Warn against unsafe static resource locations in MVC and WebFlux #36692

Activity

1. bclozel

   added this to the 7.0.8 milestone on Apr 23, 2026
2. bclozel

   self-assigned this

   on Apr 23, 2026
3. bclozel

   added

   in: webIssues in web modules (web, webmvc, webflux, websocket)Issues in web modules (web, webmvc, webflux, websocket)

   type: enhancementA general enhancementA general enhancement

   for: backport-to-7.0.xMarks an issue as a candidate for backport to 7.0.xMarks an issue as a candidate for backport to 7.0.x

   on Apr 23, 2026
4. bclozel

   changed the title [-]Warn against invalid static resource locations in MVC and WebFlux[/-] [+]Warn against unsafe static resource locations in MVC and WebFlux[/+] on Apr 23, 2026
5. github-actions

   added

   status: backportedAn issue that has been backported to maintenance branchesAn issue that has been backported to maintenance branches

   and removed

   for: backport-to-7.0.xMarks an issue as a candidate for backport to 7.0.xMarks an issue as a candidate for backport to 7.0.x

   on Apr 23, 2026
6. bclozel

   closed this as completedin 0725bf4on Apr 23, 2026
7. pull

   added a commit that references this issue on Apr 23, 2026

   Warn against unsafe static resource locations

   ...

   This issue will close once commit 0725bf4 is merged into the 'main' branch.

   0725bf4
8. bclozel

   added a commit that references this issue on Apr 23, 2026

   Reject unsafe resource handling locations

   ...

   7a5844f
9. bclozel commented on May 5, 2026

   

   bclozel

   on May 5, 2026

   MemberAuthor

   More actions

   Reopening since the root Servlet context is a valid location.
10. bclozel

    reopened this on May 5, 2026
11. bclozel

    closed this as completedin 628261don May 5, 2026
12. pull

    added a commit that references this issue on May 5, 2026

    Do not warn against Root Servlet context location

    ...

    This issue will close once commit 628261d is merged into the 'main' branch.

    628261d
13. bclozel

    added a commit that references this issue on Jul 17, 2026

    Reinstate invalid resource location checks

    ...

    5ac20a8