libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases Packages Activity Actions

Change order of absolute path and normalize in the theme folder (#34153)

Browse source 
Closes #34028

Signed-off-by: rmartinc <rmartinc@redhat.com>
This commit is contained in:
Ricardo Martin 2024-10-22 09:53:30 +02:00 committed by GitHub
parent 271e749c82
commit a84a2c2ac2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
services/src/main/java/org/keycloak/theme/ResourceLoader.java
View file

@ -36,7 +36,7 @@ public class ResourceLoader {
if (root == null || resource == null) { if (root == null || resource == null) {
return null; return null;
} }
Path rootPath = root.toPath().normalize().toAbsolutePath(); Path rootPath = root.toPath().toAbsolutePath().normalize();
Path resourcePath = rootPath.resolve(resource).normalize().toAbsolutePath(); Path resourcePath = rootPath.resolve(resource).normalize().toAbsolutePath();
if (resourcePath.startsWith(rootPath)) { if (resourcePath.startsWith(rootPath)) {
return resourcePath.toFile(); return resourcePath.toFile();

5
services/src/test/java/org/keycloak/theme/ResourceLoaderTest.java
View file

@ -9,6 +9,7 @@ import java.io.IOException;
import java.io.InputStream; import java.io.InputStream;
import java.nio.file.Files; import java.nio.file.Files;
import java.nio.file.Path; import java.nio.file.Path;
import java.nio.file.Paths;
public class ResourceLoaderTest { public class ResourceLoaderTest {
@ -48,6 +49,10 @@ public class ResourceLoaderTest {
assertFileAsStream(parent, DOUBLE + "myresource.css", false, false); assertFileAsStream(parent, DOUBLE + "myresource.css", false, false);
assertFileAsStream(new File(tempDirectory.toFile(), "test/../resources/"), "myresource.css", true, true); assertFileAsStream(new File(tempDirectory.toFile(), "test/../resources/"), "myresource.css", true, true);
// relativize tmp folder to the current working directory, something like ../../../tmp/path
Path relativeParent = Paths.get(".").toAbsolutePath().relativize(parent.toPath());
assertFileAsStream(relativeParent.toFile(), "myresource.css", true, true);
} }
private void assertResourceAsStream(String parent, String resource, boolean expectValid, boolean expectResourceToExist) throws IOException { private void assertResourceAsStream(String parent, String resource, boolean expectValid, boolean expectResourceToExist) throws IOException {