[spring-extensions] branch main updated: JSE-44 - Classpath resources should not be accessed by filesystem paths

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository spring-extensions.

View the commit online:
http://git.shibboleth.net/view/?p=spring-extensions.git;a=commit;h=b466e1e0ccf170ef136eb5ecf23c84d5778df3dd

The following commit(s) were added to refs/heads/main by this push:
       new  b466e1e   JSE-44 - Classpath resources should not be accessed by filesystem paths
b466e1e is described below

commit b466e1e0ccf170ef136eb5ecf23c84d5778df3dd
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Apr 7 14:45:18 2021 -0400

    JSE-44 - Classpath resources should not be accessed by filesystem paths
    
    https://issues.shibboleth.net/jira/browse/JSE-44
    
    Fix to VelocityEngineFactory.
---
 .../shibboleth/ext/spring/velocity/VelocityEngineFactory.java    | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/main/java/net/shibboleth/ext/spring/velocity/VelocityEngineFactory.java b/src/main/java/net/shibboleth/ext/spring/velocity/VelocityEngineFactory.java
index 34bd780..fd3d15c 100644
--- a/src/main/java/net/shibboleth/ext/spring/velocity/VelocityEngineFactory.java
+++ b/src/main/java/net/shibboleth/ext/spring/velocity/VelocityEngineFactory.java
@@ -311,6 +311,15 @@ public class VelocityEngineFactory {
 
             for (int i = 0; i < paths.length; i++) {
                 final String path = paths[i];
+                
+                // Fix for JSE-44, don't check classpath: locations, they're not file-based.
+                // Some containers will expand jars and trigger false positives.
+                if (path.startsWith(ResourceLoader.CLASSPATH_URL_PREFIX)) {
+                    log.debug("Using SpringResourceLoader for '{}'", path);
+                    nonFilePaths.add(path);
+                    continue;
+                }
+                
                 try {
                     final Resource resource = resourceLoader.getResource(path);
                     

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.