Re: Suggestions

On Thu, Jan 02, 2003 at 04:35:59PM -0800, Max Cooper wrote:
> Tomcat 4.1.18-LE-jdk14 is still broken.

I don't understand how you can conclude this, in my tests it works and
the bug report says as much. Do you have a simple piece of example code?

> > Here's what I got on WebLogic 6.1 SP2:
> > request.getRequestURI() = /securityfilter-example//////////index.jsp
> > request.getRequestURL() =
> > http://localhost:7001/securityfilter-example//////////index.jsp

These results are fine, as long as WebLogic is not normalizing the URL
to do security or servlet mappings. If that example actually returns the
result of executing index.jsp, then WebLogic is broken (unsurprising).

> In light of this bug and the likelihood that other containers are similarly
> broken, I think it is best to keep the regex stuff in security filter at
> this time for "multiple slash" matching. I've got to decide something to get
> the release ready, so this is it. The next release with have the Jakarta-ORO
> Perl5 pattern matching. That may change in the future, but I want to get a
> release out that has fixes for other bugs.

Working around conformance bugs is going to keep you awake at
nights. IMHO you'd be much better served by taking the high road and
following the spec.

Another argument is: //foo//bar//baz.jsp is fine as a URL, and you could
write security constraint in web.xml to protect //foo//*. It is all
perfectly legal. By normalizing in the filter you're breaking the
spec. Just my two cents.

-Chris


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf