Verify insecure paths with ..\ and '..//'. Add more tests.

Author: OlgaMaciaszek

spring-cloud-netflix-zuul/src/main/java/org/springframework/cloud/netflix/zuul/filters/pre/PreDecorationFilter.java

@@ -262,6 +262,12 @@ private boolean isInsecurePath(String path) {
 			}
 			return true;
 		}
+		if (path.contains("..\\")) {
+			if (log.isWarnEnabled()) {
+				log.warn("Path contains \"..\\\"");
+			}
+			return true;
+		}
 		return false;
 	}
 

spring-cloud-netflix-zuul/src/test/java/org/springframework/cloud/netflix/zuul/filters/pre/PreDecorationFilterTests.java

@@ -714,9 +714,51 @@ public void exceptionThrownForInsecurePath() {
 				.isInstanceOf(InsecureRequestPathException.class);
 	}
 
+	@Test
+	public void exceptionThrownForInsecurePathWithBackslash() {
+		request.setRequestURI("'/api/..\\admin/index'");
+		assertThatThrownBy(() -> filter.run())
+				.isInstanceOf(InsecureRequestPathException.class);
+	}
+
+	@Test
+	public void exceptionThrownForInsecurePathWithDoubleSlash() {
+		request.setRequestURI("'/api/..//admin/index'");
+		assertThatThrownBy(() -> filter.run())
+				.isInstanceOf(InsecureRequestPathException.class);
+	}
+
+	@Test
+	public void exceptionThrownForEncodedInsecurePathWithBackslash() {
+		request.setRequestURI("%27%2Fapi%2F..%5Cadmin%2Findex%27");
+		assertThatThrownBy(() -> filter.run())
+				.isInstanceOf(InsecureRequestPathException.class);
+	}
+
+	@Test
+	public void exceptionThrownForEncodedInsecurePathWithDoubleSlash() {
+		request.setRequestURI("%27%2Fapi%2F..%2F%2Fadmin%2Findex%27");
+		assertThatThrownBy(() -> filter.run())
+				.isInstanceOf(InsecureRequestPathException.class);
+	}
+
+	@Test
+	public void exceptionThrownForDoubleEncodedInsecurePathWithBackslash() {
+		request.setRequestURI("%2527%252Fapi%252F..%255Cadmin%252Findex%2527");
+		assertThatThrownBy(() -> filter.run())
+				.isInstanceOf(InsecureRequestPathException.class);
+	}
+
+	@Test
+	public void exceptionThrownForDoubleEncodedInsecurePathWithDoubleSlash() {
+		request.setRequestURI("%27%2Fapi%2F..%2F%2Fadmin%2Findex%27");
+		assertThatThrownBy(() -> filter.run())
+				.isInstanceOf(InsecureRequestPathException.class);
+	}
+
 	@Test
 	public void exceptionThrownForEncodedInsecurePath() {
-		request.setRequestURI("%27%2Fapi%2F..%3B%2Fadmin%2Findex%27");
+		request.setRequestURI("%2527%252Fapi%252F..%252F%252Fadmin%252Findex%2527");
 		assertThatThrownBy(() -> filter.run())
 				.isInstanceOf(InsecureRequestPathException.class);
 	}