Config files no longer loaded if they contain a hidden path element #23983
Description
Since upgrading from Spring Boot Version 2.3.4 to Spring Boot Version 2.3.5 a application no longer loads properties from property files that are located in config locations that contain a hidden path element.
This can be reproduced by setting the spring.config.additional-location to a location that contains a hidden path element as shown in the following snippet:
@SpringBootApplication
public class Application extends SpringBootServletInitializer {
private static final String ADDITIONAL_CONFIG_LOCATION = "/additional/config/.location/";
public static void main(String[] args) {
configureApplication(new SpringApplicationBuilder()).run(args);
}
@Override
protected SpringApplicationBuilder configure(
SpringApplicationBuilder builder) {
return configureApplication(builder);
}
private static SpringApplicationBuilder configureApplication(SpringApplicationBuilder builder) {
return builder.sources(Application.class).properties(
Map.of("spring.config.additional-location", ADDITIONAL_CONFIG_LOCATION)
);
}
}As seen in the example code snippet the additional config location given contains a hidden path element, namely .location.
If we put a file named application-some-active-profile.yml into /additional/config/.location/ this file will not be loaded by the org/springframework/boot/context/config/ConfigFileApplicationListener.java upon start up when running with -Dspring.profiles.active=some-active-profile.
This is because of the check in Line 525 of the ConfigFileApplicationListener.
This check will strip all path elements and check them for a starting .. Since the constructed resource path file:/application/config/.location/application-some-active-profile.yml contains the .location path element the resource will not be loaded.
This change was introduced with the following commit.
This issue is reproducible with all config file types: properties, xml, yaml, yml.
This issue is not reproducible with Spring Boot Version 2.3.4.