Prevent URL path traversal bypass via percent encoding in UrlValidator#383

Merged

sebbASF merged 7 commits into

apache:masterfrom

sahvx655-wq:url-validator-path-traversal-bypass

Jun 19, 2026

Commits on Jun 3, 2026

Prevent URL path traversal bypass via percent encoding in UrlValidator
“sahvx655-wq”
committed

Commits on Jun 9, 2026

Refactor percent decoding to use standard URLDecoder
“sahvx655-wq”
committed
Simplify path decoding and treat decoding exceptions as invalid paths
“sahvx655-wq”
committed
Merge remote-tracking branch 'origin/master' into url-validator-path-traversal-bypass
“sahvx655-wq”
committed

Commits on Jun 19, 2026

Simplify path decoding, preserve plus character, and count consecutive slashes on decoded path
“sahvx655-wq”
committed
Remove plus character replacement from path decoding
“sahvx655-wq”
committed
Fix trailing spaces checkstyle violations in UrlValidatorTest.java
“sahvx655-wq”
committed