tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Jean-Frederic <jfcl...@gmail.com>
Subject Re: Improving mod_jk URI forwarding
Date Sat, 19 May 2007 17:08:41 GMT
On Sat, 2007-05-19 at 18:57 +0200, Rainer Jung wrote:
> Jean-Frederic wrote:
> > On Sat, 2007-05-19 at 14:27 +0200, Rainer Jung wrote:
> >> Hi,
> >>
> >> now that we changed the default way how to forward URIs from mod_jk to 
> >> Tomcat (mod_jk 1.2.23) because of a directory traversal issue, I want to 
> >> propose a better long term solution.
> >>
> >> What's the problem?
> >> ===================
> > 
> > I think we still miss something... The mapping (map_uri_to_worker) uses
> > r->uri. Should we use s->req_uri or a carefully normalised uri to do the
> > mapping? Fixing s->req_uri doesn't help to fix the mapping (where the
> > problem comes from).
> 
> Yes, the mapping uses r->uri, and it has to, because the maping must go 
> against a uudecoded normalized URI.

What about url like /context-a/../context-b/?
There could be a problem if the goal is not to map /context-b.
Should we normalise /context-a/../context-b/ to /context-b and then do
the mapping.

Cheers

Jean-frederic

>  But to be consistent with Tomcats 
> view of the URI, we should send a URI to Tomcat, which gets interpreted 
> in the same way. My proposal is to send r->uri to Tomcat with encoded 
> '%'. That way decoding by Tomcat should result in the same URI r->uri 
> and since this one was already normalized by Apache, Tomcat 
> normalization should not change it any more.
> 
> So fixing s->req_uri in my opinion does help to fix the mapping (which 
> was correct!), because it prevents Tomcat from changing the URI in a 
> wrong way.
> 
> Regards,
> 
> Rainer
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
> 


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org


Mime
View raw message