You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2025/01/23 09:27:50 UTC
(tomcat) branch main updated (8452ba800c -> 63fbbceef2)
This is an automated email from the ASF dual-hosted git repository.
markt pushed a change to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
from 8452ba800c Update docs
new c14a6f2e15 Refactor creation of RequestDispatcher instances for consistency
new 63fbbceef2 Alphabetical order
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../apache/catalina/core/ApplicationContext.java | 39 ++++++++++------------
...TestApplicationContextGetRequestDispatcher.java | 14 ++++----
webapps/docs/changelog.xml | 5 +++
webapps/docs/config/context.xml | 18 +++++-----
4 files changed, 38 insertions(+), 38 deletions(-)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
(tomcat) 01/02: Refactor creation of RequestDispatcher instances for consistency
Posted by ma...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit c14a6f2e15fe814b458697f4c80d1e5922acb217
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Wed Jan 22 16:43:15 2025 +0000
Refactor creation of RequestDispatcher instances for consistency
Paths should always be processed in this order before mapping
- remove query string
- remove path parameters
- decode
- normalize
---
.../apache/catalina/core/ApplicationContext.java | 39 ++++++++++------------
...TestApplicationContextGetRequestDispatcher.java | 14 ++++----
webapps/docs/changelog.xml | 5 +++
3 files changed, 29 insertions(+), 29 deletions(-)
diff --git a/java/org/apache/catalina/core/ApplicationContext.java b/java/org/apache/catalina/core/ApplicationContext.java
index 806ce3710d..353a16b597 100644
--- a/java/org/apache/catalina/core/ApplicationContext.java
+++ b/java/org/apache/catalina/core/ApplicationContext.java
@@ -372,36 +372,31 @@ public class ApplicationContext implements ServletContext {
queryString = null;
}
+ // From this point, the removal of path parameters, decoding and normalization is only for mapping purposes.
// Remove path parameters
- String uriNoParams = stripPathParams(uri);
+ String uriToMap = stripPathParams(uri);
+
+ // Decode only if the uri derived from the provided path is expected to be encoded
+ if (getContext().getDispatchersUseEncodedPaths()) {
+ uriToMap = UDecoder.URLDecode(uriToMap, StandardCharsets.UTF_8);
+ }
// Then normalize
- String normalizedUri = RequestUtil.normalize(uriNoParams);
- if (normalizedUri == null) {
+ uriToMap = RequestUtil.normalize(uriToMap);
+ if (uriToMap == null) {
+ getContext().getLogger().warn(sm.getString("applicationContext.illegalDispatchPath", path),
+ new IllegalArgumentException());
return null;
}
- // Mapping is against the normalized uri
-
+ /*
+ * uri is passed to the constructor for ApplicationDispatcher and is ultimately used as the value for
+ * getRequestURI() which returns encoded values. getContextPath() returns a decoded value. uri may be encoded or
+ * not. Need to prepend the context path to uri and ensure the result is correctly encoded.
+ */
if (getContext().getDispatchersUseEncodedPaths()) {
- // Decode
- String decodedUri = UDecoder.URLDecode(normalizedUri, StandardCharsets.UTF_8);
-
- // Security check to catch attempts to encode /../ sequences
- normalizedUri = RequestUtil.normalize(decodedUri);
- if (!decodedUri.equals(normalizedUri)) {
- getContext().getLogger().warn(sm.getString("applicationContext.illegalDispatchPath", path),
- new IllegalArgumentException());
- return null;
- }
-
- // URI needs to include the context path
uri = URLEncoder.DEFAULT.encode(getContextPath(), StandardCharsets.UTF_8) + uri;
} else {
- // uri is passed to the constructor for ApplicationDispatcher and is
- // ultimately used as the value for getRequestURI() which returns
- // encoded values. Therefore, since the value passed in for path
- // was decoded, encode uri here.
uri = URLEncoder.DEFAULT.encode(getContextPath() + uri, StandardCharsets.UTF_8);
}
@@ -422,7 +417,7 @@ public class ApplicationContext implements ServletContext {
CharChunk uriCC = uriMB.getCharChunk();
try {
uriCC.append(context.getPath());
- uriCC.append(normalizedUri);
+ uriCC.append(uriToMap);
service.getMapper().map(context, uriMB, mappingData);
if (mappingData.wrapper == null) {
return null;
diff --git a/test/org/apache/catalina/core/TestApplicationContextGetRequestDispatcher.java b/test/org/apache/catalina/core/TestApplicationContextGetRequestDispatcher.java
index ff19ec187c..8845de0a0f 100644
--- a/test/org/apache/catalina/core/TestApplicationContextGetRequestDispatcher.java
+++ b/test/org/apache/catalina/core/TestApplicationContextGetRequestDispatcher.java
@@ -85,13 +85,6 @@ public class TestApplicationContextGetRequestDispatcher extends TomcatBaseTest {
}
- @Test
- public void testGetRequestDispatcherEncodedTraversal() throws Exception {
- doTestGetRequestDispatcher(
- true, "/prefix/start", null, "%2E%2E/target", "/target", DispatcherServlet.NULL);
- }
-
-
@Test
public void testGetRequestDispatcherTraversal01() throws Exception {
doTestGetRequestDispatcher(
@@ -134,6 +127,13 @@ public class TestApplicationContextGetRequestDispatcher extends TomcatBaseTest {
}
+ @Test
+ public void testGetRequestDispatcherTraversal07() throws Exception {
+ doTestGetRequestDispatcher(
+ true, "/prefix/start", null, "../../target", "/target", DispatcherServlet.NULL);
+ }
+
+
@Test
public void testGetRequestDispatcher01() throws Exception {
doTestGetRequestDispatcher(
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 3c6726c3f2..005588a961 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -183,6 +183,11 @@
<code>DELETE</code> request because the target resource cannot be
deleted. Pull request <pr>802</pr> provided by Chenjp. (markt)
</fix>
+ <scode>
+ Refactor creation of <code>RequestDispatcher</code> instances so that
+ the processing of the provided path is consistent with normal request
+ processing. (markt)
+ </scode>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
(tomcat) 02/02: Alphabetical order
Posted by ma...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 63fbbceef2eb809308188cb5a16dfcc4b64b0ee3
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Thu Jan 23 09:27:28 2025 +0000
Alphabetical order
---
webapps/docs/config/context.xml | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/webapps/docs/config/context.xml b/webapps/docs/config/context.xml
index 7b4320ea29..69cbda5150 100644
--- a/webapps/docs/config/context.xml
+++ b/webapps/docs/config/context.xml
@@ -383,6 +383,15 @@
else the default value will be <code>false</code>.</p>
</attribute>
+ <attribute name="dispatchersUseEncodedPaths" required="false">
+ <p>Controls whether paths used in calls to obtain a request dispatcher
+ ares expected to be encoded. This affects both how Tomcat handles calls
+ to obtain a request dispatcher as well as how Tomcat generates paths
+ used to obtain request dispatchers internally. If not specified, the
+ default value of <code>true</code> is used. When encoding/decoding paths
+ for a request dispatcher, UTF-8 is always used.</p>
+ </attribute>
+
<attribute name="docBase" required="true">
<p>The <em>Document Base</em> (also known as the <em>Context
Root</em>) directory for this web application, or the pathname
@@ -400,15 +409,6 @@
sufficient.</p>
</attribute>
- <attribute name="dispatchersUseEncodedPaths" required="false">
- <p>Controls whether paths used in calls to obtain a request dispatcher
- ares expected to be encoded. This affects both how Tomcat handles calls
- to obtain a request dispatcher as well as how Tomcat generates paths
- used to obtain request dispatchers internally. If not specified, the
- default value of <code>true</code> is used. When encoding/decoding paths
- for a request dispatcher, UTF-8 is always used.</p>
- </attribute>
-
<attribute name="failCtxIfServletStartFails" required="false">
<p>Set to <code>true</code> to have the context fail its startup if any
servlet that has load-on-startup >=0 fails its own startup.</p>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org