Uploaded image for project: 'Red Hat Fuse'
  1. Red Hat Fuse
  2. ENTESB-17914

[7.x] The pax-web-jetty library disabled HTTP TRACE method by incorrectly exposing "javax.servlet.ServletException"

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Major
    • fuse-7.11-GA
    • fuse-7.9-GA
    • Karaf
    • None

    Description

      The pax-web-jetty library disabled HTTP TRACE but incorrectly by throwing back an exception:
      javax.servlet.ServletException: HTTP TRACE method is disabled
      Therefore, the client side would get:

      $ curl -verbose -X TRACE http://localhost:8181/cxf/greeter
*   Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 8181 (#0)
> TRACE /cxf/greeter HTTP/1.1
> Host: localhost:8181
> User-Agent: curl/7.64.1
> Accept: */*
> Referer: rbose
> 
< HTTP/1.1 500 javax.servlet.ServletException: HTTP TRACE method is disabled
< Cache-Control: must-revalidate,no-cache,no-store
< Content-Type: text/html; charset=ISO-8859-1
< Content-Length: 341
< Connection: close

      The "javax.servlet.ServletException" exposes Java platform on server side, which shouldn't happen through HTTP TRACE method.

      Correct response should be:

      < HTTP/1.1 405 Method Not Allowed

      Attachments

        Issue Links

          clones

          Bug - A problem that impairs or prevents the functions of the product. ENTESB-17903 [6.3] The pax-web-jetty library disabled HTTP TRACE method by incorrectly exposing "javax.servlet.ServletException"

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed
          links to

          Web Link org.ops4j.pax.web/issues/1667 – [7.4] Unify handling of TRACE + OPTIONS methods across runtimes

          Activity

            People

              ggrzybek Grzegorz Grzybek
              rhn-support-qluo Joe Luo
              Federico Mariani Federico Mariani
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: