You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@wicket.apache.org by "Jan Bareš (JIRA)" <ji...@apache.org> on 2006/11/10 10:47:41 UTC
[jira] Created: (WICKET-40) Parameters of nice URL's pages with
'sensitive' characters
Parameters of nice URL's pages with 'sensitive' characters
----------------------------------------------------------
Key: WICKET-40
URL: http://issues.apache.org/jira/browse/WICKET-40
Project: Wicket
Issue Type: Bug
Components: wicket
Affects Versions: 1.2.3
Reporter: Jan Bareš
Wicket uses HttpServletRequest.getPathInfo() to get the the URL. The returned string is already URL decoded, so when the request parameter pair contains %2F, it will be returned as '/', so the request pair will be broken (the same applies to other characters like '+' etc). This was cseen with Jetty 6 and Tomcat 5.5.
Wicket should use HttpServletRequest.getRequestURI() or getRequestURL() as this seems to return URL as it was passed to the server.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Commented: (WICKET-40) Parameters of nice URL's pages with
'sensitive' characters
Posted by "Jean-Baptiste Quenot (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WICKET-40?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12478467 ]
Jean-Baptiste Quenot commented on WICKET-40:
--------------------------------------------
Jan, can you please test it again after updating your SVN working copy. If you can still reproduce the problem, can you please be more specific and describe your usecase in details? Providing a quickstart, unit test or a patch can be useful. Thanks in advance!
> Parameters of nice URL's pages with 'sensitive' characters
> ----------------------------------------------------------
>
> Key: WICKET-40
> URL: https://issues.apache.org/jira/browse/WICKET-40
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 1.2.3
> Reporter: Jan Bareš
> Assigned To: Alastair Maw
>
> Wicket uses HttpServletRequest.getPathInfo() to get the the URL. The returned string is already URL decoded, so when the request parameter pair contains %2F, it will be returned as '/', so the request pair will be broken (the same applies to other characters like '+' etc). This was cseen with Jetty 6 and Tomcat 5.5.
> Wicket should use HttpServletRequest.getRequestURI() or getRequestURL() as this seems to return URL as it was passed to the server.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WICKET-40) Parameters of nice URL's pages with
'sensitive' characters
Posted by "Jan Bareš (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WICKET-40?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12479532 ]
Jan Bareš commented on WICKET-40:
---------------------------------
Thanks for the explanation, you can close the issue.
> Parameters of nice URL's pages with 'sensitive' characters
> ----------------------------------------------------------
>
> Key: WICKET-40
> URL: https://issues.apache.org/jira/browse/WICKET-40
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 1.2.3
> Reporter: Jan Bareš
> Assigned To: Alastair Maw
>
> Wicket uses HttpServletRequest.getPathInfo() to get the the URL. The returned string is already URL decoded, so when the request parameter pair contains %2F, it will be returned as '/', so the request pair will be broken (the same applies to other characters like '+' etc). This was cseen with Jetty 6 and Tomcat 5.5.
> Wicket should use HttpServletRequest.getRequestURI() or getRequestURL() as this seems to return URL as it was passed to the server.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WICKET-40) Parameters of nice URL's pages with
'sensitive' characters
Posted by "Jean-Baptiste Quenot (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WICKET-40?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12492222 ]
Jean-Baptiste Quenot commented on WICKET-40:
--------------------------------------------
I also tested this patch successfully with:
* "/wicket-examples" servlet context path and /* servlet mapping
* "/wicket-examples" servlet context path and /* filter mapping
* "" servlet context path and /* servlet mapping
* "" servlet context path and /* filter mapping
* "" servlet context path and /helloservlet/* servlet mapping
* "" servlet context path and /helloworld/* filter mapping
> Parameters of nice URL's pages with 'sensitive' characters
> ----------------------------------------------------------
>
> Key: WICKET-40
> URL: https://issues.apache.org/jira/browse/WICKET-40
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 1.2.3
> Reporter: Jan Bareš
> Assigned To: Alastair Maw
> Attachments: 20070427-WICKET-40-WicketFilter-no-decoding.txt
>
>
> Wicket uses HttpServletRequest.getPathInfo() to get the the URL. The returned string is already URL decoded, so when the request parameter pair contains %2F, it will be returned as '/', so the request pair will be broken (the same applies to other characters like '+' etc). This was cseen with Jetty 6 and Tomcat 5.5.
> Wicket should use HttpServletRequest.getRequestURI() or getRequestURL() as this seems to return URL as it was passed to the server.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WICKET-40) Parameters of nice URL's pages with
'sensitive' characters
Posted by "Alastair Maw (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WICKET-40?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12493499 ]
Alastair Maw commented on WICKET-40:
------------------------------------
I can see what you're trying to achieve with this, but it's breaking some unit tests in wicket-examples. I'm looking into fixing this right now.
> Parameters of nice URL's pages with 'sensitive' characters
> ----------------------------------------------------------
>
> Key: WICKET-40
> URL: https://issues.apache.org/jira/browse/WICKET-40
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 1.2.3
> Reporter: Jan Bareš
> Assigned To: Alastair Maw
> Priority: Critical
> Attachments: 20070427-WICKET-40-WicketFilter-no-decoding.txt
>
>
> Wicket uses HttpServletRequest.getPathInfo() to get the the URL. The returned string is already URL decoded, so when the request parameter pair contains %2F, it will be returned as '/', so the request pair will be broken (the same applies to other characters like '+' etc). This was cseen with Jetty 6 and Tomcat 5.5.
> Wicket should use HttpServletRequest.getRequestURI() or getRequestURL() as this seems to return URL as it was passed to the server.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WICKET-40) Parameters of nice URL's pages with
'sensitive' characters
Posted by "Jean-Baptiste Quenot (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WICKET-40?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12493423 ]
Jean-Baptiste Quenot commented on WICKET-40:
--------------------------------------------
Just added some httpunit-based unit tests in wicket-examples, see revision 534932. Just need to apply the patch to WicketFilter now and rename bugTestXXX() methods to testXXX()
> Parameters of nice URL's pages with 'sensitive' characters
> ----------------------------------------------------------
>
> Key: WICKET-40
> URL: https://issues.apache.org/jira/browse/WICKET-40
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 1.2.3
> Reporter: Jan Bareš
> Assigned To: Alastair Maw
> Priority: Critical
> Attachments: 20070427-WICKET-40-WicketFilter-no-decoding.txt
>
>
> Wicket uses HttpServletRequest.getPathInfo() to get the the URL. The returned string is already URL decoded, so when the request parameter pair contains %2F, it will be returned as '/', so the request pair will be broken (the same applies to other characters like '+' etc). This was cseen with Jetty 6 and Tomcat 5.5.
> Wicket should use HttpServletRequest.getRequestURI() or getRequestURL() as this seems to return URL as it was passed to the server.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WICKET-40) Parameters of nice URL's pages with
'sensitive' characters
Posted by "Jean-Baptiste Quenot (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WICKET-40?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12479571 ]
Jean-Baptiste Quenot commented on WICKET-40:
--------------------------------------------
So the culprit must be:
In ServletWebRequest I find:
public String getPath()
{
return ((WebApplication)Application.get()).getWicketFilter().getRelativePath(
httpServletRequest);
}
And in WicketFilter:
public String getRelativePath(HttpServletRequest request) {
String path = request.getServletPath();
...
So WicketFilter is the culprit, as getServletPath() decodes the URL, see:
http://java.sun.com/j2ee/sdk_1.3/techdocs/api/javax/servlet/http/HttpServletRequest.html#getServletPath()
> Parameters of nice URL's pages with 'sensitive' characters
> ----------------------------------------------------------
>
> Key: WICKET-40
> URL: https://issues.apache.org/jira/browse/WICKET-40
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 1.2.3
> Reporter: Jan Bareš
> Assigned To: Alastair Maw
>
> Wicket uses HttpServletRequest.getPathInfo() to get the the URL. The returned string is already URL decoded, so when the request parameter pair contains %2F, it will be returned as '/', so the request pair will be broken (the same applies to other characters like '+' etc). This was cseen with Jetty 6 and Tomcat 5.5.
> Wicket should use HttpServletRequest.getRequestURI() or getRequestURL() as this seems to return URL as it was passed to the server.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (WICKET-40) Parameters of nice URL's pages with
'sensitive' characters
Posted by "Jean-Baptiste Quenot (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WICKET-40?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jean-Baptiste Quenot updated WICKET-40:
---------------------------------------
Priority: Critical (was: Major)
> Parameters of nice URL's pages with 'sensitive' characters
> ----------------------------------------------------------
>
> Key: WICKET-40
> URL: https://issues.apache.org/jira/browse/WICKET-40
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 1.2.3
> Reporter: Jan Bareš
> Assigned To: Alastair Maw
> Priority: Critical
> Attachments: 20070427-WICKET-40-WicketFilter-no-decoding.txt
>
>
> Wicket uses HttpServletRequest.getPathInfo() to get the the URL. The returned string is already URL decoded, so when the request parameter pair contains %2F, it will be returned as '/', so the request pair will be broken (the same applies to other characters like '+' etc). This was cseen with Jetty 6 and Tomcat 5.5.
> Wicket should use HttpServletRequest.getRequestURI() or getRequestURL() as this seems to return URL as it was passed to the server.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (WICKET-40) Parameters of nice URL's pages with
'sensitive' characters
Posted by "Jean-Baptiste Quenot (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WICKET-40?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jean-Baptiste Quenot updated WICKET-40:
---------------------------------------
Fix Version/s: (was: trunk)
1.3.0-beta2
> Parameters of nice URL's pages with 'sensitive' characters
> ----------------------------------------------------------
>
> Key: WICKET-40
> URL: https://issues.apache.org/jira/browse/WICKET-40
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 1.2.3
> Reporter: Jan Bareš
> Assignee: Jean-Baptiste Quenot
> Priority: Critical
> Fix For: 1.3.0-beta2
>
> Attachments: 20070427-WICKET-40-WicketFilter-no-decoding.txt
>
>
> Wicket uses HttpServletRequest.getPathInfo() to get the the URL. The returned string is already URL decoded, so when the request parameter pair contains %2F, it will be returned as '/', so the request pair will be broken (the same applies to other characters like '+' etc). This was cseen with Jetty 6 and Tomcat 5.5.
> Wicket should use HttpServletRequest.getRequestURI() or getRequestURL() as this seems to return URL as it was passed to the server.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WICKET-40) Parameters of nice URL's pages with
'sensitive' characters
Posted by "Jean-Baptiste Quenot (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WICKET-40?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12479429 ]
Jean-Baptiste Quenot commented on WICKET-40:
--------------------------------------------
I think we can close the issue now, I'm sure it has been fixed by WICKET-358
> Parameters of nice URL's pages with 'sensitive' characters
> ----------------------------------------------------------
>
> Key: WICKET-40
> URL: https://issues.apache.org/jira/browse/WICKET-40
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 1.2.3
> Reporter: Jan Bareš
> Assigned To: Alastair Maw
>
> Wicket uses HttpServletRequest.getPathInfo() to get the the URL. The returned string is already URL decoded, so when the request parameter pair contains %2F, it will be returned as '/', so the request pair will be broken (the same applies to other characters like '+' etc). This was cseen with Jetty 6 and Tomcat 5.5.
> Wicket should use HttpServletRequest.getRequestURI() or getRequestURL() as this seems to return URL as it was passed to the server.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WICKET-40) Parameters of nice URL's pages with
'sensitive' characters
Posted by "Jean-Baptiste Quenot (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WICKET-40?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12479426 ]
Jean-Baptiste Quenot commented on WICKET-40:
--------------------------------------------
What about this:
http://wicketstuff.org/wicket13/niceurl/path/to/page2/param2/sla%3Ash/param1/sss
Please use wicketstuff.org from now on for getting access to a running Wicket system.
> Parameters of nice URL's pages with 'sensitive' characters
> ----------------------------------------------------------
>
> Key: WICKET-40
> URL: https://issues.apache.org/jira/browse/WICKET-40
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 1.2.3
> Reporter: Jan Bareš
> Assigned To: Alastair Maw
>
> Wicket uses HttpServletRequest.getPathInfo() to get the the URL. The returned string is already URL decoded, so when the request parameter pair contains %2F, it will be returned as '/', so the request pair will be broken (the same applies to other characters like '+' etc). This was cseen with Jetty 6 and Tomcat 5.5.
> Wicket should use HttpServletRequest.getRequestURI() or getRequestURL() as this seems to return URL as it was passed to the server.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WICKET-40) Parameters of nice URL's pages with
'sensitive' characters
Posted by "Jan Bareš (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WICKET-40?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12479375 ]
Jan Bareš commented on WICKET-40:
---------------------------------
I don't have the possibility to test fresh SVN copy now, but I tried on wicket-examples:
http://www.wicket-library.com/wicket-examples/niceurl/path/to/page2/param2/sla%2Fsh/param1/sss
The param2 should display "sla/sh" but instead wicket crashes.
> Parameters of nice URL's pages with 'sensitive' characters
> ----------------------------------------------------------
>
> Key: WICKET-40
> URL: https://issues.apache.org/jira/browse/WICKET-40
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 1.2.3
> Reporter: Jan Bareš
> Assigned To: Alastair Maw
>
> Wicket uses HttpServletRequest.getPathInfo() to get the the URL. The returned string is already URL decoded, so when the request parameter pair contains %2F, it will be returned as '/', so the request pair will be broken (the same applies to other characters like '+' etc). This was cseen with Jetty 6 and Tomcat 5.5.
> Wicket should use HttpServletRequest.getRequestURI() or getRequestURL() as this seems to return URL as it was passed to the server.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (WICKET-40) Parameters of nice URL's pages with
'sensitive' characters
Posted by "Jean-Baptiste Quenot (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WICKET-40?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jean-Baptiste Quenot updated WICKET-40:
---------------------------------------
Attachment: 20070427-WICKET-40-WicketFilter-no-decoding.txt
The attached patch changes the way WicketFilter computes the relative URL by avoiding by any means calling getServletPath() or getPathInfo(), only using getRequestURI(), getContextPath() and getServletPath().
There is also a temporary patch to wicket-examples to be able to reproduce the issue. Go to http://localhost:8080/wicket-examples/helloservlet/ for the servlet case and http://localhost:8080/wicket-examples/helloworld/ for the filter case.
> Parameters of nice URL's pages with 'sensitive' characters
> ----------------------------------------------------------
>
> Key: WICKET-40
> URL: https://issues.apache.org/jira/browse/WICKET-40
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 1.2.3
> Reporter: Jan Bareš
> Assigned To: Alastair Maw
> Attachments: 20070427-WICKET-40-WicketFilter-no-decoding.txt
>
>
> Wicket uses HttpServletRequest.getPathInfo() to get the the URL. The returned string is already URL decoded, so when the request parameter pair contains %2F, it will be returned as '/', so the request pair will be broken (the same applies to other characters like '+' etc). This was cseen with Jetty 6 and Tomcat 5.5.
> Wicket should use HttpServletRequest.getRequestURI() or getRequestURL() as this seems to return URL as it was passed to the server.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Resolved: (WICKET-40) Parameters of nice URL's pages with
'sensitive' characters
Posted by "Jean-Baptiste Quenot (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WICKET-40?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jean-Baptiste Quenot resolved WICKET-40.
----------------------------------------
Resolution: Fixed
Fix Version/s: 1.3
Assignee: Jean-Baptiste Quenot (was: Alastair Maw)
WicketFilter changed, and tests fixed.
> Parameters of nice URL's pages with 'sensitive' characters
> ----------------------------------------------------------
>
> Key: WICKET-40
> URL: https://issues.apache.org/jira/browse/WICKET-40
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 1.2.3
> Reporter: Jan Bareš
> Assigned To: Jean-Baptiste Quenot
> Priority: Critical
> Fix For: 1.3
>
> Attachments: 20070427-WICKET-40-WicketFilter-no-decoding.txt
>
>
> Wicket uses HttpServletRequest.getPathInfo() to get the the URL. The returned string is already URL decoded, so when the request parameter pair contains %2F, it will be returned as '/', so the request pair will be broken (the same applies to other characters like '+' etc). This was cseen with Jetty 6 and Tomcat 5.5.
> Wicket should use HttpServletRequest.getRequestURI() or getRequestURL() as this seems to return URL as it was passed to the server.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WICKET-40) Parameters of nice URL's pages with
'sensitive' characters
Posted by "Johan Compagner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WICKET-40?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12468932 ]
Johan Compagner commented on WICKET-40:
---------------------------------------
this should be rewritten anyway.
Now it is a mess. We do encoding everywhere some & -> $amp; and then urlencode on params.
We should remove those everywhere. And use Request.encodeUrl or something like that
to really encode the url correctly at once.
> Parameters of nice URL's pages with 'sensitive' characters
> ----------------------------------------------------------
>
> Key: WICKET-40
> URL: https://issues.apache.org/jira/browse/WICKET-40
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 1.2.3
> Reporter: Jan Bare?
> Assigned To: Alastair Maw
>
> Wicket uses HttpServletRequest.getPathInfo() to get the the URL. The returned string is already URL decoded, so when the request parameter pair contains %2F, it will be returned as '/', so the request pair will be broken (the same applies to other characters like '+' etc). This was cseen with Jetty 6 and Tomcat 5.5.
> Wicket should use HttpServletRequest.getRequestURI() or getRequestURL() as this seems to return URL as it was passed to the server.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WICKET-40) Parameters of nice URL's pages with
'sensitive' characters
Posted by "Jan Bareš (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WICKET-40?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12479518 ]
Jan Bareš commented on WICKET-40:
---------------------------------
Thanks, I tried, but the problem still persist, please mind the %2F, which is '/' character, so the result should be "sla/sh". The ":" doesn't clash with parameters, but "/" does.
http://wicketstuff.org/wicket13/niceurl/path/to/page2/param2/sla%2Fsh/param1/sss
> Parameters of nice URL's pages with 'sensitive' characters
> ----------------------------------------------------------
>
> Key: WICKET-40
> URL: https://issues.apache.org/jira/browse/WICKET-40
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 1.2.3
> Reporter: Jan Bareš
> Assigned To: Alastair Maw
>
> Wicket uses HttpServletRequest.getPathInfo() to get the the URL. The returned string is already URL decoded, so when the request parameter pair contains %2F, it will be returned as '/', so the request pair will be broken (the same applies to other characters like '+' etc). This was cseen with Jetty 6 and Tomcat 5.5.
> Wicket should use HttpServletRequest.getRequestURI() or getRequestURL() as this seems to return URL as it was passed to the server.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WICKET-40) Parameters of nice URL's pages with
'sensitive' characters
Posted by "Jean-Baptiste Quenot (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WICKET-40?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12479570 ]
Jean-Baptiste Quenot commented on WICKET-40:
--------------------------------------------
Mmm actually, looking at the very description of this issue, you are right:
The Javadoc for getRequestURI() states that the URI is *not* decoded:
http://java.sun.com/j2ee/sdk_1.3/techdocs/api/javax/servlet/http/HttpServletRequest.html#getRequestURI()
Whereas it is for getPathInfo(). So we may want to take a look at this issue, indeed.
> Parameters of nice URL's pages with 'sensitive' characters
> ----------------------------------------------------------
>
> Key: WICKET-40
> URL: https://issues.apache.org/jira/browse/WICKET-40
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 1.2.3
> Reporter: Jan Bareš
> Assigned To: Alastair Maw
>
> Wicket uses HttpServletRequest.getPathInfo() to get the the URL. The returned string is already URL decoded, so when the request parameter pair contains %2F, it will be returned as '/', so the request pair will be broken (the same applies to other characters like '+' etc). This was cseen with Jetty 6 and Tomcat 5.5.
> Wicket should use HttpServletRequest.getRequestURI() or getRequestURL() as this seems to return URL as it was passed to the server.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WICKET-40) Parameters of nice URL's pages with
'sensitive' characters
Posted by "Jean-Baptiste Quenot (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WICKET-40?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12479529 ]
Jean-Baptiste Quenot commented on WICKET-40:
--------------------------------------------
Using a slash in one of the parameter's key or value is another story because the URI is already decoded by the servlet container or web server. So it leads to unmatched key pair error because request.getURI() already returns a decoded URI like
/niceurl/path/to/page2/param2/sla/sh/param1/sss
You have to encode the encoded slash, like this:
http://localhost:8080/wicket-examples/niceurl/path/to/page2/param2/sla%252Fsh/param1/sss
On the older wicket snapshost, triple encode seems to be needed:
http://www.wicket-library.com/wicket-examples/niceurl/path/to/page2/param2/sla%25252Fsh/param1/sss
In other words, the servlet API does not offer a facility for parsing query parameters in this form using slashes, only using the query string beginning with "?" so you'd better avoid encoding slashes in the bookmarkable page parameters. Wicket does its best to parse the slashes-delimited query parameters, but it's far from being perfect.
> Parameters of nice URL's pages with 'sensitive' characters
> ----------------------------------------------------------
>
> Key: WICKET-40
> URL: https://issues.apache.org/jira/browse/WICKET-40
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 1.2.3
> Reporter: Jan Bareš
> Assigned To: Alastair Maw
>
> Wicket uses HttpServletRequest.getPathInfo() to get the the URL. The returned string is already URL decoded, so when the request parameter pair contains %2F, it will be returned as '/', so the request pair will be broken (the same applies to other characters like '+' etc). This was cseen with Jetty 6 and Tomcat 5.5.
> Wicket should use HttpServletRequest.getRequestURI() or getRequestURL() as this seems to return URL as it was passed to the server.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Assigned: (WICKET-40) Parameters of nice URL's pages with
'sensitive' characters
Posted by "Eelco Hillenius (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WICKET-40?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Eelco Hillenius reassigned WICKET-40:
-------------------------------------
Assignee: Alastair Maw
If you don't mind, here's another one for ya
> Parameters of nice URL's pages with 'sensitive' characters
> ----------------------------------------------------------
>
> Key: WICKET-40
> URL: https://issues.apache.org/jira/browse/WICKET-40
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 1.2.3
> Reporter: Jan Bare?
> Assigned To: Alastair Maw
>
> Wicket uses HttpServletRequest.getPathInfo() to get the the URL. The returned string is already URL decoded, so when the request parameter pair contains %2F, it will be returned as '/', so the request pair will be broken (the same applies to other characters like '+' etc). This was cseen with Jetty 6 and Tomcat 5.5.
> Wicket should use HttpServletRequest.getRequestURI() or getRequestURL() as this seems to return URL as it was passed to the server.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.