Uploaded image for project: 'Red Hat Fuse'
  1. Red Hat Fuse
  2. ENTESB-14546

CXF stack trace returned to client for java.net.URISyntaxException: Illegal character

    XMLWordPrintable

Details

    • Bug
    • Resolution: Won't Do
    • Major
    • None
    • fuse-6.3-R16-GA
    • CXF
    • None
    • % %
    • Fuse Standalone
    • Hide

      Issue can be observed by first installing the soap quickstart in Fuse:

      osgi:install -s mvn:org.jboss.quickstarts.fuse/cxf-soap/6.3.0.redhat-446
      

      Then send the following CURL POST request:

      $ curl -XPOST "localhost:8181/cxf/HelloWorld/<>"
      ...
      Server Error</pre></p><h3>Caused by:</h3><pre>java.lang.IllegalArgumentException: Illegal character in path at index 37: http://localhost:8181/cxf/HelloWorld/&lt;&gt;
      	at java.net.URI.create(URI.java:852)
      	at org.apache.cxf.transport.servlet.BaseUrlHelper.getBaseURL(BaseUrlHelper.java:47)
      ...

       

      Show
      Issue can be observed by first installing the soap quickstart in Fuse: osgi:install -s mvn:org.jboss.quickstarts.fuse/cxf-soap/6.3.0.redhat-446 Then send the following CURL POST request: $ curl -XPOST "localhost:8181/cxf/HelloWorld/<>" ... Server Error</pre></p><h3>Caused by:</h3><pre>java.lang.IllegalArgumentException: Illegal character in path at index 37: http: //localhost:8181/cxf/HelloWorld/&lt;&gt; at java.net.URI.create(URI.java:852) at org.apache.cxf.transport.servlet.BaseUrlHelper.getBaseURL(BaseUrlHelper.java:47) ...  

    Description

      CXF should not return a stack trace to the client in this case, potential security issue (server information leak).

      Attachments

        1. pax-web-api-4.3.6.jar
          19 kB
        2. pax-web-jetty-4.3.6.jar
          579 kB
        3. pax-web-runtime-4.3.6.jar
          122 kB
        4. pax-web-spi-4.3.6.jar
          300 kB

        Activity

          People

            yfang@redhat.com Freeman(Yue) Fang
            rhn-support-shiggs Stephen Higgs
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: