I have written a spring boot application with only spring-boot-starter-web as part of my spring boot project. I have added below configuration where I keep 2 html files named 404.html and 404ए.html in Test folder while 404s.html and in 404प्र.htmlin static folder under classpath. 

@Configuration
public class StaticResourceConfiguration implements WebMvcConfigurer {

    private static final String[] CLASSPATH_RESOURCE_LOCATIONS = {"file:../../test"
     ,"classpath:/static/"         
            };

    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        registry.addResourceHandler("/**")
            .addResourceLocations(CLASSPATH_RESOURCE_LOCATIONS);

       }


}

I tried to hit below urls and there respective result

  • http://localhost:8080/404s.html-- success 200
  • http://localhost:8080/404प्र.html-- success 200
  • http://localhost:8080/test/404.html-- success 200
  • http://localhost:8080/test/404ए.html-- fail 404

Below is the success Trace log for request http://localhost:8080/404प्र.html-- success 200

2022-10-14T19:40:33.101+0530 TRACE o.s.web.filter.RequestContextFilter.initContextHolders Bound request context to thread: org.apache.catalina.connector.RequestFacade@9490ca2
2022-10-14T19:40:33.102+0530 TRACE o.s.core.log.LogFormatUtils.traceDebug GET "/404%E0%A4%AA%E0%A5%8D%E0%A4%B0.html", parameters={}, headers={masked} in DispatcherServlet 'dispatcherServlet'
2022-10-14T19:40:33.103+0530 TRACE o.s.w.s.h.AbstractHandlerMapping.getHandler Mapped to HandlerExecutionChain with [ResourceHttpRequestHandler [URL [file:../../test], classpath [static/]]] and 3 interceptors
2022-10-14T19:40:33.104+0530 TRACE o.s.w.s.r.ResourceHttpRequestHandler.handleRequest Resource not modified
2022-10-14T19:40:33.104+0530 TRACE o.s.web.servlet.DispatcherServlet.processDispatchResult No view rendering, null ModelAndView returned.
2022-10-14T19:40:33.105+0530 DEBUG o.s.web.servlet.FrameworkServlet.logResult Completed 304 NOT_MODIFIED, headers={masked}
2022-10-14T19:40:33.105+0530 TRACE o.s.web.filter.RequestContextFilter.doFilterInternal Cleared thread-bound request context: org.apache.catalina.connector.RequestFacade@9490ca2

Below is the failure Trace log for request http://localhost:8080/test/404ए.html

2022-10-14T19:40:44.505+0530 TRACE o.s.web.filter.RequestContextFilter.initContextHolders Bound request context to thread: org.apache.catalina.connector.RequestFacade@9490ca2
2022-10-14T19:40:44.505+0530 TRACE o.s.core.log.LogFormatUtils.traceDebug GET "/test/404%E0%A4%8F.html", parameters={}, headers={masked} in DispatcherServlet 'dispatcherServlet'
2022-10-14T19:40:44.506+0530 TRACE o.s.w.s.h.AbstractHandlerMapping.getHandler Mapped to HandlerExecutionChain with [ResourceHttpRequestHandler [URL [file:../../test], classpath [static/]]] and 3 interceptors
2022-10-14T19:40:44.506+0530 WARN o.s.w.s.r.PathResourceResolver.isInvalidEncodedPath "Resolved resource path contains encoded "../" or "..\": file:../../test/404%E0%A4%8F.html"
2022-10-14T19:40:44.507+0530 WARN o.s.w.s.r.PathResourceResolver.isInvalidEncodedPath "Resolved resource path contains encoded "../" or "..\": file:../../test/404%E0%A4%8F.html"
2022-10-14T19:40:44.507+0530 WARN o.s.w.s.r.PathResourceResolver.getResource "Resource path "test/404%E0%A4%8F.html" was successfully resolved but resource "file:../../test/404%E0%A4%8F.html" is neither under the current location "file:../../test" nor under any of the allowed locations [URL [file:../../test], class path resource [static/]]"
2022-10-14T19:40:44.507+0530 DEBUG o.s.w.s.r.ResourceHttpRequestHandler.handleRequest Resource not found
2022-10-14T19:40:44.508+0530 TRACE o.s.web.servlet.DispatcherServlet.processDispatchResult No view rendering, null ModelAndView returned.
2022-10-14T19:40:44.508+0530 DEBUG o.s.web.servlet.FrameworkServlet.logResult Completed 404 NOT_FOUND, headers={masked}
2022-10-14T19:40:44.508+0530 TRACE o.s.web.filter.RequestContextFilter.doFilterInternal Cleared thread-bound request context: org.apache.catalina.connector.RequestFacade@9490ca2
2022-10-14T19:40:44.510+0530 TRACE o.s.web.filter.RequestContextFilter.initContextHolders Bound request context to thread: org.apache.catalina.core.ApplicationHttpRequest@762bf5a4
2022-10-14T19:40:44.510+0530 TRACE o.s.core.log.LogFormatUtils.traceDebug "ERROR" dispatch for GET "/error", parameters={}, headers={masked} in DispatcherServlet 'dispatcherServlet'
2022-10-14T19:40:44.511+0530 TRACE o.s.w.s.h.AbstractHandlerMethodMapping.lookupHandlerMethod 2 matching mappings: [{ [/error], produces [text/html]}, { [/error]}]
2022-10-14T19:40:44.512+0530 TRACE o.s.b.f.support.AbstractBeanFactory.doGetBean Returning cached instance of singleton bean 'basicErrorController'
2022-10-14T19:40:44.512+0530 TRACE o.s.w.s.h.AbstractHandlerMapping.getHandler Mapped to org.springframework.boot.autoconfigure.web.servlet.error.BasicErrorController#errorHtml(HttpServletRequest, HttpServletResponse)
2022-10-14T19:40:44.513+0530 TRACE o.s.w.m.s.InvocableHandlerMethod.invokeForRequest Arguments: [org.apache.catalina.core.ApplicationHttpRequest@762bf5a4, org.apache.catalina.connector.ResponseFacade@6d648a54]
2022-10-14T19:40:44.515+0530 TRACE o.s.w.s.support.WebContentGenerator.prepareResponse Applying default cacheSeconds=-1
2022-10-14T19:40:44.516+0530 TRACE o.s.b.f.support.AbstractBeanFactory.doGetBean Returning cached instance of singleton bean 'error'
2022-10-14T19:40:44.516+0530 TRACE o.s.w.s.v.AbstractCachingViewResolver.resolveViewName View with key [error] served from cache
2022-10-14T19:40:44.516+0530 DEBUG o.s.w.s.v.ContentNegotiatingViewResolver.getBestView Selected 'text/html' given [text/html, text/html;q=0.8]
2022-10-14T19:40:44.516+0530 TRACE o.s.web.servlet.DispatcherServlet.render Rendering view [org.springframework.boot.autoconfigure.web.servlet.error.ErrorMvcAutoConfiguration$StaticView@245de034] 
2022-10-14T19:40:44.517+0530 DEBUG o.s.web.servlet.FrameworkServlet.logResult Exiting from "ERROR" dispatch, status 404, headers={masked}
2022-10-14T19:40:44.517+0530 TRACE o.s.web.filter.RequestContextFilter.doFilterInternal Cleared thread-bound request context: org.apache.catalina.core.ApplicationHttpRequest@762bf5a4

I am unable to understand why the html from classpath static folder is process correctly but from externally configured folder is not handelled correctly by spring boot and how to resolve it.

Thanks in advance

Spring boot version: 2.7.4

You can refer to Git Project HTTP URL https://github.com/guysmart694/TestLanguage.git Project URL https://github.com/guysmart694/TestLanguage SSH URL git@github.com:guysmart694/TestLanguage.git

Comment From: bclozel

I can't reproduce this issue with the sample project you've provided.

I think that you're probably locally changing the "classpath:/test/" location to a relative location using "../" path segments. The "test" folder is not available at runtime in the application as it's not packaged with the application nor part of the classpath. You should move static resources under "src/main/resources" in all cases as other locations won't be packaged with your application.

The following log statement shows that the application is trying to access a folder that is outside of the allowed locations.

2022-10-14T19:40:44.507+0530 WARN o.s.w.s.r.PathResourceResolver.getResource "Resource path "test/404%E0%A4%8F.html" was successfully resolved but resource "file:../../test/404%E0%A4%8F.html" is neither under the current location "file:../../test" nor under any of the allowed locations [URL [file:../../test], class path resource [static/]]"

If you need more help, please ask questions on StackOverflow.