file uri fix was placed in wrong order

bertramdev · Aug 22, 2018 · 4c57fc3 · 4c57fc3
1 parent a584e89
commit 4c57fc3
Showing 1 changed file with 1 addition and 2 deletions.
diff --git a/asset-pipeline-grails/src/main/groovy/asset/pipeline/AssetPipelineFilter.groovy b/asset-pipeline-grails/src/main/groovy/asset/pipeline/AssetPipelineFilter.groovy
@@ -61,11 +61,10 @@ class AssetPipelineFilter extends OncePerRequestFilter {
 			if(fileUri == '' || fileUri.endsWith('/')) {
 				fileUri += indexFile
 			}
-			fileUri = AssetHelper.normalizePath(fileUri) //JETTY Security bug, we MUST prevent reverse 
 			if(fileUri.startsWith('/')) {
 				manifestPath = fileUri.substring(1) //Omit forward slash
 			}
-			traversal
+			manifestPath = AssetHelper.normalizePath(manifestPath) //JETTY Security bug, we MUST prevent reverse traversal
 			fileUri = manifest?.getProperty(manifestPath, manifestPath)