public String resolvePath(String pathInfo){
  if ((pathInfo == null) || (pathInfo.indexOf("..") != -1)) {
    return null;
  }
  int libStart=pathInfo.indexOf('/') + 1;
  int libEnd=pathInfo.indexOf('/',libStart);
  if (libEnd == -1) {
    libEnd=pathInfo.length();
  }
  String libname=pathInfo.substring(libStart,libEnd);
  String subpath=pathInfo.substring(libEnd);
  String lib_home=getPath(libname);
  if (lib_home == null) {
    return null;
  }
  return lib_home + "/" + subpath;
}

public String resolvePath ( String pathInfo ) { if ( ( pathInfo == null ) || ( pathInfo . indexOf ( ".." ) != - 1 ) ) { return null ; } int libStart = pathInfo . indexOf ( '/' ) + 1 ; int libEnd = pathInfo . indexOf ( '/' , libStart ) ; if ( libEnd == - 1 ) { libEnd = pathInfo . length ( ) ; } String libname = pathInfo . substring ( libStart , libEnd ) ; String subpath = pathInfo . substring ( libEnd ) ; String lib_home = getPath ( libname ) ; if ( lib_home == null ) { return null ; } return lib_home + "/" + subpath ; }
return a file object that the path resolves to . performs some minimal checks to try and prevent an attacker from feeding in urls that cause the servlets to climb out of their sandbox . a better option is to use a servlet container with the ability to restrict servlet file access . for example , apache software foundation ' s tomcat 5 servlet / jsp container running with the - security flag .
