Re: cvs commit: jakarta-tomcat/src/examples/WEB-INF/classes/examples ShowSource.java

[Ben Laurie <be...@algroup.co.uk>]

akv@locus.apache.org wrote:
> 
> akv         00/03/07 11:53:39
> 
>   Modified:    src/examples/WEB-INF/classes/examples ShowSource.java
>   Log:
>   Fix the fix for the fix again.

I've got to say that this kind of piecemeal path processing is exactly
what has caused MS's neverending ASP holes. You've got to canonicalise
paths and then decide whether they are legit.

Cheers,

Ben.

--
SECURE HOSTING AT THE BUNKER: http://www.thebunker.net/hosting.htm

http://www.apache-ssl.org/ben.html

Coming to ApacheCon Europe? http://ApacheCon.Com/

Re: cvs commit: jakarta-tomcat/src/examples/WEB-INF/classes/examples ShowSource.java

["Anil K. Vijendran" <An...@eng.sun.com>]

This fix itself had nothing to do with piecemeal path processing. All I
fixed was a compilation error first  and then changed the error handling
(exception instead of writing to the output stream that goes to the
browser). The real fix for this kind of stuff should live in the lowest
layers of the Servlet implementation, not in an example.

But I understand the point you are making, in general and agree with it.

Ben Laurie wrote:

> akv@locus.apache.org wrote:
> >
> > akv         00/03/07 11:53:39
> >
> >   Modified:    src/examples/WEB-INF/classes/examples ShowSource.java
> >   Log:
> >   Fix the fix for the fix again.
>
> I've got to say that this kind of piecemeal path processing is exactly
> what has caused MS's neverending ASP holes. You've got to canonicalise
> paths and then decide whether they are legit.
>
> Cheers,
>
> Ben.
>
> --
> SECURE HOSTING AT THE BUNKER: http://www.thebunker.net/hosting.htm
>
> http://www.apache-ssl.org/ben.html
>
> Coming to ApacheCon Europe? http://ApacheCon.Com/
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org

--
Peace, Anil +<:-)