tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Jean-Frederic <jfcl...@gmail.com>
Subject Re: Changing JK_OPT_FWDURIDEFAULT to JK_OPT_FWDURICOMPATUNPARSED
Date Wed, 16 May 2007 11:49:55 GMT
On Wed, 2007-05-16 at 13:17 +0200, Rainer Jung wrote:
> >> Why do you think the default is bad?
> > 
> > Because it breaks the spec's and allows unexpected handling of url that
> > are encoded (for example: /context-A/%252E%252E/context-B that is send
> > to Tomcat as /context-A/%2E%2E/context-B and mapped by Tomcat
> > as /context-B).
> 
> So what how do you suggest to handle a change.
> 
> - Being secure by default, i.e. really changing the default in 1.2 and 
> putting a big note about it in the docs, the news page and maybe the 
> download README

Yes I think that the correct option. Default values should always follow
the spec's and be as secure as possible.

Cheers

Jean-Frederic

> 
> or/and
> 
> - Staying compatible in 1.2, changing in 1.3 but putting a big note in 
> the docs page about the options concerning the security relevance of the 
> options.
> 
> Regards,
> 
> Rainer
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
> 


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org


Mime
View raw message