You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2009/01/15 16:34:52 UTC
svn commit: r734734 - in /tomcat/trunk/java/org/apache: catalina/connector/
catalina/core/ catalina/servlets/ catalina/ssi/ catalina/util/
naming/resources/
Author: markt
Date: Thu Jan 15 07:34:52 2009
New Revision: 734734
URL: http://svn.apache.org/viewvc?rev=734734&view=rev
Log:
Remove 3 of the essentially 4 duplicate normalise implementations.
Minor tweaks where required to use the new single implementation.
Remove unnecessary normalisation calls.
Modified:
tomcat/trunk/java/org/apache/catalina/connector/Request.java
tomcat/trunk/java/org/apache/catalina/core/ApplicationContext.java
tomcat/trunk/java/org/apache/catalina/core/ApplicationHttpRequest.java
tomcat/trunk/java/org/apache/catalina/servlets/WebdavServlet.java
tomcat/trunk/java/org/apache/catalina/ssi/SSIServletExternalResolver.java
tomcat/trunk/java/org/apache/catalina/ssi/SSIServletRequestUtil.java
tomcat/trunk/java/org/apache/catalina/util/RequestUtil.java
tomcat/trunk/java/org/apache/naming/resources/FileDirContext.java
Modified: tomcat/trunk/java/org/apache/catalina/connector/Request.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/connector/Request.java?rev=734734&r1=734733&r2=734734&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/catalina/connector/Request.java (original)
+++ tomcat/trunk/java/org/apache/catalina/connector/Request.java Thu Jan 15 07:34:52 2009
@@ -1297,10 +1297,9 @@
int pos = requestPath.lastIndexOf('/');
String relative = null;
if (pos >= 0) {
- relative = RequestUtil.normalize
- (requestPath.substring(0, pos + 1) + path);
+ relative = requestPath.substring(0, pos + 1) + path;
} else {
- relative = RequestUtil.normalize(requestPath + path);
+ relative = requestPath + path;
}
return (context.getServletContext().getRequestDispatcher(relative));
Modified: tomcat/trunk/java/org/apache/catalina/core/ApplicationContext.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/core/ApplicationContext.java?rev=734734&r1=734733&r2=734734&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/catalina/core/ApplicationContext.java (original)
+++ tomcat/trunk/java/org/apache/catalina/core/ApplicationContext.java Thu Jan 15 07:34:52 2009
@@ -52,6 +52,7 @@
import org.apache.catalina.deploy.FilterDef;
import org.apache.catalina.deploy.FilterMap;
import org.apache.catalina.util.Enumerator;
+import org.apache.catalina.util.RequestUtil;
import org.apache.catalina.util.ResourceSet;
import org.apache.catalina.util.ServerInfo;
import org.apache.catalina.util.StringManager;
@@ -410,7 +411,7 @@
path = path.substring(0, pos);
}
- path = normalize(path);
+ path = RequestUtil.normalize(path);
if (path == null)
return (null);
@@ -495,7 +496,7 @@
throw new MalformedURLException(sm.getString("applicationContext.requestDispatcher.iae", path));
- path = normalize(path);
+ path = RequestUtil.normalize(path);
if (path == null)
return (null);
@@ -544,13 +545,16 @@
*/
public InputStream getResourceAsStream(String path) {
- path = normalize(path);
if (path == null)
return (null);
if (!path.startsWith("/") && Globals.STRICT_SERVLET_COMPLIANCE)
return null;
-
+
+ path = RequestUtil.normalize(path);
+ if (path == null)
+ return (null);
+
DirContext resources = context.getResources();
if (resources != null) {
try {
@@ -583,7 +587,7 @@
(sm.getString("applicationContext.resourcePaths.iae", path));
}
- path = normalize(path);
+ path = RequestUtil.normalize(path);
if (path == null)
return (null);
@@ -1057,45 +1061,6 @@
/**
- * Return a context-relative path, beginning with a "/", that represents
- * the canonical version of the specified path after ".." and "." elements
- * are resolved out. If the specified path attempts to go outside the
- * boundaries of the current context (i.e. too many ".." path elements
- * are present), return <code>null</code> instead.
- *
- * @param path Path to be normalized
- */
- private String normalize(String path) {
-
- if (path == null) {
- return null;
- }
-
- String normalized = path;
-
- // Normalize the slashes
- if (normalized.indexOf('\\') >= 0)
- normalized = normalized.replace('\\', '/');
-
- // Resolve occurrences of "/../" in the normalized path
- while (true) {
- int index = normalized.indexOf("/../");
- if (index < 0)
- break;
- if (index == 0)
- return (null); // Trying to go outside our context
- int index2 = normalized.lastIndexOf('/', index - 1);
- normalized = normalized.substring(0, index2) +
- normalized.substring(index + 3);
- }
-
- // Return the normalized path that we have completed
- return (normalized);
-
- }
-
-
- /**
* Merge the context initialization parameters specified in the application
* deployment descriptor with the application parameters described in the
* server configuration, respecting the <code>override</code> property of
Modified: tomcat/trunk/java/org/apache/catalina/core/ApplicationHttpRequest.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/core/ApplicationHttpRequest.java?rev=734734&r1=734733&r2=734734&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/catalina/core/ApplicationHttpRequest.java (original)
+++ tomcat/trunk/java/org/apache/catalina/core/ApplicationHttpRequest.java Thu Jan 15 07:34:52 2009
@@ -318,10 +318,9 @@
int pos = requestPath.lastIndexOf('/');
String relative = null;
if (pos >= 0) {
- relative = RequestUtil.normalize
- (requestPath.substring(0, pos + 1) + path);
+ relative = requestPath.substring(0, pos + 1) + path;
} else {
- relative = RequestUtil.normalize(requestPath + path);
+ relative = requestPath + path;
}
return (context.getServletContext().getRequestDispatcher(relative));
Modified: tomcat/trunk/java/org/apache/catalina/servlets/WebdavServlet.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/servlets/WebdavServlet.java?rev=734734&r1=734733&r2=734734&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/catalina/servlets/WebdavServlet.java (original)
+++ tomcat/trunk/java/org/apache/catalina/servlets/WebdavServlet.java Thu Jan 15 07:34:52 2009
@@ -1412,68 +1412,6 @@
}
- /**
- * Return a context-relative path, beginning with a "/", that represents
- * the canonical version of the specified path after ".." and "." elements
- * are resolved out. If the specified path attempts to go outside the
- * boundaries of the current context (i.e. too many ".." path elements
- * are present), return <code>null</code> instead.
- *
- * @param path Path to be normalized
- */
- protected String normalize(String path) {
-
- if (path == null)
- return null;
-
- // Create a place for the normalized path
- String normalized = path;
-
- if (normalized.equals("/."))
- return "/";
-
- // Normalize the slashes and add leading slash if necessary
- if (normalized.indexOf('\\') >= 0)
- normalized = normalized.replace('\\', '/');
- if (!normalized.startsWith("/"))
- normalized = "/" + normalized;
-
- // Resolve occurrences of "//" in the normalized path
- while (true) {
- int index = normalized.indexOf("//");
- if (index < 0)
- break;
- normalized = normalized.substring(0, index) +
- normalized.substring(index + 1);
- }
-
- // Resolve occurrences of "/./" in the normalized path
- while (true) {
- int index = normalized.indexOf("/./");
- if (index < 0)
- break;
- normalized = normalized.substring(0, index) +
- normalized.substring(index + 2);
- }
-
- // Resolve occurrences of "/../" in the normalized path
- while (true) {
- int index = normalized.indexOf("/../");
- if (index < 0)
- break;
- if (index == 0)
- return (null); // Trying to go outside our context
- int index2 = normalized.lastIndexOf('/', index - 1);
- normalized = normalized.substring(0, index2) +
- normalized.substring(index + 3);
- }
-
- // Return the normalized path that we have completed
- return (normalized);
-
- }
-
-
// -------------------------------------------------------- Private Methods
/**
@@ -1628,7 +1566,7 @@
}
// Normalise destination path (remove '.' and '..')
- destinationPath = normalize(destinationPath);
+ destinationPath = RequestUtil.normalize(destinationPath);
String contextPath = req.getContextPath();
if ((contextPath != null) &&
@@ -2383,7 +2321,8 @@
if (!toAppend.startsWith("/"))
toAppend = "/" + toAppend;
- generatedXML.writeText(rewriteUrl(normalize(absoluteUri + toAppend)));
+ generatedXML.writeText(rewriteUrl(RequestUtil.normalize(
+ absoluteUri + toAppend)));
generatedXML.writeElement(null, "href", XMLWriter.CLOSING);
Modified: tomcat/trunk/java/org/apache/catalina/ssi/SSIServletExternalResolver.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/ssi/SSIServletExternalResolver.java?rev=734734&r1=734733&r2=734734&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/catalina/ssi/SSIServletExternalResolver.java (original)
+++ tomcat/trunk/java/org/apache/catalina/ssi/SSIServletExternalResolver.java Thu Jan 15 07:34:52 2009
@@ -31,6 +31,7 @@
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.catalina.connector.Request;
+import org.apache.catalina.util.RequestUtil;
import org.apache.coyote.Constants;
/**
@@ -370,7 +371,7 @@
+ pathWithoutContext);
}
String fullPath = prefix + path;
- String retVal = SSIServletRequestUtil.normalize(fullPath);
+ String retVal = RequestUtil.normalize(fullPath);
if (retVal == null) {
throw new IOException("Normalization yielded null on path: "
+ fullPath);
@@ -403,7 +404,7 @@
return new ServletContextAndPath(context,
getAbsolutePath(virtualPath));
} else {
- String normalized = SSIServletRequestUtil.normalize(virtualPath);
+ String normalized = RequestUtil.normalize(virtualPath);
if (isVirtualWebappRelative) {
return new ServletContextAndPath(context, normalized);
} else {
Modified: tomcat/trunk/java/org/apache/catalina/ssi/SSIServletRequestUtil.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/ssi/SSIServletRequestUtil.java?rev=734734&r1=734733&r2=734734&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/catalina/ssi/SSIServletRequestUtil.java (original)
+++ tomcat/trunk/java/org/apache/catalina/ssi/SSIServletRequestUtil.java Thu Jan 15 07:34:52 2009
@@ -47,7 +47,7 @@
if ((result == null) || (result.equals(""))) {
result = "/";
}
- return normalize(result);
+ return RequestUtil.normalize(result);
}
@@ -63,15 +63,9 @@
*
* @param path
* Path to be normalized
+ * @deprecated
*/
public static String normalize(String path) {
- if (path == null) return null;
- String normalized = path;
- //Why doesn't RequestUtil do this??
- // Normalize the slashes and add leading slash if necessary
- if (normalized.indexOf('\\') >= 0)
- normalized = normalized.replace('\\', '/');
- normalized = RequestUtil.normalize(path);
- return normalized;
+ return RequestUtil.normalize(path);
}
}
\ No newline at end of file
Modified: tomcat/trunk/java/org/apache/catalina/util/RequestUtil.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/util/RequestUtil.java?rev=734734&r1=734733&r2=734734&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/catalina/util/RequestUtil.java (original)
+++ tomcat/trunk/java/org/apache/catalina/util/RequestUtil.java Thu Jan 15 07:34:52 2009
@@ -93,6 +93,19 @@
* @param path Relative path to be normalized
*/
public static String normalize(String path) {
+ return normalize(path, true);
+ }
+
+ /**
+ * Normalize a relative URI path that may have relative values ("/./",
+ * "/../", and so on ) it it. <strong>WARNING</strong> - This method is
+ * useful only for normalizing application-generated paths. It does not
+ * try to perform security checks for malicious input.
+ *
+ * @param path Relative path to be normalized
+ * @param replaceBackSlash Should '\\' be replaced with '/'
+ */
+ public static String normalize(String path, boolean replaceBackSlash) {
if (path == null)
return null;
@@ -100,6 +113,9 @@
// Create a place for the normalized path
String normalized = path;
+ if (replaceBackSlash && normalized.indexOf('\\') >= 0)
+ normalized = normalized.replace('\\', '/');
+
if (normalized.equals("/."))
return "/";
Modified: tomcat/trunk/java/org/apache/naming/resources/FileDirContext.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/naming/resources/FileDirContext.java?rev=734734&r1=734733&r2=734734&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/naming/resources/FileDirContext.java (original)
+++ tomcat/trunk/java/org/apache/naming/resources/FileDirContext.java Thu Jan 15 07:34:52 2009
@@ -40,6 +40,7 @@
import javax.naming.directory.SearchControls;
import javax.naming.directory.SearchResult;
+import org.apache.catalina.util.RequestUtil;
import org.apache.naming.NamingContextBindingsEnumeration;
import org.apache.naming.NamingContextEnumeration;
import org.apache.naming.NamingEntry;
@@ -768,50 +769,10 @@
*/
protected String normalize(String path) {
- String normalized = path;
+ return RequestUtil.normalize(path, File.separatorChar == '\\');
- // Normalize the slashes and add leading slash if necessary
- if (File.separatorChar == '\\' && normalized.indexOf('\\') >= 0)
- normalized = normalized.replace('\\', '/');
- if (!normalized.startsWith("/"))
- normalized = "/" + normalized;
-
- // Resolve occurrences of "//" in the normalized path
- while (true) {
- int index = normalized.indexOf("//");
- if (index < 0)
- break;
- normalized = normalized.substring(0, index) +
- normalized.substring(index + 1);
- }
-
- // Resolve occurrences of "/./" in the normalized path
- while (true) {
- int index = normalized.indexOf("/./");
- if (index < 0)
- break;
- normalized = normalized.substring(0, index) +
- normalized.substring(index + 2);
- }
-
- // Resolve occurrences of "/../" in the normalized path
- while (true) {
- int index = normalized.indexOf("/../");
- if (index < 0)
- break;
- if (index == 0)
- return (null); // Trying to go outside our context
- int index2 = normalized.lastIndexOf('/', index - 1);
- normalized = normalized.substring(0, index2) +
- normalized.substring(index + 3);
}
- // Return the normalized path that we have completed
- return (normalized);
-
- }
-
-
/**
* Return a File object representing the specified normalized
* context-relative path if it exists and is readable. Otherwise,
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org