OpenSource/jenkins
1
0 Fork 0
mirror of https://github.com/jenkinsci/jenkins.git synced 2026-11-03 15:15:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'security-stable-2.46' into security-stable-2.60

Browse Source
This commit is contained in:
Jesse Glick committed 2018-02-09 11:26:46 -05:00
2 parents 4aa29f8b37 9de6291580
commit 19b71d8d29
2 files changed
+4 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

core/src/main/java/hudson/Plugin.java
+1 -1
View File
@@ -228,7 +228,7 @@ public abstract class Plugin implements Saveable {
String path = req.getRestOfPath();
String pathUC = path.toUpperCase(Locale.ENGLISH);
if (path.isEmpty() || path.contains("..") || path.contains("%") || pathUC.contains("META-INF") || pathUC.contains("WEB-INF")) {
if (path.isEmpty() || path.contains("..") || path.startsWith(".") || path.contains("%") || pathUC.contains("META-INF") || pathUC.contains("WEB-INF")) {
LOGGER.warning("rejecting possibly malicious " + req.getRequestURIWithQueryString());
rsp.sendError(HttpServletResponse.SC_BAD_REQUEST);
return;