You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@struts.apache.org by "Lukasz Lenart (JIRA)" <ji...@apache.org> on 2014/03/19 09:40:48 UTC
[jira] [Resolved] (WW-4187) ServletRedirectResult only works with a
limited set of hardcoded URL protocols
[ https://issues.apache.org/jira/browse/WW-4187?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Lukasz Lenart resolved WW-4187.
-------------------------------
Resolution: Fixed
Assignee: Lukasz Lenart
Done!
> ServletRedirectResult only works with a limited set of hardcoded URL protocols
> ------------------------------------------------------------------------------
>
> Key: WW-4187
> URL: https://issues.apache.org/jira/browse/WW-4187
> Project: Struts 2
> Issue Type: Bug
> Affects Versions: 2.3.7, 2.3.8, 2.3.12, 2.3.14, 2.3.14.1, 2.3.14.2, 2.3.14.3, 2.3.15.1
> Reporter: Michiel Toneman
> Assignee: Lukasz Lenart
> Fix For: 2.3.17
>
>
> The isPathUrl(String url) implementation was changed from:
> {code:java}
> return (url.indexOf(':') == -1);
> {code}
> to:
> {code:java}
> return !url.startsWith("http:")
> && !url.startsWith("https:")
> && !url.startsWith("mailto:")
> && !url.startsWith("file:")
> && !url.startsWith("ftp:");
> {code}
> This breaks integrations which require a redirect in (e.g.) a mobile app for iOS which often use custom protocols such as myapp://
> There are also numerous valid / common protocols which are not in this list.
> The result of this change is that redirects to such URLs are treated as local redirects (paths), rather than absolute redirects.
--
This message was sent by Atlassian JIRA
(v6.2#6252)