Skip to content

Commit 6e3c7b1

Browse files
committed
fix: Fix PathMatchingResourcePatternResolver to handle absolute paths in JAR manifests
When JAR manifest Class-Path entries contain absolute paths (as Gradle creates on Windows for long classpaths), PathMatchingResourcePatternResolver incorrectly rejected them. Fixes #35730
1 parent ce050f1 commit 6e3c7b1

File tree

1 file changed

+14
-2
lines changed

1 file changed

+14
-2
lines changed

spring-core/src/main/java/org/springframework/core/io/support/PathMatchingResourcePatternResolver.java

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -614,6 +614,7 @@ private Set<ClassPathManifestEntry> getClassPathManifestEntries() {
614614
private Set<ClassPathManifestEntry> getClassPathManifestEntriesFromJar(File jar) throws IOException {
615615
URL base = jar.toURI().toURL();
616616
File parent = jar.getAbsoluteFile().getParentFile();
617+
617618
try (JarFile jarFile = new JarFile(jar)) {
618619
Manifest manifest = jarFile.getManifest();
619620
Attributes attributes = (manifest != null ? manifest.getMainAttributes() : null);
@@ -623,12 +624,23 @@ private Set<ClassPathManifestEntry> getClassPathManifestEntriesFromJar(File jar)
623624
StringTokenizer tokenizer = new StringTokenizer(classPath);
624625
while (tokenizer.hasMoreTokens()) {
625626
String path = tokenizer.nextToken();
627+
626628
if (path.indexOf(':') >= 0 && !"file".equalsIgnoreCase(new URL(base, path).getProtocol())) {
627629
// See jdk.internal.loader.URLClassPath.JarLoader.tryResolveFile(URL, String)
628630
continue;
629631
}
630-
File candidate = new File(parent, path);
631-
if (candidate.isFile() && candidate.getCanonicalPath().contains(parent.getCanonicalPath())) {
632+
633+
// Handle absolute paths correctly - don't use parent for absolute paths
634+
File pathFile = new File(path);
635+
File candidate = pathFile.isAbsolute() ? pathFile : new File(parent, path);
636+
637+
// For relative paths, enforce security check (must be under parent)
638+
// For absolute paths, just verify file exists (matching JVM behavior)
639+
boolean isValid = pathFile.isAbsolute() ?
640+
candidate.isFile() :
641+
(candidate.isFile() && candidate.getCanonicalPath().contains(parent.getCanonicalPath()));
642+
643+
if (isValid) {
632644
manifestEntries.add(ClassPathManifestEntry.of(candidate, this.useCaches));
633645
}
634646
}

0 commit comments

Comments
 (0)