Return-Path: Mailing-List: contact tomcat-dev-help@jakarta.apache.org; run by ezmlm Delivered-To: mailing list tomcat-dev@jakarta.apache.org Received: (qmail 59646 invoked from network); 11 Sep 2000 12:22:22 -0000 Received: from msp-26-164-174.mn.rr.com (HELO localhost.localdomain) (24.26.164.174) by locus.apache.org with SMTP; 11 Sep 2000 12:22:22 -0000 Received: from fatman (IDENT:nobody@localhost [127.0.0.1]) by localhost.localdomain (8.9.3/8.9.3) with SMTP id GAA10978 for ; Mon, 11 Sep 2000 06:20:14 -0500 Message-ID: <134664582.968671214830.JavaMail.nobody@fatman> Date: Mon, 11 Sep 2000 06:20:14 -0500 (CDT) From: BugRat Mail System Reply-To: BugRat Mail System To: tomcat-bugs@cortexity.com Subject: BugRat Report #97 has been filed. Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="134687289.968671214801.JavaMail.nobody@fatman" X-Mailer: org.gjt.mail.EnhancedMimeMsg, Organization: The Giant Java Tree, X-Spam-Rating: locus.apache.org 1.6.2 0/1000/N --134687289.968671214801.JavaMail.nobody@fatman Content-Type: text/plain Content-Transfer-Encoding: 7bit Bug report #97 has just been filed. You can view the report at the following URL: REPORT #97 Details. Project: Catalina Category: Bug Report SubCategory: New Bug Report Class: swbug State: received Priority: high Severity: critical Confidence: public Environment: Release: current toplevel CVS source JVM Release: 1.2 Operating System: solaris OS Release: 2.7 Platform: sparc Synopsis: decoding of URL is never necessary Description: In org.apache.tomcat.connector.http.HttpProccessor.java there is some code that decodes the URI if necessary as the comment above the code describes it. Decoding the URL is never necessary but is bug because it is a violation of the URL / URI formats as described in rfc1738, rfc1630 and rfc2616. If the URL is decoded the original URL used in the request can not be reconstructed and the semantics of the URL changes. Example: it IS a difference if a slash is used or a encoded slash is used, a slash is a hierachy delimiter an encoded slash isn't. Decoding the URL breaks javax.servlet.HttpUtil.getRequestURL() and makes servlets unusable that use encoded names in URLs. --134687289.968671214801.JavaMail.nobody@fatman Content-Type: text/html; name=Report-97.html Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=Report-97.html Content-Description: DataSource attachment 'Report-97.html' BugRat Report # 97

BugRat Report # 97

Project: Catalina Release: current toplevel CVS source
Category: Bug Report SubCategory: New Bug Report
Class: swbug State: received
Priority: high Severity: critical
Confidence: public

Submitter: Bernd Eilers ( bei@staroffice.de )
Date Submitted: Sep 11 2000, 06:20:14 CDT
Responsible: Z_Tomcat Alias ( tomcat-bugs@cortexity.com )

Synopsis:
decoding of URL is never necessary
Environment: (jvm, os, osrel, platform)
1.2, solaris, 2.7, sparc

Additional Environment Description:

Report Description:
In org.apache.tomcat.connector.http.HttpProccessor.java there is some code that decodes the URI if necessary as the comment above the code describes it. Decoding the URL is never necessary but is bug because it is a violation of the URL / URI formats as described in rfc1738, rfc1630 and rfc2616. If the URL is decoded the original URL used in the request can not be reconstructed and the semantics of the URL changes. Example: it IS a difference if a slash is used or a encoded slash is used, a slash is a hierachy delimiter an encoded slash isn't. Decoding the URL breaks javax.servlet.HttpUtil.getRequestURL() and makes servlets unusable that use encoded names in URLs.

How To Reproduce:
null

Workaround:
null

View this report online...
--134687289.968671214801.JavaMail.nobody@fatman--