Add validation to matchPathToPattern method (#2171)

Added a length validation to check if the base path and the request path are of equal length. This is to avoid index out of bound issues that can be encountered for method rewrite rules.
networknt · Mar 7, 2024 · aeb5f61 · aeb5f61
1 parent c7b8da0
commit aeb5f61
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/utility/src/main/java/com/networknt/utility/StringUtils.java b/utility/src/main/java/com/networknt/utility/StringUtils.java
@@ -1498,6 +1498,9 @@ public static String maskHalfString(String str) {
     public static boolean matchPathToPattern(String requestPath, String endpointPattern) {
         String[] pathPatternParts = endpointPattern.split("/");
         String[] pathParts = requestPath.split("/");
+        if (pathPatternParts.length != pathParts.length) {
+            return false;
+        }
 
         boolean isMatch = true;
         for (int i = 0; i < pathPatternParts.length; i++) {

diff --git a/utility/src/test/java/com/networknt/utility/StringUtilsTest.java b/utility/src/test/java/com/networknt/utility/StringUtilsTest.java
@@ -81,5 +81,7 @@ public void testMatchPath() {
         pattern = "/gateway/dev/ph-l4j-files/file?version=1";
         Assert.assertTrue(StringUtils.matchPathToPattern("/gateway/dev/ph-l4j-files/file?version=1", pattern));
 
+        pattern = "/gateway/dev/ph-l4j-files/file/05048267?version=1";
+        Assert.assertFalse(StringUtils.matchPathToPattern("/gateway/dev/ph-l4j-files/file?version=1", pattern));
     }
 }