[JCR-2953] PathParser accepts illegal paths containing curly brackets

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 2.0.5, 2.1.5, 2.2.7
• Component/s: jackrabbit-spi-commons
• Assignee: Angela Schreiber
• Reporter: Stefan Guggisberg
• Created: 02/May/11 12:07
• Updated: 23/Sep/11 14:26
• Resolved: 17/May/11 07:04

Description

o.a.jackrabbit.spi.commons.conversion.PathParser accepts the following path:

"/public/.

{.}

/private"

the normalized resulting Path object represents "/private"

that's a potential security risk.