Check for % before converting to URI

Author: ia3andy

extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/RoutingUtils.java

@@ -1,10 +1,11 @@
 package io.quarkus.vertx.http.runtime;
 
-import java.net.URI;
 import java.util.Set;
 
 import io.vertx.core.http.HttpHeaders;
+import io.vertx.core.http.impl.HttpUtils;
 import io.vertx.core.http.impl.MimeMapping;
+import io.vertx.core.net.impl.URIDecoder;
 import io.vertx.ext.web.RoutingContext;
 import io.vertx.ext.web.handler.StaticHandler;
 
@@ -17,18 +18,24 @@ private RoutingUtils() throws IllegalAccessException {
     /**
      * Get the normalized and decoded path:
      * - normalize based on RFC3986
-     * - convert % encoded characters to their non encoded form (using {@link java.net.URI})
+     * - convert % encoded characters to their non encoded form (using {@link URIDecoder#decodeURIComponent})
+     * - remove relative dots in path
+     * - replace '\' with '/'
      * - invalid if the path contains '?' (query section of the path)
      *
      * @param ctx the RoutingContext
      * @return the normalized and decoded path or null if not valid
      */
     public static String getNormalizedAndDecodedPath(RoutingContext ctx) {
         String normalizedPath = ctx.normalizedPath();
-        if (normalizedPath.contains("?")) {
+        if (normalizedPath.indexOf('?') != -1) {
             return null;
         }
-        return URI.create(normalizedPath).getPath();
+        if (normalizedPath.indexOf('%') == -1) {
+            return normalizedPath;
+        }
+        final String uriDecodedPath = URIDecoder.decodeURIComponent(normalizedPath);
+        return toUnixPathWithoutDots(uriDecodedPath);
     }
 
     /**
@@ -67,6 +74,10 @@ public static void compressIfNeeded(VertxHttpBuildTimeConfig config, Set<String>
         }
     }
 
+    private static String toUnixPathWithoutDots(String path) {
+        return HttpUtils.removeDots(path.replace('\\', '/'));
+    }
+
     private static boolean isCompressed(Set<String> compressMediaTypes, String path) {
         if (compressMediaTypes.isEmpty()) {
             return false;