You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2017/06/15 16:41:00 UTC
[10/15] cxf git commit: Merge pull request #3 from
exabrial/TRIBESTRM-3973_CVE-2016-6812
Merge pull request #3 from exabrial/TRIBESTRM-3973_CVE-2016-6812
[TRIBESTRM-3973] CVE-2016-6812
Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/d8e4ea6a
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/d8e4ea6a
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/d8e4ea6a
Branch: refs/heads/2.6.x-fixes
Commit: d8e4ea6a67b4093f703387919a98f0026a9d6724
Parents: 73963a7
Author: Tod Bookless <tb...@tomitribe.com>
Authored: Fri Jun 2 15:48:04 2017 -0700
Committer: Jonathan S. Fisher <jf...@tomitribe.com>
Committed: Wed Jun 7 15:11:59 2017 -0500
----------------------------------------------------------------------
.../cxf/transport/servlet/BaseUrlHelper.java | 15 +++++---
.../servicelist/FormattedServiceListWriter.java | 6 +++-
.../ServiceListGeneratorServlet.java | 20 +++++++++--
.../jaxrs/JAXRSClientServerSpringBookTest.java | 37 +++++++++++++++++++-
4 files changed, 70 insertions(+), 8 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf/blob/d8e4ea6a/rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/BaseUrlHelper.java
----------------------------------------------------------------------
diff --git a/rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/BaseUrlHelper.java b/rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/BaseUrlHelper.java
index db80a07..76b2143 100644
--- a/rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/BaseUrlHelper.java
+++ b/rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/BaseUrlHelper.java
@@ -37,9 +37,8 @@ public final class BaseUrlHelper {
*/
public static String getBaseURL(HttpServletRequest request) {
String reqPrefix = request.getRequestURL().toString();
- String pathInfo = request.getPathInfo() == null ? "" : request.getPathInfo();
- //fix for CXF-898
- if (!"/".equals(pathInfo) || reqPrefix.endsWith("/")) {
+ String pathInfo = request.getPathInfo();
+ if (!"/".equals(pathInfo) || reqPrefix.contains(";")) {
StringBuilder sb = new StringBuilder();
// request.getScheme(), request.getLocalName() and request.getLocalPort()
// should be marginally cheaper - provided request.getLocalName() does
@@ -48,7 +47,15 @@ public final class BaseUrlHelper {
URI uri = URI.create(reqPrefix);
sb.append(uri.getScheme()).append("://").append(uri.getRawAuthority());
- sb.append(request.getContextPath()).append(request.getServletPath());
+
+ String contextPath = request.getContextPath();
+ if (contextPath != null) {
+ sb.append(contextPath);
+ }
+ String servletPath = request.getServletPath();
+ if (servletPath != null) {
+ sb.append(servletPath);
+ }
reqPrefix = sb.toString();
}
http://git-wip-us.apache.org/repos/asf/cxf/blob/d8e4ea6a/rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/servicelist/FormattedServiceListWriter.java
----------------------------------------------------------------------
diff --git a/rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/servicelist/FormattedServiceListWriter.java b/rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/servicelist/FormattedServiceListWriter.java
index 62bbb86..45edf79 100644
--- a/rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/servicelist/FormattedServiceListWriter.java
+++ b/rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/servicelist/FormattedServiceListWriter.java
@@ -129,7 +129,11 @@ public class FormattedServiceListWriter implements ServiceListWriter {
return null;
}
} else {
- return basePath + endpointAddress;
+ String address = basePath;
+ if (address.endsWith("/") && endpointAddress.startsWith("/")) {
+ address = address.substring(0, address.length() - 1);
+ }
+ return address + endpointAddress;
}
}
http://git-wip-us.apache.org/repos/asf/cxf/blob/d8e4ea6a/rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/servicelist/ServiceListGeneratorServlet.java
----------------------------------------------------------------------
diff --git a/rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/servicelist/ServiceListGeneratorServlet.java b/rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/servicelist/ServiceListGeneratorServlet.java
index 338956a..65bc39e 100644
--- a/rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/servicelist/ServiceListGeneratorServlet.java
+++ b/rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/servicelist/ServiceListGeneratorServlet.java
@@ -111,9 +111,25 @@ public class ServiceListGeneratorServlet extends HttpServlet {
String styleSheetPath;
if (serviceListStyleSheet != null) {
styleSheetPath = request.getContextPath() + "/" + serviceListStyleSheet;
-
} else {
- styleSheetPath = request.getRequestURI() + "/?stylesheet=1";
+ styleSheetPath = "";
+ String contextPath = request.getContextPath();
+ if (contextPath != null) {
+ styleSheetPath += contextPath;
+ }
+ String servletPath = request.getServletPath();
+ if (servletPath != null) {
+ styleSheetPath += servletPath;
+ }
+ String pathInfo = request.getPathInfo();
+ if (pathInfo != null) {
+ styleSheetPath += pathInfo;
+ }
+
+ if (!styleSheetPath.endsWith("/")) {
+ styleSheetPath += "/";
+ }
+ styleSheetPath += "?stylesheet=1";
}
serviceListWriter =
new FormattedServiceListWriter(styleSheetPath, title, showForeignContexts, atomMap);
http://git-wip-us.apache.org/repos/asf/cxf/blob/d8e4ea6a/systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/JAXRSClientServerSpringBookTest.java
----------------------------------------------------------------------
diff --git a/systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/JAXRSClientServerSpringBookTest.java b/systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/JAXRSClientServerSpringBookTest.java
index 8c5794d..4f87b93 100644
--- a/systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/JAXRSClientServerSpringBookTest.java
+++ b/systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/JAXRSClientServerSpringBookTest.java
@@ -70,7 +70,42 @@ public class JAXRSClientServerSpringBookTest extends AbstractBusClientServerTest
launchServer(BookServerSpring.class));
createStaticBus();
}
-
+
+ @Test
+ public void testGetServicesPageNotFound() throws Exception {
+ final String address = "http://localhost:" + PORT + "/the/services;a=b";
+ WebClient wc = WebClient.create(address).accept("text/*");
+ WebClient.getConfig(wc).getHttpConduit().getClient().setReceiveTimeout(10000000);
+ Response response = wc.get();
+ String s = getStringFromInputStream((InputStream) response.getEntity());
+ assertNotNull(s);
+ assertTrue(s.contains("No service was found"));
+ assertFalse(s.contains(";a=b"));
+ assertEquals(404, response.getStatus());
+ }
+
+ @Test
+ public void testGetServicesPageWithServletPatternMatchOnly() throws Exception {
+ final String address = "http://localhost:" + PORT + "/the/;a=b";
+ WebClient wc = WebClient.create(address).accept("text/*");
+ String s = wc.get(String.class);
+ assertTrue(s.contains("href=\"/the/?stylesheet=1\""));
+ assertTrue(s.contains("<title>CXF - Service list</title>"));
+ assertFalse(s.contains(";a=b"));
+ assertTrue(s.contains("<a href=\"http://localhost:" + PORT + "/the/"));
+ }
+
+ @Test
+ public void testGetServicesPageWithServletPatternMatchOnly2() throws Exception {
+ final String address = "http://localhost:" + PORT + "/the;a=b;/services;a=b/;a=b";
+ WebClient wc = WebClient.create(address).accept("text/*");
+ String s = wc.get(String.class);
+ assertTrue(s.contains("href=\"/the/?stylesheet=1\""));
+ assertTrue(s.contains("<title>CXF - Service list</title>"));
+ assertFalse(s.contains(";a=b"));
+ assertTrue(s.contains("<a href=\"http://localhost:" + PORT + "/the/thebooks/bookstore"));
+ }
+
@Test
public void testGetGenericBook() throws Exception {
String baseAddress = "http://localhost:" + PORT + "/the/thebooks8/books";