Re: Suggestions

Chris Nokleberg <chris-k7PiZI/[email protected]> Thu, 2 Jan 2003 23:26:09 -0800
Newsgroups gmane.comp.java.securityfilter.user
Message-ID <20030103072609.GE16236@shorty>
On Thu, Jan 02, 2003 at 10:34:27PM -0800, Max Cooper wrote:
> Hmm... I just tried it on "Apache Tomcat/4.1.18-LE-jdk14" (as reported in
> the log) and got:
> 
> Request URI: /hacktest////////////////////index.jsp
> Request URL: http://localhost:8080/hacktest////////////////////index.jsp
> 
> I'm going to try downloading the same version you have and see what it does.
> I looked at the RequestUtil.normalize() method and it seems like it should
> be chopping out the extra slashes, but that doesn't seem to be how it is
> working for me. I am using Sun's JDK 1.4.1_01 on Windows XP (I know, I know
> ;-) if that matters.

I downloaded 4.1.18 and it works the same for me, under both Linux and
Windows XP. I'm suspecting that you have something else screwy going on
(old versions or libraries lurking around or being used somehow).

> Also note, I don't think that request.getRequestURI() or
> request.getRequestURL() are supposed to be normalizing the URL. 

Did you see this? 
http://issues.apache.org/bugzilla/show_bug.cgi?id=2612
It says explicitly that the getRequest* methods should be normalized.

-Chris


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf