Uploaded image for project: 'Red Hat Fuse'
  1. Red Hat Fuse
  2. ENTESB-17903

[6.3] The pax-web-jetty library disabled HTTP TRACE method by incorrectly exposing "javax.servlet.ServletException"

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Won't Do
    • Icon: Major Major
    • None
    • fuse-6.3-R18-GA
    • Karaf
    • None
    • False
    • False
    • Low
    • % %
    • Todo

      The pax-web-jetty library disabled HTTP TRACE but incorrectly by throwing back an exception:
      javax.servlet.ServletException: HTTP TRACE method is disabled
      Therefore, the client side would get:

      $ curl -verbose -X TRACE http://localhost:8181/cxf/greeter
*   Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 8181 (#0)
> TRACE /cxf/greeter HTTP/1.1
> Host: localhost:8181
> User-Agent: curl/7.64.1
> Accept: */*
> Referer: rbose
> 
< HTTP/1.1 500 javax.servlet.ServletException: HTTP TRACE method is disabled
< Cache-Control: must-revalidate,no-cache,no-store
< Content-Type: text/html; charset=ISO-8859-1
< Content-Length: 341
< Connection: close

      The "javax.servlet.ServletException" exposes Java platform on server side, which shouldn't happen through HTTP TRACE method.

      Correct response should be:

      < HTTP/1.1 405 Method Not Allowed

        1. patch.txt
          1 kB

            ggrzybek Grzegorz Grzybek
            rhn-support-qluo Joe Luo
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: