Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (nike.apache.org: domain of rosenberg.leon@gmail.com
 designates 209.85.210.173 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type;
        b=ZH8MYUzlhu20T6Bdf2crtfS1P8KqmWVPLxNBSL/m6O7tey/oATCHwvDm9jsfZaBy9Z
         h5sKoGq64rKJHXIa4prwS+UDtu3cgKhoSvcfIcDmqfxi00nX9iNlbsNkfu9SfDGv8RFm
         eULQVvVR2A8R5ygNUxNWhZst5CuQBweW9ZSQ0=
MIME-Version: 1.0
In-Reply-To: <4D951A7E.3020304@christopherschultz.net>
References: <4D938E98.6050005@christopherschultz.net>
	<1717038681.59.1301569533854.JavaMail.tomcat@localhost>
	<4D951A7E.3020304@christopherschultz.net>
Date: Fri, 1 Apr 2011 07:49:35 +0200
Message-ID: <AANLkTimhvHWMDvqUiN9jPdW2KmzppxyNVuHPNW+esJGM@mail.gmail.com>
Subject: Re: [OT] Protecting against HTTP response splitting
From: Leon Rosenberg <rosenberg.leon@gmail.com>
To: Tomcat Users List <users@tomcat.apache.org>
Content-Type: text/plain; charset=ISO-8859-1

On Fri, Apr 1, 2011 at 2:21 AM, Christopher Schultz
<chris@christopherschultz.net> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Ronald,
>
> On 3/31/2011 7:05 AM, Ronald Klop wrote:
>> I would say that some proper input validation solves your problem.
>> Does new URL(redirectURL).toString() give an exception on invalid url's?
>
> new URL(String) will throw a MalformedURLException if there are illegal
> characters in the URL.
>

This will work for 'correct urls', however, you don't necessary need
to send correct urls, and I suppose you don't want to:
Consider this, struts1 like action:
	public ActionForward execute(ActionMapping mapping, FormBean bean,
HttpServletRequest req, HttpServletResponse res) throws Exception {

		//do something.... useful
		res.sendRedirect("pageResult?page=1");
		return null;
	}

This is not a syntactically correct url, but it will work in all
browsers and save you a lot of stress in multi-url (i18n) portals.
I would solve your problem by having multiple entry points for the
actions which than can specify the final redirect path.

regards
Leon

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org