You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@wicket.apache.org by "Jean-Baptiste Quenot (JIRA)" <ji...@apache.org> on 2007/04/27 09:58:15 UTC
[jira] Updated: (WICKET-40) Parameters of nice URL's pages with
'sensitive' characters
[ https://issues.apache.org/jira/browse/WICKET-40?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jean-Baptiste Quenot updated WICKET-40:
---------------------------------------
Attachment: 20070427-WICKET-40-WicketFilter-no-decoding.txt
The attached patch changes the way WicketFilter computes the relative URL by avoiding by any means calling getServletPath() or getPathInfo(), only using getRequestURI(), getContextPath() and getServletPath().
There is also a temporary patch to wicket-examples to be able to reproduce the issue. Go to http://localhost:8080/wicket-examples/helloservlet/ for the servlet case and http://localhost:8080/wicket-examples/helloworld/ for the filter case.
> Parameters of nice URL's pages with 'sensitive' characters
> ----------------------------------------------------------
>
> Key: WICKET-40
> URL: https://issues.apache.org/jira/browse/WICKET-40
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 1.2.3
> Reporter: Jan Bareš
> Assigned To: Alastair Maw
> Attachments: 20070427-WICKET-40-WicketFilter-no-decoding.txt
>
>
> Wicket uses HttpServletRequest.getPathInfo() to get the the URL. The returned string is already URL decoded, so when the request parameter pair contains %2F, it will be returned as '/', so the request pair will be broken (the same applies to other characters like '+' etc). This was cseen with Jetty 6 and Tomcat 5.5.
> Wicket should use HttpServletRequest.getRequestURI() or getRequestURL() as this seems to return URL as it was passed to the server.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.