Uploaded image for project: 'Undertow'
  1. Undertow
  2. UNDERTOW-874

SinglePortConfidentialityHandler generates invalid URL if the client sent a full URI in the request

    XMLWordPrintable

Details

    Description

      I think it's same issue has UNDERTOW-592, but i cannot re-open it and nobody responds to my comment.
      450+ crash in one day...

      My Undertown modules = undertow-core-1.3.15.Final, undertow-servlet-1.3.15.Final, undertow-websockets-jsr-1.3.15.Final

      Exemples:

      2016-10-22 09:23:00,764 ERROR [io.undertow.request] UT005001: An exception occurred processing the request: java.net.URISyntaxException: Relative path in absolute URI: https://X.X.X.X:443http://X.X.X.X:80/phppma/

      at java.net.URI.checkPath(URI.java:1823)
      at java.net.URI.<init>(URI.java:672)
      at io.undertow.security.handlers.SinglePortConfidentialityHandler.getRedirectURI(SinglePortConfidentialityHandler.java:51)
      at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.getRedirectURI(ServletConfidentialityConstraintHandler.java:83)
      at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:49)
      at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
      at io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.handleRequest(ServletSecurityConstraintHandler.java:59)
      at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
      at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
      at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
      at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
      at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
      at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
      at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
      at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
      at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
      at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
      at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
      at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
      at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
      at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
      at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
      at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
      at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
      at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
      at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
      at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
      at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
      at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
      at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
      at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
      at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:805)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
      at java.lang.Thread.run(Thread.java:745)

      2016-10-22 09:23:00,593 ERROR [io.undertow.request] UT005001: An exception occurred processing the request: java.net.URISyntaxException: Relative path in absolute URI: https://X.X.X.X:443http://X.X.X.X:80/phpmy/
      ...

      2016-10-22 09:23:00,423 ERROR [io.undertow.request] UT005001: An exception occurred processing the request: java.net.URISyntaxException: Relative path in absolute URI: https://X.X.X.X:443http://X.X.X.X:80/2phpmyadmin/
      ...

      2016-10-22 09:23:00,423 ERROR [io.undertow.request] UT005001: An exception occurred processing the request: java.net.URISyntaxException: Relative path in absolute URI: https://X.X.X.X:443http://X.X.X.X:80/2phpmyadmin/
      ...

      2016-10-22 09:23:00,253 ERROR [io.undertow.request] UT005001: An exception occurred processing the request: java.net.URISyntaxException: Relative path in absolute URI: https://X.X.X.X:443http://X.X.X.X:80/phpmyadmin4/
      ...

      2016-10-22 09:23:00,083 ERROR [io.undertow.request] UT005001: An exception occurred processing the request: java.net.URISyntaxException: Relative path in absolute URI: https://X.X.X.X:443http://X.X.X.X:80/phpmyadmin3/
      ...

      2016-10-22 09:22:59,573 ERROR [io.undertow.request] UT005001: An exception occurred processing the request: java.net.URISyntaxException: Relative path in absolute URI: https://X.X.X.X:443http://X.X.X.X:80/phpMyAdmin/
      ...

      2016-10-22 09:22:59,062 ERROR [io.undertow.request] UT005001: An exception occurred processing the request: java.net.URISyntaxException: Relative path in absolute URI: https://X.X.X.X:443http://X.X.X.X:80/mysql/mysqlmanager/
      ...

      Attachments

        Issue Links

          Activity

            People

              sdouglas1@redhat.com Stuart Douglas
              stefprog Stéphane Jacquemain (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: