Re: Suggestions

Hmm... I just tried it on "Apache Tomcat/4.1.18-LE-jdk14" (as reported in
the log) and got:

Request URI: /hacktest////////////////////index.jsp
Request URL: http://localhost:8080/hacktest////////////////////index.jsp

I'm going to try downloading the same version you have and see what it does.
I looked at the RequestUtil.normalize() method and it seems like it should
be chopping out the extra slashes, but that doesn't seem to be how it is
working for me. I am using Sun's JDK 1.4.1_01 on Windows XP (I know, I know
;-) if that matters.

Also note, I don't think that request.getRequestURI() or
request.getRequestURL() are supposed to be normalizing the URL. It seems
like request.getServletPath() and request.getPathInfo() are supposed to do
that, however. SecurityFilter currently uses getRequestURI() and
getPathInfo() to reconstruct the URLfor pattern matching, though it seems
like that should change to getServletPath() and getPathInfo() to account for
stuff like /./admin/hacked.jsp.

-Max

----- Original Message -----
From: "Chris Nokleberg" <chris-k7PiZI/[email protected]>
To: "SecurityFilter" <securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org>
Sent: Thursday, January 02, 2003 9:37 PM
Subject: Re: [securityfilter-user] Suggestions


> On Thu, Jan 02, 2003 at 09:16:54PM -0800, Chris Nokleberg wrote:
> > Anyway, I'll send a sample war file tomorrow to illustrate my experience
> > with it working correctly in the latest tomcat release.
>
> It was easier than I thought, here it is. One filter (java and class
> file), and a web.xml to map it to all requests. Drop into tomcat
> "webapps" directory and try something like
>
> http://localhost:8080/hacktest//////////index.jsp
>
> I get
> Request URI: /hacktest/index.jsp
> Request URL: http://localhost:8080/hacktest/index.jsp
>
> This is using jakarta-tomcat-4.1.16-LE-jdk14
>
> -Chris
>




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf