From 6ef0938a9206d0034bf4d565554ec82b9735cd23 Mon Sep 17 00:00:00 2001 From: Juergen Hoeller Date: Wed, 22 Aug 2018 14:12:39 +0200 Subject: [PATCH] Defensive URL cleaning (preserving the original URL if possible) Issue: SPR-17198 --- .../springframework/core/io/UrlResource.java | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/spring-core/src/main/java/org/springframework/core/io/UrlResource.java b/spring-core/src/main/java/org/springframework/core/io/UrlResource.java index 72945507b4..8938a9ed55 100644 --- a/spring-core/src/main/java/org/springframework/core/io/UrlResource.java +++ b/spring-core/src/main/java/org/springframework/core/io/UrlResource.java @@ -141,18 +141,20 @@ public class UrlResource extends AbstractFileResolvingResource { * Determine a cleaned URL for the given original URL. * @param originalUrl the original URL * @param originalPath the original URL path - * @return the cleaned URL + * @return the cleaned URL (possibly the original URL as-is) * @see org.springframework.util.StringUtils#cleanPath */ private URL getCleanedUrl(URL originalUrl, String originalPath) { - try { - return new URL(StringUtils.cleanPath(originalPath)); - } - catch (MalformedURLException ex) { - // Cleaned URL path cannot be converted to URL - // -> take original URL. - return originalUrl; + String cleanedPath = StringUtils.cleanPath(originalPath); + if (!cleanedPath.equals(originalPath)) { + try { + return new URL(cleanedPath); + } + catch (MalformedURLException ex) { + // Cleaned URL path cannot be converted to URL -> take original URL. + } } + return originalUrl; } /**