Re:It is incorrect to "normalize" // in HTTP URL paths
by jeroenhd on Saturday April 18, 2026 @07:12AM
(#47814946)
What I don't understand about this setup is why a double slash could ever be a directory traversal attack in Spring Boot.
If you're proxying to another server that just assumes relative paths and doesn't do any kind of validation, I guess an extra / might cause reading files outside of the expected area? That'd be an extremely weird and awful setup that I don't think makes any sense in the context of Spring Boot.
Re:It is incorrect to "normalize" // in HTTP URL paths
by masklinn on Sunday April 19, 2026 @02:01AM
(#47822126)
Given the claims relate to path traversal I assume it’s from (some) software treating http path trailers as FS paths, where a leading / would be an absolute path.
If you're proxying to another server that just assumes relative paths and doesn't do any kind of validation, I guess an extra / might cause reading files outside of the expected area? That'd be an extremely weird and awful setup that I don't think makes any sense in the context of Spring Boot.