Merge pull request #537 from tdrwenski/allow-two-periods

Allow two periods in file paths
Unidata · Sep 20, 2024 · 686002d · 686002d
2 parents ae751d3 + 9fcfcbe
commit 686002d
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/tds/src/main/java/thredds/util/TdsPathUtils.java b/tds/src/main/java/thredds/util/TdsPathUtils.java
@@ -42,8 +42,8 @@ public static String extractPath(HttpServletRequest req, String removePrefix) {
     if (dataPath.startsWith("/"))
       dataPath = dataPath.substring(1);
 
-    if (dataPath.contains("..")) // LOOK what about escapes ??
-      throw new IllegalArgumentException("path cannot contain '..'");
+    if (dataPath.contains("../")) // LOOK what about escapes ??
+      throw new IllegalArgumentException("path cannot contain '../'");
 
     return dataPath;
   }