Re: Suggestions

Darn! I was all set to start integrating the updated noregex pattern
matching scheme, but I did a test on Tomcat and it doesn't look like it is
going to work. I added a print statement here (SecurityFilter.java):

         URLPattern match = null;
         try {
>           System.out.println("requestURL = \"" + requestURL + "\"");
            // check if this is a login form submittal
            if (patternMatcher.match(requestURL, loginSubmitPattern)) {
               processLogin(wrappedRequest, hRes);
               return;
            }

And then deployed the example app and made a request for
http://localhost:8080/securityfilter-example//////////index.jsp and got this
output:

requestURL = "//////////index.jsp"

I have been using request.getRequestURI() to get the request pattern to
match (with some additional manipulations). I figured I would try some
others to see what I get and unfortunately, all of them have multiple
slashes:

request.getRequestURI() = /securityfilter-example//////////index.jsp
request.getRequestURL() =
http://localhost:8080/securityfilter-example//////////index.jsp
request.getServletPath() = /////index.jsp

I guess I could write something to strip out extra slashes, but at the
moment I am thinking of keeping the Perl5 pattern matching since it is
already in there. I welcome any feedback.

-Max

----- Original Message -----
From: "Chris Nokleberg" <chris-k7PiZI/[email protected]>
To: "SecurityFilter" <securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org>
Sent: Friday, December 20, 2002 12:11 PM
Subject: Re: [securityfilter-user] Suggestions


> On Fri, Dec 20, 2002 at 02:41:03AM -0800, Max Cooper wrote:
> > That fails for a few of the tests (see the /regex-test CVS module in the
> > securityfilter repository). It fails for the one with multiple slashes
(the
> > /+ thing from the first point above). For instance /////catalog should
match
> > /catalog, but it doesn't. It also fails where /baz is supposed to match
> > /baz/*. I added some NoRegex* classes to the regex-test CVS module to
test
> > the code above if you want to check it out.
>
> Here is a patch to the NoRegexURLPattern that makes it pass all tests
> except for the /+ normalization.
>
> I've also attached an ant build.xml file for regex-test.
>
> I should point out that if you are really looking for speed at all
> costs, the ultimate solution is to avoid matching against each pattern
> in the resource collection. Instead, you should build a Trie or DFA out
> of the entire set of patterns. It would then require at most one pass
> over the input URI. From reading the archives I think Tomcat may try to
> do something like this 5.0. If you want to pursue this route let me
> know, otherwise I think NoRegex is the best bet.
>
> -Chris
>
> Index: NoRegexURLPattern.java
> ===================================================================
> RCS file:
/cvsroot/securityfilter/regex-test/src/org/securityfilter/regextest/noregex/
NoRegexURLPattern.java,v
> retrieving revision 1.1
> diff -u -r1.1 NoRegexURLPattern.java
> --- NoRegexURLPattern.java 20 Dec 2002 09:57:53 -0000 1.1
> +++ NoRegexURLPattern.java 20 Dec 2002 20:06:13 -0000
> @@ -11,6 +11,7 @@
>   */
>  public class NoRegexURLPattern extends URLPattern {
>     protected String matchAgainst;
> +   protected int matchLength;
>
>     public NoRegexURLPattern(
>        String URLPattern,
> @@ -24,7 +25,8 @@
>     public boolean match(String path) {
>        switch (patternType) {
>           case PATH_TYPE:
> -            return path.startsWith(matchAgainst);
> +            return path.startsWith(matchAgainst) &&
> +               (path.length() == matchLength || path.charAt(matchLength)
== '/');
>           case EXTENSION_TYPE:
>              return path.endsWith(matchAgainst);
>           default:
> @@ -38,7 +40,8 @@
>              matchAgainst = pattern.substring(1);
>              break;
>           case PATH_TYPE:
> -            matchAgainst = pattern.substring(0, pattern.length() - 1);
> +            matchLength = pattern.length() - 2;
> +            matchAgainst = pattern.substring(0, matchLength);
>              break;
>           case EXACT_TYPE:
>              matchAgainst = pattern;
>
>
> -------------------------------------------------------
> This SF.NET email is sponsored by:  The Best Geek Holiday Gifts!
> Time is running out!  Thinkgeek.com has the coolest gifts for
> your favorite geek.   Let your fingers do the typing.   Visit Now.
> T H I N K G E E K . C O M        http://www.thinkgeek.com/sf/
> _______________________________________________
> securityfilter-user mailing list
> securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> https://lists.sourceforge.net/lists/listinfo/securityfilter-user
>




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf