Re: Suggestions

On Thu, 2 Jan 2003, Chris Nokleberg wrote:

> On Thu, Jan 02, 2003 at 04:35:59PM -0800, Max Cooper wrote:
> > Tomcat 4.1.18-LE-jdk14 is still broken.
>
> I don't understand how you can conclude this, in my tests it works and
> the bug report says as much. Do you have a simple piece of example code?
>
> > > Here's what I got on WebLogic 6.1 SP2:
> > > request.getRequestURI() = /securityfilter-example//////////index.jsp
> > > request.getRequestURL() =
> > > http://localhost:7001/securityfilter-example//////////index.jsp
>
> These results are fine, as long as WebLogic is not normalizing the URL
> to do security or servlet mappings. If that example actually returns the
> result of executing index.jsp, then WebLogic is broken (unsurprising).
>
> > In light of this bug and the likelihood that other containers are similarly
> > broken, I think it is best to keep the regex stuff in security filter at
> > this time for "multiple slash" matching. I've got to decide something to get
> > the release ready, so this is it. The next release with have the Jakarta-ORO
> > Perl5 pattern matching. That may change in the future, but I want to get a
> > release out that has fixes for other bugs.
>
> Working around conformance bugs is going to keep you awake at
> nights. IMHO you'd be much better served by taking the high road and
> following the spec.
>


I can't agree with this, especially if you want your project to actually
be used by a significant audience. A good bit of implementing on real
platforms if making your code resilent to imperfections in the platforms.
This normalization approach makes good sense; assuming (or forcing) that
everyone is using an update-to-date and bug-free platform doesn't.

Of course, you can't anticipate all problems/bugs, and have to draw a line
somewhere, but a little defensive driving like this does make sense.


> Another argument is: //foo//bar//baz.jsp is fine as a URL, and you could
> write security constraint in web.xml to protect //foo//*. It is all
> perfectly legal. By normalizing in the filter you're breaking the
> spec. Just my two cents.
>

If someone really needs such a strict reading of the specs, and not the
spirit of the specs, then add a "strict URL" option in the config file.
You can take both the high & low road, (with minimal effort, it looks
like; another three lines in SecurityConfig, and a flag in URLPattern, or
so?)


rob



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf