struts-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Alfredo Osorio (JIRA)" <j...@apache.org>
Subject [jira] [Comment Edited] (WW-4187) ServletRedirectResult only works with a limited set of hardcoded URL protocols
Date Tue, 03 Sep 2013 16:18:53 GMT

    [ https://issues.apache.org/jira/browse/WW-4187?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13756737#comment-13756737
] 

Alfredo Osorio edited comment on WW-4187 at 9/3/13 4:18 PM:
------------------------------------------------------------

Well, I can see with that linked issue that url.indexOf(':') is not an option because it checks
all the URL and ":" could be a parameter and we are just interested to check if the protocol
is present at the beginning, maybe we could use a regex to be more specific or do it as you
suggest
                
      was (Author: aosorio):
    Well, I can see with that linked issue that url.indexOf(':') is not an option because
it checks all the URL and ":" could be a parameter and we are just interested to check if
the protocol is present at the beginning, maybe we could use a regex or something to be more
specific or do it as you suggest
                  
> ServletRedirectResult only works with a limited set of hardcoded URL protocols
> ------------------------------------------------------------------------------
>
>                 Key: WW-4187
>                 URL: https://issues.apache.org/jira/browse/WW-4187
>             Project: Struts 2
>          Issue Type: Bug
>    Affects Versions: 2.3.7, 2.3.8, 2.3.12, 2.3.14, 2.3.14.1, 2.3.14.2, 2.3.14.3, 2.3.15.1
>            Reporter: Michiel Toneman
>             Fix For: 2.3.17
>
>
> The isPathUrl(String url) implementation was changed from:
> {code:java}
> return (url.indexOf(':') == -1);
> {code}
> to:
> {code:java}
> return !url.startsWith("http:")
>                 && !url.startsWith("https:")
>                 && !url.startsWith("mailto:")
>                 && !url.startsWith("file:")
>                 && !url.startsWith("ftp:");
> {code}
> This breaks integrations which require a redirect in (e.g.) a mobile app for iOS which
often use custom protocols such as myapp:// 
> There are also numerous valid / common protocols which are not in this list.
> The result of this change is that redirects to such URLs are treated as local redirects
(paths), rather than absolute redirects.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira

Mime
View raw message