Re: Suggestions

On Fri, Dec 20, 2002 at 02:41:03AM -0800, Max Cooper wrote:
> > a) "replace '/' chars with '/+' to match one or more consecutive slashes"
> >   seems wrong to me. Can you give me a pointer to the relevant portion
> >   of the Servlet spec?
> 
> I made this change to account for the way the servers typically
> work. If you write a web page that normally has the URL
> '/admin/editEmployee.jsp' and someone makes a request for
> '///////admin////editEmployee.jsp' (insert as many slashes as you
> want) they will see the page. SecurityFilter needs to protect that
> page if you have a mapping like '/admin/*', so I added the + after the
> slashes to match one or more of them.

In my tests, Tomcat (the latest version, at least) returns the
normalized version from getRequestURI, so you do not need to
re-normalize. If there is a server that does not do that, I think it is
a bug (and not something securityfilter should try to work around).

> If you want to code a compliant matching routine to see how it performs, you
> can test it with the regex-test framework, or email it to me and I'll test
> it. It would be nice to reduce the number of external libraries if we can
> get a correct and performant solution without a regex package.

If the /+ thing isn't necessary, I'm sure it's possible. I'll work out
the details to make it fully compliant.

> On a related note, I need to add another type for form-login-page and
> form-error-page and match those first with no authentication requirements. I
> might add a type for j_security_check, too and refactor the code to just try
> matching any of these and do the processing based on what gets matched.

FWIW, I'd suggest keeping URLPattern to mirror what is in the spec. The
form-*-pages should be matchable using a simple equals, and
j_security_check using endsWith, so keeping that code in the filter
itself doesn't seem too burdensome.

> > d) What is the status of user-data-constraint support?
> 
> There hasn't been much interest expressed so far, so I haven't even
> thought about it much. I would really like to get it into the project
> for compliance with the spec. Code contributions are welcome!

Ok, I'll look into this. I think it will require an extra element in the
config file to specify the port to use, since securityfilter has no way
of knowing how the container is configured in this regard.

-Chris


-------------------------------------------------------
This SF.NET email is sponsored by:  The Best Geek Holiday Gifts!
Time is running out!  Thinkgeek.com has the coolest gifts for
your favorite geek.   Let your fingers do the typing.   Visit Now.
T H I N K G E E K . C O M        http://www.thinkgeek.com/sf/