Re: Suggestions

Tomcat 4.1.18-LE-jdk14 is still broken.

In light of this bug and the likelihood that other containers are similarly
broken, I think it is best to keep the regex stuff in security filter at
this time for "multiple slash" matching. I've got to decide something to get
the release ready, so this is it. The next release with have the Jakarta-ORO
Perl5 pattern matching. That may change in the future, but I want to get a
release out that has fixes for other bugs.

-Max

----- Original Message -----
From: "Max Cooper" <[email protected]>
To: "Chris Nokleberg" <chris-k7PiZI/[email protected]>
Cc: "SecurityFilter" <securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org>
Sent: Thursday, January 02, 2003 4:16 PM
Subject: Re: [securityfilter-user] Suggestions


> I am using Tomcat 4.1.12-LE-jdk14. It is kind of strange that
> request.getServletPath() is partially normalized (less slashes).
>
> Here's what I got on WebLogic 6.1 SP2:
>
> request.getRequestURI() = /securityfilter-example//////////index.jsp
> request.getRequestURL() =
> http://localhost:7001/securityfilter-example//////////index.jsp
> request.getServletPath() = /index.jsp
>
> Ah, I see that there is a bug for Tomcat. I'll update to the latest
version
> 4.1.18 and see if it is fixed. Okay, I'm back on the no-regex integration
> plan now...
>
> -Max
>
> ----- Original Message -----
> From: "Chris Nokleberg" <chris-k7PiZI/[email protected]>
> To: "Max Cooper" <[email protected]>
> Cc: "SecurityFilter" <securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org>
> Sent: Thursday, January 02, 2003 1:53 PM
> Subject: Re: [securityfilter-user] Suggestions
>
>
> > On Thu, Jan 02, 2003 at 01:47:19PM -0800, Max Cooper wrote:
> > > Darn! I was all set to start integrating the updated noregex pattern
> > > matching scheme, but I did a test on Tomcat and it doesn't look like
it
> is
> > > going to work.
> >
> > Which version of Tomcat? I did a similar test on 4.1.16 or something and
> > got "better" results. I'll check again to make sure.
> >
> > I feel strongly that it is a bug if they normalize but don't make the
> > normalized version available.
> >
> > -Chris
> >
>
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> securityfilter-user mailing list
> securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> https://lists.sourceforge.net/lists/listinfo/securityfilter-user
>




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf