session lost with tomcat 4.1.21 (4.1.18) & utf-8 url's?

I am not sure about dropping sessions, but that looks like a security issue
with SecurityFilter. I added System.out.println's for the "matchableURL"
that securityfilter tries to match as well as several of the request
methods, and this is what I got:

matchableURL = /main%2Fpages%2Fgroups%2F%C3%A6%C3%B8%C3%A5hmm%2F
request.getServletPath() = /main/pages/groups/µ°σhmm/
request.getRequestURI() =
/securityfilter-example/main%2Fpages%2Fgroups%2F%C3%6%C3%B8%C3%A5hmm%2F
request.getRequestURL() =
http://localhost:8080/securityfilter-example/main%2Fpages%2Fgroups%2F%C3%A6%
C3%B8%C3%A5hmm%2F

The encoded URL you chose for testing looks like "u'oh hmm" which is pretty
appropriate. :)

It looks like we need to use getServletPath() or do some decoding on the
current matchableURL. I had been thinking about using getServletPath() for
multiple-slash and '/./' and '/../' normalization anyway, so this looks like
another good reason. I held off before because I didn't want to break
anything and I found other solutions for the multi-slash and dot problems
anyway. Curiously, getServletPath() doesn't seem to totally fix the
multi-slash problem on my Tomcat test systems (4.1.18 on WinXP and Linux),
despite some feedback that it did fix it for other people. It does seem to
fix the multi-slash problem on WebLogic 6.1.

Does anyone care to share their thoughts on UTF-encoding handling for
url-patterns specified in securityfilter-config.xml? I presume that you
should be allowed to use UTF-encoding to specify them in the config file,
though I think you might be able to enter the UTF characters directly as
well. Perhaps I will need to decode the url-patterns also. I am interested
in any feedback on this, particularly how you would like to specify them in
the config file.

This needs to be fixed, so a securityfilter-1.0.1 release will be coming
soon...

-Max



I'm testing tomcat 4.1.21 to see if it looses sessions when the url
 contains utf-8 chars encoded as %XX%XX. I see it constantly on 4.1.18,
 and almost as frequently on 4.1.21, and I'm trying to find out if this
 is a tomcat problem or a securityfilter problem. Url's are like

 http://localhost:8080/main%2Fpages%2Fgroups%2F%C3%A6%C3%B8%C3%A5hmm%2F

 Have anyone else seen this with securityfilter?

 --
 Torgeir Veimo <torgeir-tbzGvf8UZ/[email protected]>






-------------------------------------------------------
This SF.net email is sponsored by:
The Definitive IT and Networking Event. Be There!
NetWorld+Interop Las Vegas 2003 -- Register today!
http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en