[SLING-11438] Resource path consisting of %7D with multiple dots leads to path traversal

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Engine 2.9.0
• Fix Version/s: Engine 2.9.2
• Component/s: Engine
• Assignee: Karl Pauls
• Reporter: Sagar Miglani
• Created: 06/Jul/22 08:26
• Updated: 18/Jul/22 12:12
• Resolved: 13/Jul/22 09:42

Description

With changes of SLING-10225, sling-engine started considering requests consisting of resource path with %5B ([) and multiple dots as "Invalid", as it could lead to path traversal and exposure of repository content.

But same could happen with %7D (}) with multiple dots in the request resource path.

e.g: http://<HOST>:<PORT>/content/we-retail/us/en/experience.html/.%7D./.%7D./.1.json would lead to exposure of repository content stored at /content/we-retail/us