Re: Suggestions

> > Also note, I don't think that request.getRequestURI() or
> > request.getRequestURL() are supposed to be normalizing the URL.
>
> Did you see this?
> http://issues.apache.org/bugzilla/show_bug.cgi?id=2612
> It says explicitly that the getRequest* methods should be normalized.
>
> -Chris

I did read that, but WebLogic doesn't seem to normalize those methods, only
getServletPath(). I assume (hope) that it normalizes getPathInfo(), too, but
I'll have to check that to be sure. The J2EE Javadoc says that only
getServletPath() is "decoded", which may or may not mean normalized. Tomcat
may normalize the getRequest* methods, but it doesn't seem to be part of the
spec. At this point, I am inclined to think that getRequestURI() and
getRequestURL() are not going to be normalized by the container
consistently, so I won't count on that. My own experiences in testing Tomcat
this week are that it at least tries to normalize getServletPath() by
removing some of the extra slashes, but leaves all the extra slashes in
getRequestURI().

I need to test out stuff like /unsecure/../secure/hacked.jsp, too. I hope
that getServletPath(), etc. will normalize that stuff out, too. On a
separate but related note, the spec seems to indicate that url-patterns with
security-constraints that have stuff like /foo/../bar/* are supposed to be
normalized to /bar/*, too, but that seems less urgent and the next release
probably won't normalize those. I would like to get all the ////// and
/public/../secure/hacked.jsp fixed up to close the security holes, though.

I did a test of the RequestUtil.normalize() method from my installation of
Tomcat and it seems to do the job correctly. Here are the results of my
little test:
RequestUtil.normalize("//////////////index.jsp") = "/index.jsp"
RequestUtil.normalize("////foo///bar///index.jsp") = "/foo/bar/index.jsp"
RequestUtil.normalize("/public/../secure/index.jsp") = "/secure/index.jsp"
RequestUtil.normalize("/./secure/index.jsp") = "/secure/index.jsp"

For the life of me, I cannot figure out why Tomcat fails to strip out the
extra slashes from getServletPath(). It does seem to normalize stuff like
/./index.jsp and /secure/../index.jsp properly. But if there are multiple
slashes, it doesn't normalize the path correctly. I tried it on both Windows
XP and Linux with no CLASSPATH set and fresh installs of Tomcat
4.1.18-LE-jdk14 (with only the test webapp added) and Sun's J2SDK 1.4.1_01
and got exactly the same thing. My test of the normalize() method suggests
that it should normalize correctly, but it doesn't seem to work that way
when running the server.

I'm going to build Tomcat with the debug info included and try to follow
what is happening while the server is running next.

-Max





-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf