[SLING-10225] Files with ".." In Name Throw 400 Exception

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: Engine 2.7.4
• Fix Version/s: Engine 2.7.6
• Component/s: Engine
• Assignee: Karl Pauls
• Reporter: Dan Klco
• Created: 16/Mar/21 22:07
• Updated: 25/Jun/21 11:18
• Resolved: 31/May/21 15:41

Description

SLING-9741 and the associated PR introduced a regression where the Sling Engine will return a 400 error on requests based on the presence of ".." in the URL when not preceded by a slash.

This is an issue as file names may contain multiple periods and it is not obvious that it would cause an issue to upload a file with two periods in the name.

Reproduction steps:

• Update a Sling instance to use Engine 2.7.4
• Upload a file containing .. in the path
• Attempt to get the file or any path with the file as a suffix
• Note this returns a 400 error

Issue Links

• is caused by: SLING-9741 Invalid path decomposition in case of multiple dots
• is related to: SLING-10554 The check for valid requests should not fail on a resolution path that is null