You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sling.apache.org by "Ian Boston (JIRA)" <ji...@apache.org> on 2010/02/02 13:18:19 UTC
[jira] Created: (SLING-1344) Possible response split in
SlingSafeMethodsServlet
Possible response split in SlingSafeMethodsServlet
--------------------------------------------------
Key: SLING-1344
URL: https://issues.apache.org/jira/browse/SLING-1344
Project: Sling
Issue Type: Bug
Components: API
Affects Versions: API 2.0.8
Reporter: Ian Boston
Assignee: Ian Boston
Fix For: API 2.0.10
Headers in the doTrace method are echoed to the response, making it potentially possible to split a response.
Would suggest encoding the headers both name part and value part correctly
IIRC Value part should be URIEncoded ?
but name part Eliminate values outside 33 - 126 as per rfc 822 ?
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SLING-1344) Possible response split in
SlingSafeMethodsServlet
Posted by "Carsten Ziegeler (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-1344?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12849626#action_12849626 ]
Carsten Ziegeler commented on SLING-1344:
-----------------------------------------
Can you provide a patch for this?
> Possible response split in SlingSafeMethodsServlet
> --------------------------------------------------
>
> Key: SLING-1344
> URL: https://issues.apache.org/jira/browse/SLING-1344
> Project: Sling
> Issue Type: Bug
> Components: API
> Affects Versions: API 2.0.8
> Reporter: Ian Boston
> Assignee: Ian Boston
> Fix For: API 2.1.0
>
>
> Headers in the doTrace method are echoed to the response, making it potentially possible to split a response.
> Would suggest encoding the headers both name part and value part correctly
> IIRC Value part should be URIEncoded ?
>
> but name part Eliminate values outside 33 - 126 as per rfc 822 ?
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SLING-1344) Possible response split in
SlingSafeMethodsServlet
Posted by "Felix Meschberger (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-1344?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12849660#action_12849660 ]
Felix Meschberger commented on SLING-1344:
------------------------------------------
Is this Sling API ? Isn't this rather about the Default GET Servlet ?
And then as per SLING-1340 support for the TRACE method in the SlingMainServlet is configurable (switched off by default)
> Possible response split in SlingSafeMethodsServlet
> --------------------------------------------------
>
> Key: SLING-1344
> URL: https://issues.apache.org/jira/browse/SLING-1344
> Project: Sling
> Issue Type: Bug
> Components: API
> Affects Versions: API 2.0.8
> Reporter: Ian Boston
> Assignee: Ian Boston
> Fix For: API 2.1.0
>
>
> Headers in the doTrace method are echoed to the response, making it potentially possible to split a response.
> Would suggest encoding the headers both name part and value part correctly
> IIRC Value part should be URIEncoded ?
>
> but name part Eliminate values outside 33 - 126 as per rfc 822 ?
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Resolved: (SLING-1344) Possible response split in
SlingSafeMethodsServlet
Posted by "Ian Boston (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-1344?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ian Boston resolved SLING-1344.
-------------------------------
Resolution: Not A Problem
Since TRACE is disabled by default this is now a non issue.
> Possible response split in SlingSafeMethodsServlet
> --------------------------------------------------
>
> Key: SLING-1344
> URL: https://issues.apache.org/jira/browse/SLING-1344
> Project: Sling
> Issue Type: Bug
> Components: API
> Affects Versions: API 2.0.8
> Reporter: Ian Boston
> Assignee: Ian Boston
> Fix For: API 2.1.0
>
>
> Headers in the doTrace method are echoed to the response, making it potentially possible to split a response.
> Would suggest encoding the headers both name part and value part correctly
> IIRC Value part should be URIEncoded ?
>
> but name part Eliminate values outside 33 - 126 as per rfc 822 ?
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Closed: (SLING-1344) Possible response split in
SlingSafeMethodsServlet
Posted by "Felix Meschberger (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-1344?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Felix Meschberger closed SLING-1344.
------------------------------------
Mark issues only relating to Sling API 2.1.0 release as closed (others to be closed once the respective versions are released)
> Possible response split in SlingSafeMethodsServlet
> --------------------------------------------------
>
> Key: SLING-1344
> URL: https://issues.apache.org/jira/browse/SLING-1344
> Project: Sling
> Issue Type: Bug
> Components: API
> Affects Versions: API 2.0.8
> Reporter: Ian Boston
> Assignee: Ian Boston
> Fix For: API 2.1.0
>
>
> Headers in the doTrace method are echoed to the response, making it potentially possible to split a response.
> Would suggest encoding the headers both name part and value part correctly
> IIRC Value part should be URIEncoded ?
>
> but name part Eliminate values outside 33 - 126 as per rfc 822 ?
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.