normalize module base path before resolving rpc policy resource

user/src/com/google/gwt/user/server/rpc/RemoteServiceServlet.java

@@ -26,6 +26,7 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.MalformedURLException;
+import java.net.URI;
 import java.net.URL;
 import java.text.ParseException;
 import java.util.HashMap;
@@ -59,7 +60,7 @@ static SerializationPolicy loadSerializationPolicy(HttpServlet servlet,
     String modulePath = null;
     if (moduleBaseURL != null) {
       try {
-        modulePath = new URL(moduleBaseURL).getPath();
+        modulePath = normalizeModulePath(new URL(moduleBaseURL).getPath());
       } catch (MalformedURLException ex) {
         // log the information, we will default
         servlet.log("Malformed moduleBaseURL: " + moduleBaseURL, ex);
@@ -137,6 +138,26 @@ static SerializationPolicy loadSerializationPolicy(HttpServlet servlet,
     return serializationPolicy;
   }
 
+  /**
+   * Collapses "." and ".." segments in a module base path. The path is derived
+   * from the client-supplied module base URL, which is later concatenated with
+   * the strong name and file suffix to locate a resource; normalizing here
+   * ensures a crafted URL such as {@code http://host/ctx/../../WEB-INF/foo}
+   * cannot walk outside the module directory before the "same web application"
+   * containment check is applied. Returns {@code null} if the path cannot be
+   * parsed.
+   */
+  private static String normalizeModulePath(String path) {
+    if (path == null) {
+      return null;
+    }
+    try {
+      return URI.create(path).normalize().getRawPath();
+    } catch (IllegalArgumentException ex) {
+      return null;
+    }
+  }
+
   private static final SerializationPolicyClient CODE_SERVER_CLIENT =
       new SerializationPolicyClient(5000, 5000);
 
@@ -226,7 +247,10 @@ protected String getRequestModuleBasePath() {
       if (header == null) {
         return null;
       }
-      String path = new URL(header).getPath();
+      String path = normalizeModulePath(new URL(header).getPath());
+      if (path == null) {
+        return null;
+      }
       String contextPath = getThreadLocalRequest().getContextPath();
       if (!path.startsWith(contextPath)) {
         return null;

user/test/com/google/gwt/user/server/rpc/RemoteServiceServletTest.java

@@ -366,6 +366,41 @@ public String getVirtualServerName() {
     }
   }
 
+  /**
+   * A crafted moduleBaseURL containing ".." segments must not be able to walk
+   * out of the module directory when the strong name and file suffix are
+   * appended to build the serialization policy resource path.
+   */
+  public void testDoGetSerializationPolicy_ModuleBaseUrlTraversal()
+      throws ServletException {
+    final StringBuilder requestedResource = new StringBuilder();
+    MockServletContext mockContext = new MockServletContext() {
+      @Override
+      public InputStream getResourceAsStream(String resource) {
+        requestedResource.append(resource);
+        return null;
+      }
+    };
+    MockServletConfig mockConfig = new MockServletConfig(mockContext);
+
+    RemoteServiceServlet rss = new RemoteServiceServlet();
+
+    MockHttpServletRequestContextPath mockRequest = new MockHttpServletRequestContextPath();
+    rss.init(mockConfig);
+
+    mockRequest.contextPath = "/MyModule";
+
+    SerializationPolicy serializationPolicy = rss.doGetSerializationPolicy(
+        mockRequest, "http://www.google.com/MyModule/../../../secret", "12345");
+
+    // The traversal walks above the context path, so no policy is loaded and
+    // the resource path handed to the container never escapes the module dir.
+    assertNull(serializationPolicy);
+    assertNotNull(mockContext.messageLogged);
+    assertFalse("resource path must not contain a traversal segment: "
+        + requestedResource, requestedResource.toString().contains(".."));
+  }
+
   public void testDoGetSerializationPolicy_FailToOpenMD5Resource()
       throws ServletException {
     MockServletContext mockContext = new MockServletContext() {