Mailing-List: contact dev-help@shiro.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@shiro.apache.org
Date: Tue, 6 Oct 2015 19:59:26 +0000 (UTC)
From: "Mark Hale (JIRA)" <jira@apache.org>
To: dev@shiro.apache.org
Message-ID: <JIRA.12726591.1405001688000.39337.1444161566744@Atlassian.JIRA>
In-Reply-To: <JIRA.12726591.1405001688000@Atlassian.JIRA>
References: <JIRA.12726591.1405001688000@Atlassian.JIRA>
 <JIRA.12726591.1405001688254@arcas>
Subject: [jira] [Commented] (SHIRO-509) WebUtils.decodeAndCleanUriString
 incorrectly handles matrix parameters
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/SHIRO-509?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14945659#comment-14945659 ] 

Mark Hale commented on SHIRO-509:
---------------------------------

Yep

> WebUtils.decodeAndCleanUriString incorrectly handles matrix parameters
> ----------------------------------------------------------------------
>
>                 Key: SHIRO-509
>                 URL: https://issues.apache.org/jira/browse/SHIRO-509
>             Project: Shiro
>          Issue Type: Bug
>          Components: Web
>    Affects Versions: 1.2.2
>         Environment: Webapp deployment in Jetty
>            Reporter: Mark Hale
>
> If I config a web filter (say anon) for a path /**/public and make a request to /mystuff;filter=toys/prices/public the filter is not triggered because WebUtils.decodeAndCleanUriString() removes everything after the ';' (so it only tries to match on /mystuff). The fix is to change
>         int semicolonIndex = uri.indexOf(';');
> to
>         int lastSlash = uri.lastIndexOf('/');
>         int semicolonIndex = uri.lastIndexOf(';');
> if(semicolonIndex > lastSlash) then drop trailing matrix params. So that matrix params in parent path segments are left intact.


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)