tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Konstantin Kolinko <knst.koli...@gmail.com>
Subject Re: svn commit: r1005192 - /tomcat/tc6.0.x/trunk/STATUS.txt
Date Thu, 14 Oct 2010 08:02:32 GMT
2010/10/13 Mark Thomas <markt@apache.org>:
> On 13/10/2010 16:57, Konstantin Kolinko wrote:
>> 2010/10/6  <markt@apache.org>:
>>> Author: markt
>>> Date: Wed Oct  6 18:03:03 2010
>>> New Revision: 1005192
>>>
>>> URL: http://svn.apache.org/viewvc?rev=1005192&view=rev
>>> Log:
>>> Proposal
>>>
>>> Modified:
>>>    tomcat/tc6.0.x/trunk/STATUS.txt
>>>
>>> +
>>> +* Fix path parameter handling. Currently the following URL fails with a 404:
>>> +  http://localhost:8080/examples/jsp/snp;x=y/snoop.jsp
>>> +  http://people.apache.org/~markt/patches/2010-10-06-path-param-tc6.patch
>>> +  +1: markt
>>> +  -1:
>>>
>>
>> I think this is wrong, because a path parameter is not just a pair of
>> (name, value), but a triple of (path, name, value),  taking into
>> account the path segment where it was applied.
>>
>> The proposed patch strips information on the parameters from the path.
>> How the application is supposed to have access to them?
>
> The short answer is via getRequestURI(). The longer answer is:
>
> The Servlet Specification defines the following:
> requestURI = contextPath + servletPath + pathInfo
>
> It also states that:
> - path parameters are returned by getRequestURI() and getPathInfo()
> - contextPath & path parameters are ignored when mapping requests to
> servlets
>
> The specification does not state:
> - if the value returned by getContextPath() include path parameters or
> not. The implication is that it should not.
> - if the value returned by getServletPath() include path parameters or
> not. The implication is that it should not.
>
> If you add removal of /../ sequences, URI decoding and character
> decoding then the picture gets even murkier.
>
> The Servlet expert group has previously indicated [1] that the
> specification would be altered to state that getPathInfo() should not
> return path parameters and that clarification would be added to confirm
> that getContextPath() and getServletPath() should not return path
> parameters either. This clarification was never added to the specification.
>
> I'm not against switching from a pair to a triple for this but a) I'm
> not sure many (any?) folks are using path parameters apart from for
> session IDs and b) I think the 404 is a more important issue.
>
> Finally, I'd add that the behaviour varies considerably between
> containers in this area and an app's only hope for portability at the
> moment is to use getRequestURI().
>
> Mark
>
> [1] https://issues.apache.org/bugzilla/show_bug.cgi?id=25015
>

OK. Looks that the patch is working.  The snoop.jsp displays the full
original path as "Request URI" (aka request.getRequestURI()).

Other things there
1) Add http://svn.apache.org/viewvc?rev=1022389&view=rev
2) protected method CoyoteAdapter.parseSessionId(..) is no more used.
Deprecate it?
3) path parameters that have no '=' in them are not added to the map.

Best regards,
Konstantin Kolinko

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org


Mime
View raw message