Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-21589

[GSS](7.3.z) UNDERTOW-1886 - Undertow ignores two-dot segments in relative path URI when its canonicalized path is outside servlet context

    XMLWordPrintable

Details

    • False
    • False
    • +
    • Undefined
    • Hide
      1. Install a EAP 7.3.6 and then deploy IssueTest.war
      2. From a browser visit http://localhost:8080/IssueTest/jsp/forward-1.jsp
      3. The above jsp tries to forward request to web.xml file using below code with relative path "../../../../WEB-INF/web.xml"
      
request.getRequestDispatcher("../../../../WEB-INF/web.xml").forward(request, response);

       

      Expected result: The calculated path goes outside/beyond the context root /IssueTest and a null should be returned by method getRequestDispatcher() , with proper error/warning message.

      Actual result: the content of web.xml file is returned to browser and there is no error.

      Show
      Install a EAP 7.3.6 and then deploy IssueTest.war From a browser visit http://localhost:8080/IssueTest/jsp/forward-1.jsp The above jsp tries to forward request to web.xml file using below code with relative path "../../../../WEB-INF/web.xml" request.getRequestDispatcher( "../../../../WEB-INF/web.xml" ).forward(request, response);   Expected result: The calculated path goes outside/beyond the context root /IssueTest and a null should be returned by method getRequestDispatcher() , with proper error/warning message. Actual result: the content of web.xml file is returned to browser and there is no error.

    Description

      In Undertow, when the class "io.undertow.util.CanonicalPathUtils" is used to canonicalize a given path URI, it may ignore some two-dot segments (../) when the calculated path goes beyond/outside the servlet context.

      Reference: JBEAP-21543

      The javadoc of getRequestDipatcher says:

      The pathname specified may be relative, although it cannot extend outside the current servlet context. If the path begins with a "/" it is interpreted as relative to the current context root. This method returns null if the servlet container cannot return a RequestDispatcher.

      So a path like /../../../something is currently returning the dispatcher to /something which is against the spec or at least very weird. Returning null is much more aligned with the spec and with the reference implementation.

      There will be a way (system property) of setting back the previous behavior just in case.

       

      Attachments

        Issue Links

          clones

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-21749 [GSS](7.4.z) UNDERTOW-1886 - Undertow ignores two-dot segments in relative path URI when its canonicalized path is outside servlet context

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Verified
          is caused by

          Bug - A problem that impairs or prevents the functions of the product. UNDERTOW-1886 Request dispatcher is returned when the path points to outside the servlet context

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Resolved
          is incorporated by

          Component Upgrade - A task tracking an update to a bundled component or revision of component upstream of the project. JBEAP-21441 (7.3.z) Upgrade Undertow from 2.0.35.SP1-redhat-00001 to 2.0.38.SP1-redhat-00001

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed
          relates to

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-21543 RequestDispatcher with non-existent path can acquire web.xml content

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed

          Activity

            People

              rhn-support-rmartinc Ricardo Martin Camarero
              rhn-support-lywang Lyle Wang (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: