in src/main/java/org/apache/commons/validator/routines/UrlValidator.java [472:495]
protected boolean isValidPath(final String path) {
if (path == null || !PATH_PATTERN.matcher(path).matches()) {
return false;
}
try {
// Don't omit host otherwise leading path may be taken as host if it starts with //
final URI uri = new URI(null, "localhost", path, null);
final String norm = uri.normalize().getPath();
if (norm.startsWith("/../") // Trying to go via the parent dir
|| norm.equals("/..")) { // Trying to go to the parent dir
return false;
}
} catch (final URISyntaxException e) {
return false;
}
final int slash2Count = countToken("//", path);
if (isOff(ALLOW_2_SLASHES) && slash2Count > 0) {
return false;
}
return true;
}