From a252de4af66facff0aefbcd4994fab340e9d6d26 Mon Sep 17 00:00:00 2001 From: Frederic Thevenet Date: Tue, 6 May 2025 18:17:57 +0200 Subject: [PATCH] Do not apply sanitization to root path when generating paths for downloaded assets in the cache folder. --- netx/net/sourceforge/jnlp/cache/CacheUtil.java | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/netx/net/sourceforge/jnlp/cache/CacheUtil.java b/netx/net/sourceforge/jnlp/cache/CacheUtil.java index d298d203b..39b316e3b 100644 --- a/netx/net/sourceforge/jnlp/cache/CacheUtil.java +++ b/netx/net/sourceforge/jnlp/cache/CacheUtil.java @@ -680,9 +680,6 @@ public static File urlToPath(URL location, String subdir) { StringBuilder path = new StringBuilder(); - path.append(subdir); - path.append(File.separatorChar); - path.append(location.getProtocol()); path.append(File.separatorChar); path.append(location.getHost()); @@ -707,7 +704,7 @@ public static File urlToPath(URL location, String subdir) { * So without mercy, hash it */ String hexed = hex(new File(locationPath).getName(), locationPath); - return new File(path.toString(), hexed.toString()); + return new File(subdir, path.append(File.separatorChar).append(hexed).toString()); } catch (NoSuchAlgorithmException ex) { // should not occur, cite from javadoc: // every java implementation should support @@ -720,7 +717,7 @@ public static File urlToPath(URL location, String subdir) { path.append(".").append(location.getQuery()); } - File candidate = new File(FileUtils.sanitizePath(path.toString())); + File candidate = new File(subdir, FileUtils.sanitizePath(path.toString())); try { if (candidate.getName().length() > 255) { /**