Details
-
Task
-
Resolution: Fixed
-
Major
-
16.10.6
-
None
-
Unit
-
Unknown
-
N/A
-
N/A
-
Description
In an application server, ClassLoader#getResource and ClassLoader#getResourceAsStream can be fooled by path traversal syntaxes (../) to go read files which are not really support to be part of the classloader.
To make it easier to avoid this problem, it would be nice to produce a tool with a protection against that.