-
Bug
-
Resolution: Done
-
Major
-
7.3.6.GA
-
False
-
False
-
-
-
-
-
-
+
-
Undefined
-
-
In Undertow, when the class "io.undertow.util.CanonicalPathUtils" is used to canonicalize a given path URI, it may ignore some two-dot segments (../) when the calculated path goes beyond/outside the servlet context.
Reference: JBEAP-21543
The javadoc of getRequestDipatcher says:
The pathname specified may be relative, although it cannot extend outside the current servlet context. If the path begins with a "/" it is interpreted as relative to the current context root. This method returns null if the servlet container cannot return a RequestDispatcher.
So a path like /../../../something is currently returning the dispatcher to /something which is against the spec or at least very weird. Returning null is much more aligned with the spec and with the reference implementation.
There will be a way (system property) of setting back the previous behavior just in case.
- clones
-
JBEAP-21749 [GSS](7.4.z) UNDERTOW-1886 - Undertow ignores two-dot segments in relative path URI when its canonicalized path is outside servlet context
- Closed
- is caused by
-
UNDERTOW-1886 Request dispatcher is returned when the path points to outside the servlet context
- Resolved
- is incorporated by
-
JBEAP-21441 (7.3.z) Upgrade Undertow from 2.0.35.SP1-redhat-00001 to 2.0.38.SP1-redhat-00001
- Closed
- relates to
-
JBEAP-21543 RequestDispatcher with non-existent path can acquire web.xml content
- Closed