You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2026/01/29 02:18:58 UTC
[Bug 69940] New: LoadBalancerDrainingValve redirect to an incorrect URI with invalidSessionId
https://bz.apache.org/bugzilla/show_bug.cgi?id=69940
Bug ID: 69940
Summary: LoadBalancerDrainingValve redirect to an incorrect URI
with invalidSessionId
Product: Tomcat 11
Version: 11.0.15
Hardware: PC
Status: NEW
Severity: normal
Priority: P2
Component: Catalina
Assignee: dev@tomcat.apache.org
Reporter: ch_jp@msn.com
Target Milestone: -------
Request URI: /test;jsessionid=0x01/path;jsessionid=0x01
Expected Redirect: /test/path
Actual Redirect: /test
```java
- uri = uri.replaceFirst(";" + sessionURIParamName + "=[^&?]*", "");
+ uri = uri.replaceAll(";" + sessionURIParamName + "=[^/&?]*", "");
```
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69940] LoadBalancerDrainingValve redirect to an incorrect URI with invalidSessionId
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69940
--- Comment #5 from Chen Jp <ch...@msn.com> ---
(In reply to Remy Maucherat from comment #2)
> Why would the input be obviously invalid ? Please focus on fixing actually
> issues.
`/test;jsessionid=0x01/path;jsessionid=0x01` is a legitimate request, not
'obviously invalid'.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69940] LoadBalancerDrainingValve redirect to an incorrect URI with invalidSessionId
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69940
Chen Jp <ch...@msn.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
OS| |All
--- Comment #1 from Chen Jp <ch...@msn.com> ---
Patch PR#948
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69940] LoadBalancerDrainingValve redirect to an incorrect URI with invalidSessionId
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69940
Remy Maucherat <re...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |WONTFIX
--- Comment #2 from Remy Maucherat <re...@apache.org> ---
Why would the input be obviously invalid ? Please focus on fixing actually
issues.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69940] LoadBalancerDrainingValve redirect to an incorrect URI with invalidSessionId
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69940
Chen Jp <ch...@msn.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|WONTFIX |---
--- Comment #3 from Chen Jp <ch...@msn.com> ---
disagree.
Obviously it is a bug.
Fortunately, it is a 307 redirection, not a simple rewrite-and-goon. Otherwise
a typical security-constraint-bypass.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69940] LoadBalancerDrainingValve redirect to an incorrect URI with invalidSessionId
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69940
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution|--- |FIXED
--- Comment #6 from Mark Thomas <ma...@apache.org> ---
Tomcat doesn't generate URIs with multiple session ID path parameters.
Applications and/or clients that do so can clean up their own mess.
The proposed regex is wrong.
There is no need for ? as the query string has already been removed.
There is no need to & as it is not a standard separator for path parameters.
; needs to be added as it is a standard separator for path parameters.
Fixed in:
- 11.0.x for 11.0.19 onwards
- 10.1.x for 10.1.53 onwards
- 9.0.x for 9.0.116 onwards
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69940] LoadBalancerDrainingValve redirect to an incorrect URI with invalidSessionId
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69940
--- Comment #4 from Christopher Schultz <ch...@christopherschultz.net> ---
Yep, there is an issue with the missing / in the regular expression, here.
Tomcat always puts the ;jsessionid path parameter on the final path segment,
and never has more than one. So this request is mostly polish for situations
that will basically never happen.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org