e49257257d1c09b688ba3da5fdb0212f6bd240cd,xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/TempResourceAction.java,TempResourceAction,getTemporaryFile,#String#XWikiContext#,130

Before Change


                // This should never happen;
            }
            String space = withMinimalURLEncoding(matcher.group(1));
            String page = withMinimalURLEncoding(matcher.group(2));
            String module = withMinimalURLEncoding(matcher.group(3));
            // The file path is used as is, without any modifications (no decoding/encoding is performed). The modules
            // that create the temporary files and the corresponding URLs used to access them are responsible for
            // encoding the file path components so that they don't contain invalid characters.
            String filePath = matcher.group(4);
            String prefix = String.format("temp/%s/%s/%s/%s/", module, wiki, space, page);
            String path = URI.create(prefix + filePath).normalize().toString();
            if (path.startsWith(prefix)) {
                result = new File(this.environment.getTemporaryDirectory(), path);
                result = result.exists() ? result : null;

After Change


            // temp/module
            pathSegments.add(withMinimalURLEncoding(matcher.group(3)));
            // temp/module/wiki
            pathSegments.add(encodeURLPathSegment(context.getWikiId()));
            // temp/module/wiki/space
            pathSegments.add(withMinimalURLEncoding(matcher.group(1)));
            // temp/module/wiki/space/page
            pathSegments.add(withMinimalURLEncoding(matcher.group(2)));
            // Save the path prefix before adding the file path to be able to check if the file path tries to get out of
            // the parent folder (e.g. using '/../').
            String prefix = StringUtils.join(pathSegments, PATH_SEPARATOR);