot-starter-webflux to reduce path traversal capability
Open
Nobody has claimed this yet.
status: waiting-for-triage
type: enhancement
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Expected Behavior
Reject path traversal url in Spring WebFlux, e.g. GET /download/..%2F..%2Fpasswords
We'd better add HttpFirewall to WebFlux as well.
Current Behavior
Current behavior allows downloading files with relative path.
Context
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing WebFlux request path handling and the existing HttpFirewall design. Verify that the encoded traversal request in the issue is rejected while ordinary download paths remain usable. The issue names no files or tests, so locating the relevant integration points and adding regression coverage will require project familiarity.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring, spring-boot
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100