package spark.staticfiles;

import static spark.utils.StringUtils.removeLeadingAndTrailingSlashesFrom;

/**
 * Protecting against Directory traversal
 */
public class DirectoryTraversal {

    public static void protectAgainstInClassPath(String path) {
        if (!removeLeadingAndTrailingSlashesFrom(path).startsWith(StaticFilesFolder.local())) {
            throw new DirectoryTraversalDetection("classpath");
        }
    }

    public static void protectAgainstForExternal(String path) {
        if (!removeLeadingAndTrailingSlashesFrom(path).startsWith(StaticFilesFolder.external())) {
            throw new DirectoryTraversalDetection("external");
        }
    }

    public static final class DirectoryTraversalDetection extends RuntimeException {

        public DirectoryTraversalDetection(String msg) {
            super(msg);
        }

    }

}

@@ -98,16 +98,45 @@
 esFrom;%0D
+%0Aimport java.nio.file.Paths;%0D
 %0A%0D%0A/**%0D%0A
@@ -524,32 +524,126 @@
 String path) %7B%0D%0A
+        String nixLikePath = Paths.get(path).toAbsolutePath().toString().replace(%22%5C%5C%22, %22/%22);%0D%0A
         if (!rem
@@ -667,33 +667,40 @@
 lingSlashesFrom(
-p
+nixLikeP
 ath).startsWith(

Add Windows to *nix path conversion