You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2019/05/31 19:52:42 UTC
[tomcat] branch 8.5.x updated: Remove fragment from
RequestDispatcher target if (incorrectly) present
This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch 8.5.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/8.5.x by this push:
new 348d395 Remove fragment from RequestDispatcher target if (incorrectly) present
348d395 is described below
commit 348d395c0eb7c15c5b4562ed589ac8975f828d8e
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Fri May 31 20:30:08 2019 +0100
Remove fragment from RequestDispatcher target if (incorrectly) present
---
.../catalina/connector/LocalStrings.properties | 1 +
java/org/apache/catalina/connector/Request.java | 14 ++++++--
.../catalina/core/ApplicationHttpRequest.java | 38 ++++++++++++++++------
.../apache/catalina/core/LocalStrings.properties | 2 ++
webapps/docs/changelog.xml | 5 +++
5 files changed, 47 insertions(+), 13 deletions(-)
diff --git a/java/org/apache/catalina/connector/LocalStrings.properties b/java/org/apache/catalina/connector/LocalStrings.properties
index b70b187..1631c62 100644
--- a/java/org/apache/catalina/connector/LocalStrings.properties
+++ b/java/org/apache/catalina/connector/LocalStrings.properties
@@ -76,6 +76,7 @@ inputBuffer.requiresNonBlocking=Not available in non blocking mode
outputBuffer.writeNull=The String argument to write(String,int,int) may not be null
request.asyncNotSupported=A filter or servlet of the current chain does not support asynchronous operations.
+request.fragmentInDispatchPath=The fragment in dispatch path [{0}] has been removed
request.illegalWrap=The request wrapper must wrap the request obtained from getRequest()
request.notAsync=It is illegal to call this method if the current request is not in asynchronous mode (i.e. isAsyncStarted() returns false)
diff --git a/java/org/apache/catalina/connector/Request.java b/java/org/apache/catalina/connector/Request.java
index 8aed515..03f55a0 100644
--- a/java/org/apache/catalina/connector/Request.java
+++ b/java/org/apache/catalina/connector/Request.java
@@ -1373,11 +1373,19 @@ public class Request implements org.apache.catalina.servlet4preview.http.HttpSer
return null;
}
- // If the path is already context-relative, just pass it through
if (path == null) {
return null;
- } else if (path.startsWith("/")) {
- return (context.getServletContext().getRequestDispatcher(path));
+ }
+
+ int fragmentPos = path.indexOf('#');
+ if (fragmentPos > -1) {
+ log.warn(sm.getString("request.fragmentInDispatchPath", path));
+ path = path.substring(0, fragmentPos);
+ }
+
+ // If the path is already context-relative, just pass it through
+ if (path.startsWith("/")) {
+ return context.getServletContext().getRequestDispatcher(path);
}
/*
diff --git a/java/org/apache/catalina/core/ApplicationHttpRequest.java b/java/org/apache/catalina/core/ApplicationHttpRequest.java
index f7c86c9..f49b32a 100644
--- a/java/org/apache/catalina/core/ApplicationHttpRequest.java
+++ b/java/org/apache/catalina/core/ApplicationHttpRequest.java
@@ -45,9 +45,11 @@ import org.apache.catalina.connector.RequestFacade;
import org.apache.catalina.servlet4preview.http.PushBuilder;
import org.apache.catalina.servlet4preview.http.ServletMapping;
import org.apache.catalina.util.ParameterMap;
+import org.apache.catalina.util.URLEncoder;
import org.apache.tomcat.util.buf.B2CConverter;
import org.apache.tomcat.util.buf.MessageBytes;
import org.apache.tomcat.util.http.Parameters;
+import org.apache.tomcat.util.res.StringManager;
/**
@@ -68,9 +70,7 @@ import org.apache.tomcat.util.http.Parameters;
class ApplicationHttpRequest
extends org.apache.catalina.servlet4preview.http.HttpServletRequestWrapper {
-
- // ------------------------------------------------------- Static Variables
-
+ private static final StringManager sm = StringManager.getManager(ApplicationHttpRequest.class);
/**
* The set of attribute names that are special for request dispatchers.
@@ -319,11 +319,20 @@ class ApplicationHttpRequest
if (context == null)
return (null);
+ if (path == null) {
+ return null;
+ }
+
+ int fragmentPos = path.indexOf('#');
+ if (fragmentPos > -1) {
+ context.getLogger().warn(sm.getString("applicationHttpRequest.fragmentInDispatchPath", path));
+ path = path.substring(0, fragmentPos);
+ }
+
// If the path is already context-relative, just pass it through
- if (path == null)
- return (null);
- else if (path.startsWith("/"))
- return (context.getServletContext().getRequestDispatcher(path));
+ if (path.startsWith("/")) {
+ return context.getServletContext().getRequestDispatcher(path);
+ }
// Convert a request-relative path to a context-relative one
String servletPath =
@@ -343,10 +352,19 @@ class ApplicationHttpRequest
int pos = requestPath.lastIndexOf('/');
String relative = null;
- if (pos >= 0) {
- relative = requestPath.substring(0, pos + 1) + path;
+ if (context.getDispatchersUseEncodedPaths()) {
+ if (pos >= 0) {
+ relative = URLEncoder.DEFAULT.encode(
+ requestPath.substring(0, pos + 1), StandardCharsets.UTF_8) + path;
+ } else {
+ relative = URLEncoder.DEFAULT.encode(requestPath, StandardCharsets.UTF_8) + path;
+ }
} else {
- relative = requestPath + path;
+ if (pos >= 0) {
+ relative = requestPath.substring(0, pos + 1) + path;
+ } else {
+ relative = requestPath + path;
+ }
}
return (context.getServletContext().getRequestDispatcher(relative));
diff --git a/java/org/apache/catalina/core/LocalStrings.properties b/java/org/apache/catalina/core/LocalStrings.properties
index 409ced1..8e09920 100644
--- a/java/org/apache/catalina/core/LocalStrings.properties
+++ b/java/org/apache/catalina/core/LocalStrings.properties
@@ -55,6 +55,8 @@ applicationFilterConfig.release=Failed to destroy the filter named [{0}] of type
applicationFilterRegistration.nullInitParam=Unable to set initialisation parameter for filter due to null name and/or value. Name [{0}], Value [{1}]
applicationFilterRegistration.nullInitParams=Unable to set initialisation parameters for filter due to null name and/or value. Name [{0}], Value [{1}]
+applicationHttpRequest.fragmentInDispatchPath=The fragment in dispatch path [{0}] has been removed
+
applicationPushBuilder.methodInvalid=The HTTP method for a push request must be both cacheable and safe but [{0}] is not
applicationPushBuilder.methodNotToken=HTTP methods must be tokens but [{0}] contains a non-token character
applicationPushBuilder.noCoyoteRequest=Unable to find the underlying Coyote request object (which is required to create a push request) from the request of type [{0}]
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index e07bef4..9c9c838 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -58,6 +58,11 @@
Avoid potential <code>NullPointerException</code> when generating an
HTTP <code>Allow</code> header. Identified by Coverity Scan. (markt)
</fix>
+ <add>
+ Remove any fragment included in the target path used to obtain a
+ <code>RequestDispatcher</code>. The requested target path is logged as a
+ warning since this is an application error. (markt)
+ </add>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org