Mailing-List: contact issues-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@struts.apache.org
Date: Wed, 19 Mar 2014 08:40:45 +0000 (UTC)
From: "ASF subversion and git services (JIRA)" <jira@apache.org>
To: issues@struts.apache.org
Message-ID: <JIRA.12666619.1378154898182.102863.1395218445708@arcas>
In-Reply-To: <JIRA.12666619.1378154898182@arcas>
References: <JIRA.12666619.1378154898182@arcas>
Subject: [jira] [Commented] (WW-4187) ServletRedirectResult only works with
 a limited set of hardcoded URL protocols
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/WW-4187?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13940296#comment-13940296 ] 

ASF subversion and git services commented on WW-4187:
-----------------------------------------------------

Commit 3c1d25c04f1d1a65fca15d1c2de062dd1ae54f34 in struts's branch refs/heads/develop from [~lukaszlenart]
[ https://git-wip-us.apache.org/repos/asf?p=struts.git;h=3c1d25c ]

Merge branch 'develop' into feature/WW-4187-correctly-identify-protocols


> ServletRedirectResult only works with a limited set of hardcoded URL protocols
> ------------------------------------------------------------------------------
>
>                 Key: WW-4187
>                 URL: https://issues.apache.org/jira/browse/WW-4187
>             Project: Struts 2
>          Issue Type: Bug
>    Affects Versions: 2.3.7, 2.3.8, 2.3.12, 2.3.14, 2.3.14.1, 2.3.14.2, 2.3.14.3, 2.3.15.1
>            Reporter: Michiel Toneman
>             Fix For: 2.3.17
>
>
> The isPathUrl(String url) implementation was changed from:
> {code:java}
> return (url.indexOf(':') == -1);
> {code}
> to:
> {code:java}
> return !url.startsWith("http:")
>                 && !url.startsWith("https:")
>                 && !url.startsWith("mailto:")
>                 && !url.startsWith("file:")
>                 && !url.startsWith("ftp:");
> {code}
> This breaks integrations which require a redirect in (e.g.) a mobile app for iOS which often use custom protocols such as myapp:// 
> There are also numerous valid / common protocols which are not in this list.
> The result of this change is that redirects to such URLs are treated as local redirects (paths), rather than absolute redirects.


--
This message was sent by Atlassian JIRA
(v6.2#6252)