add limit for normalization iterations

- fail if the loop counter exceeds the limit
grails-plugins · Feb 25, 2014 · c3cf21a · c3cf21a
1 parent ad1471c
commit c3cf21a
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/src/groovy/org/grails/plugin/resource/URLUtils.groovy b/src/groovy/org/grails/plugin/resource/URLUtils.groovy
@@ -6,6 +6,7 @@ package org.grails.plugin.resource
 class URLUtils {
 
     def static externalURLPattern = /^((https?:?)?\/\/).*/
+    private static final int MAX_NORMALIZE_ITERATIONS = 3
 
     /**
      * Take a base URI and a target URI and resolve target against the base
@@ -38,9 +39,13 @@ class URLUtils {
 
     static String normalizeUri(String uri) {
         String current = uri
+        int counter=0
         boolean changed = true
         // handle double-encoding
         while (changed) { 
+            if (counter++ > MAX_NORMALIZE_ITERATIONS) {
+                throw new IllegalArgumentException("unable to normalize input uri ${uri}")
+            }
             String normalized = doNormalizeUri(current)
             changed = (current != normalized)
             current = normalized       

diff --git a/test/unit/org/grails/plugin/resource/URLUtilsSpec.groovy b/test/unit/org/grails/plugin/resource/URLUtilsSpec.groovy
@@ -30,6 +30,13 @@ class URLUtilsSpec extends Specification {
         normalizeUri('/parentdir/%25%32%35%25%33%37%25%33%33%25%32%35%25%33%36%25%36%36%25%32%35%25%33%36%25%36%34%25%32%35%25%33%36%25%33%35%25%32%35%25%33%32%25%36%34%25%32%35%25%33%36%25%33%34%25%32%35%25%33%36%25%33%39%25%32%35%25%33%37%25%33%32/file.xml') == '/parentdir/some-dir/file.xml'
     }
 
+    def 'fail if normalization limit exceeds'() {
+        when:
+        def uri=normalizeUri('/parentdir/%25%32%35%25%33%32%25%33%35%25%32%35%25%33%33%25%33%37%25%32%35%25%33%33%25%33%33%25%32%35%25%33%32%25%33%35%25%32%35%25%33%33%25%33%36%25%32%35%25%33%36%25%33%36%25%32%35%25%33%32%25%33%35%25%32%35%25%33%33%25%33%36%25%32%35%25%33%36%25%33%34%25%32%35%25%33%32%25%33%35%25%32%35%25%33%33%25%33%36%25%32%35%25%33%33%25%33%35%25%32%35%25%33%32%25%33%35%25%32%35%25%33%33%25%33%32%25%32%35%25%33%36%25%33%34%25%32%35%25%33%32%25%33%35%25%32%35%25%33%33%25%33%36%25%32%35%25%33%33%25%33%34%25%32%35%25%33%32%25%33%35%25%32%35%25%33%33%25%33%36%25%32%35%25%33%33%25%33%39%25%32%35%25%33%32%25%33%35%25%32%35%25%33%33%25%33%37%25%32%35%25%33%33%25%33%32/file.xml')
+        then:
+        thrown IllegalArgumentException
+    }
+
     def 'allow spaces in path'() {
         expect:
         normalizeUri('/parentdir/a b c.xml') == '/parentdir/a b c.xml'