tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Bill Barker" <>
Subject Re: cvs commit: jakarta-tomcat-catalina/catalina/src/share/org/apache/catalina/realm
Date Wed, 02 Mar 2005 20:17:41 GMT

----- Original Message -----
From: "Remy Maucherat" <>
To: "Tomcat Developers List" <>
Sent: Wednesday, March 02, 2005 11:56 AM
Subject: Re: cvs commit:

> wrote:
>> luehe       2005/03/02 11:27:11
>>   Modified:    catalina/src/share/org/apache/catalina/realm
>>   Log:
>>   Consider the case where original request was mapped to welcome page.
>>   In this case, the mapped welcome page (and not the original request
>>   URI!) needs to be the target of hasResourcePermission().
>>   This is consistent with the change that had been made in
>>   BTW, shouldn't request.getDecodedRequestURI() return the mapped
>>   welcome page (instead of the original URI) in this case?
>>   In other words, shouldn't the path passed to
>>     mappingData.requestPath.setString(pathStr)
>>   in be propagated to the request object associatd with the
>>   mappingData?
>I consider welcome files to be internal forwards (since it is allowed to
>handle them this way). As a result, they shouldn't be matched by
>secrurity constraints. Only the original request path should be the used
>(so here it's getDecodedRequestURI - as sent by the client).

I agree with Remy.  It's an internal Tomcat implementation detail that
welcome-files aren't handled via DefaultServlet doing:
  RequestDispatcher rd = request.getRequestDispatcher(welcome[i]);
  rd.forward(request, response);
Since this is explicitly allowed by the spec, nobody can expect that a
security-constraint mapped only to the welcome-file will be applied.
However, this is probably another thing that should be better specified in
the 2.5 spec.

To unsubscribe, e-mail:
For additional commands, e-mail:

This message is intended only for the use of the person(s) listed above as the intended recipient(s),
and may contain information that is PRIVILEGED and CONFIDENTIAL.  If you are not an intended
recipient, you may not read, copy, or distribute this message or any attachment. If you received
this communication in error, please notify us immediately by e-mail and then delete all copies
of this message and any attachments.

In addition you should be aware that ordinary (unencrypted) e-mail sent through the Internet
is not secure. Do not send confidential or sensitive information, such as social security
numbers, account numbers, personal identification numbers and passwords, to us via ordinary
(unencrypted) e-mail.

View raw message