Mailing-List: contact dev-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Developers List" <dev@tomcat.apache.org>
Received-SPF: pass (herse.apache.org: domain of jfclere@gmail.com designates
 66.249.82.226 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:subject:from:to:in-reply-to:references:content-type:date:message-id:mime-version:x-mailer:content-transfer-encoding;
        b=J/gT1XIvKt7+yWf3QqxNhclO4kOBuTvUFFqifXnTzwAhHwVgvTyD4L0SctWNV3NKwlxIUVd3FEpu793WeH4BcWBqOKj5goGrHmeqGpjuo3AlDDV6qK7opsIRyeGI0skqUrn77ewHjBSSmwyAl0pkirVTzOBg6g1EtMt5ZhZZmBU=
Subject: Re: Changing JK_OPT_FWDURIDEFAULT to JK_OPT_FWDURICOMPATUNPARSED
From: Jean-Frederic <jfclere@gmail.com>
To: Tomcat Developers List <dev@tomcat.apache.org>
In-Reply-To: <464AE83B.1010103@kippdata.de>
References: <1179244805.3813.35.camel@jfcpc>  <4649E1DC.704@kippdata.de>
	 <1179297592.3824.9.camel@jfcpc>  <464AE83B.1010103@kippdata.de>
Content-Type: text/plain
Date: Wed, 16 May 2007 13:49:55 +0200
Message-Id: <1179316195.3824.30.camel@jfcpc>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit

On Wed, 2007-05-16 at 13:17 +0200, Rainer Jung wrote:
> >> Why do you think the default is bad?
> > 
> > Because it breaks the spec's and allows unexpected handling of url that
> > are encoded (for example: /context-A/%252E%252E/context-B that is send
> > to Tomcat as /context-A/%2E%2E/context-B and mapped by Tomcat
> > as /context-B).
> 
> So what how do you suggest to handle a change.
> 
> - Being secure by default, i.e. really changing the default in 1.2 and 
> putting a big note about it in the docs, the news page and maybe the 
> download README

Yes I think that the correct option. Default values should always follow
the spec's and be as secure as possible.

Cheers

Jean-Frederic

> 
> or/and
> 
> - Staying compatible in 1.2, changing in 1.3 but putting a big note in 
> the docs page about the options concerning the security relevance of the 
> options.
> 
> Regards,
> 
> Rainer
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
> 


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org