You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-commits@hadoop.apache.org by su...@apache.org on 2012/10/17 08:58:03 UTC
svn commit: r1399127 - in /hadoop/common/branches/branch-1: CHANGES.txt
src/core/org/apache/hadoop/http/HttpServer.java
src/test/org/apache/hadoop/http/TestHttpServer.java
Author: suresh
Date: Wed Oct 17 06:58:03 2012
New Revision: 1399127
URL: http://svn.apache.org/viewvc?rev=1399127&view=rev
Log:
HADOOP-6496. HttpServer sends wrong content-type for CSS files. Backported by Ivan Mitic.
Modified:
hadoop/common/branches/branch-1/CHANGES.txt
hadoop/common/branches/branch-1/src/core/org/apache/hadoop/http/HttpServer.java
hadoop/common/branches/branch-1/src/test/org/apache/hadoop/http/TestHttpServer.java
Modified: hadoop/common/branches/branch-1/CHANGES.txt
URL: http://svn.apache.org/viewvc/hadoop/common/branches/branch-1/CHANGES.txt?rev=1399127&r1=1399126&r2=1399127&view=diff
==============================================================================
--- hadoop/common/branches/branch-1/CHANGES.txt (original)
+++ hadoop/common/branches/branch-1/CHANGES.txt Wed Oct 17 06:58:03 2012
@@ -254,6 +254,9 @@ Release 1.2.0 - unreleased
HADOOP-8882. Uppercase namenode host name causes fsck to fail when
useKsslAuth is on. (Arpit Gupta via suresh)
+ HADOOP-6496. HttpServer sends wrong content-type for CSS files.
+ (Todd Lipcon, Backport by Ivan Mitic via suresh).
+
Release 1.1.0 - unreleased
INCOMPATIBLE CHANGES
Modified: hadoop/common/branches/branch-1/src/core/org/apache/hadoop/http/HttpServer.java
URL: http://svn.apache.org/viewvc/hadoop/common/branches/branch-1/src/core/org/apache/hadoop/http/HttpServer.java?rev=1399127&r1=1399126&r2=1399127&view=diff
==============================================================================
--- hadoop/common/branches/branch-1/src/core/org/apache/hadoop/http/HttpServer.java (original)
+++ hadoop/common/branches/branch-1/src/core/org/apache/hadoop/http/HttpServer.java Wed Oct 17 06:58:03 2012
@@ -51,9 +51,12 @@ import org.apache.hadoop.security.Krb5An
import org.apache.hadoop.security.UserGroupInformation;
import org.apache.hadoop.security.authorize.AccessControlList;
import org.apache.hadoop.util.ReflectionUtils;
+import org.mortbay.io.Buffer;
import org.mortbay.jetty.Connector;
import org.mortbay.jetty.Handler;
+import org.mortbay.jetty.MimeTypes;
import org.mortbay.jetty.Server;
+import org.mortbay.jetty.handler.ContextHandler;
import org.mortbay.jetty.handler.ContextHandlerCollection;
import org.mortbay.jetty.nio.SelectChannelConnector;
import org.mortbay.jetty.security.SslSocketConnector;
@@ -763,6 +766,7 @@ public class HttpServer implements Filte
* all of the servlets resistant to cross-site scripting attacks.
*/
public static class QuotingInputFilter implements Filter {
+ private FilterConfig config;
public static class RequestQuoter extends HttpServletRequestWrapper {
private final HttpServletRequest rawRequest;
@@ -850,6 +854,7 @@ public class HttpServer implements Filte
@Override
public void init(FilterConfig config) throws ServletException {
+ this.config = config;
}
@Override
@@ -863,12 +868,29 @@ public class HttpServer implements Filte
) throws IOException, ServletException {
HttpServletRequestWrapper quoted =
new RequestQuoter((HttpServletRequest) request);
- final HttpServletResponse httpResponse = (HttpServletResponse) response;
- // set the default to UTF-8 so that we don't need to worry about IE7
- // choosing to interpret the special characters as UTF-7
- httpResponse.setContentType("text/html;charset=utf-8");
- chain.doFilter(quoted, response);
- }
+ HttpServletResponse httpResponse = (HttpServletResponse) response;
+ String mime = inferMimeType(request);
+ if (mime == null || mime.equals("text/html")) {
+ // no extension or HTML with unspecified encoding, we want to
+ // force HTML with utf-8 encoding
+ // This is to avoid the following security issue:
+ // http://openmya.hacker.jp/hasegawa/security/utf7cs.html
+ httpResponse.setContentType("text/html; charset=utf-8");
+ }
+ chain.doFilter(quoted, httpResponse);
+ }
+
+ /**
+ * Infer the mime type for the response based on the extension of the request
+ * URI. Returns null if unknown.
+ */
+ private String inferMimeType(ServletRequest request) {
+ String path = ((HttpServletRequest)request).getRequestURI();
+ ContextHandler.SContext sContext = (ContextHandler.SContext)config.getServletContext();
+ MimeTypes mimes = sContext.getContextHandler().getMimeTypes();
+ Buffer mimeBuffer = mimes.getMimeByExtension(path);
+ return (mimeBuffer == null) ? null : mimeBuffer.toString();
+ }
}
}
Modified: hadoop/common/branches/branch-1/src/test/org/apache/hadoop/http/TestHttpServer.java
URL: http://svn.apache.org/viewvc/hadoop/common/branches/branch-1/src/test/org/apache/hadoop/http/TestHttpServer.java?rev=1399127&r1=1399126&r2=1399127&view=diff
==============================================================================
--- hadoop/common/branches/branch-1/src/test/org/apache/hadoop/http/TestHttpServer.java (original)
+++ hadoop/common/branches/branch-1/src/test/org/apache/hadoop/http/TestHttpServer.java Wed Oct 17 06:58:03 2012
@@ -23,6 +23,7 @@ import java.io.File;
import java.io.IOException;
import java.io.InputStream;
import java.io.PrintStream;
+import java.net.URLConnection;
import java.net.HttpURLConnection;
import java.net.URL;
import java.util.Arrays;
@@ -162,6 +163,30 @@ public class TestHttpServer {
readOutput(new URL(baseUrl, "/echomap?a=b&c<=d&a=>")));
}
+ @Test public void testContentTypes() throws Exception {
+ // Static CSS files should have text/css
+ URL cssUrl = new URL(baseUrl, "/static/hadoop.css");
+ HttpURLConnection conn = (HttpURLConnection)cssUrl.openConnection();
+ conn.connect();
+ assertEquals(200, conn.getResponseCode());
+ assertEquals("text/css", conn.getContentType());
+
+ // Servlets should have text/html with proper encoding
+ URL servletUrl = new URL(baseUrl, "/echo?a=b");
+ conn = (HttpURLConnection)servletUrl.openConnection();
+ conn.connect();
+ assertEquals(200, conn.getResponseCode());
+ assertEquals("text/html; charset=utf-8", conn.getContentType());
+
+ // We should ignore parameters for mime types - ie a parameter
+ // ending in .css should not change mime type
+ servletUrl = new URL(baseUrl, "/echo?a=b.css");
+ conn = (HttpURLConnection)servletUrl.openConnection();
+ conn.connect();
+ assertEquals(200, conn.getResponseCode());
+ assertEquals("text/html; charset=utf-8", conn.getContentType());
+ }
+
/**
* Dummy filter that mimics as an authentication filter. Obtains user identity
* from the request parameter user.name. Wraps around the request so that