Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-30947

[GSS](7.4.z) UNDERTOW-2609 - Previous fixes in the handling of decoded characters in query requests reflect in getQueryString of APIs

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • 7.4.24.GA
    • 7.4.23.GA
    • Undertow
    • None
    • False
    • Hide

      None

      Show
      None
    • False
    • Hide
      1. Start JBoss with attached standalone-ha.xml
      2. Deploy jbeap-30975.war
      3. Test like so and the app should fetch getQueryString and print that back out still undecoded:
      $ curl -v localhost:8080/jbeap-30975/?test=%7Bfoobar 
...
<html>
<head>test=%7Bfoobar
</head>
</html>

      Without the fix, this is decoded:

      <html>
<head>test={foobar
</head>
</html>
      Show
      Start JBoss with attached standalone-ha.xml Deploy jbeap-30975.war Test like so and the app should fetch getQueryString and print that back out still undecoded: $ curl -v localhost:8080/jbeap-30975/?test=%7Bfoobar ... <html> <head>test=%7Bfoobar </head> </html> Without the fix, this is decoded: <html> <head>test={foobar </head> </html>

      When UndertowOptions.ALLOW_UNESCAPED_CHARACTERS is enabled, we want to follow that config as part of Undertow's internal contract when, for example, printing the request in the AccessLog.

      This relates to UNDERTOW-2312 and other related issues, for a full list, please se linked issues.

      The previous fixes are reflecting on the getQueryString implementation of apis such as Servlet, and this is causing malfunction for users that rely on frameworks that are build on top of those APIs.

      For that reason, the previous fixes need to be carefully reviewed so that we don't create a regression in those Jiras while also amending the behavior of HttpServerExchange.getQueryString(), the method that is used by Undertow to reply to any request on the query string done via APIs such as HttpServletRequest.getQueryString(), and any related code that might have the same effect.

        1. jbeap-30975.war
          0.5 kB
          Aaron Ogburn
        2. standalone-ha.xml
          34 kB
          Aaron Ogburn

              flaviarnn Flavia Rainone
              rhn-support-aogburn Aaron Ogburn
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: