Author: markt
Date: Wed Apr 20 12:21:00 2016
New Revision: 1740132
URL: http://svn.apache.org/viewvc?rev=1740132&view=rev
Log:
When normalizing paths, improve the handling when paths end with'/.' or '/..'
and ensure that input and output are consistent with respect to whether or not
they end with '/'.
Modified:
tomcat/tc8.5.x/trunk/ (props changed)
tomcat/tc8.5.x/trunk/java/org/apache/tomcat/util/http/RequestUtil.java
tomcat/tc8.5.x/trunk/test/org/apache/tomcat/util/http/TestRequestUtil.java
tomcat/tc8.5.x/trunk/webapps/docs/changelog.xml
Propchange: tomcat/tc8.5.x/trunk/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Wed Apr 20 12:21:00 2016
@@ -1 +1 @@
-/tomcat/trunk:1734785,1734799,1734845,1734928,1735041,1735044,1735480,1735577,1735597,1735599-1735600,1735615,1736145,1736162,1736209,1736280,1736297,1736299,1736489,1736646,1736703,1736836,1736849,1737104-1737105,1737112,1737117,1737119-1737120,1737155,1737157,1737192,1737280,1737339,1737632,1737664,1737715,1737748,1737785,1737834,1737860,1737959,1738005,1738007,1738014-1738015,1738018,1738022,1738039,1738043,1738059-1738060,1738147,1738149,1738174-1738175,1738261,1738589,1738623-1738625,1738643,1738816,1738850,1738855,1738946-1738948,1738953-1738954,1738979,1738982,1739079-1739081,1739087,1739113,1739153,1739172,1739176,1739191,1739474,1739726,1739762,1739775,1739814,1739817-1739818,1739975
+/tomcat/trunk:1734785,1734799,1734845,1734928,1735041,1735044,1735480,1735577,1735597,1735599-1735600,1735615,1736145,1736162,1736209,1736280,1736297,1736299,1736489,1736646,1736703,1736836,1736849,1737104-1737105,1737112,1737117,1737119-1737120,1737155,1737157,1737192,1737280,1737339,1737632,1737664,1737715,1737748,1737785,1737834,1737860,1737959,1738005,1738007,1738014-1738015,1738018,1738022,1738039,1738043,1738059-1738060,1738147,1738149,1738174-1738175,1738261,1738589,1738623-1738625,1738643,1738816,1738850,1738855,1738946-1738948,1738953-1738954,1738979,1738982,1739079-1739081,1739087,1739113,1739153,1739172,1739176,1739191,1739474,1739726,1739762,1739775,1739814,1739817-1739818,1739975,1740131
Modified: tomcat/tc8.5.x/trunk/java/org/apache/tomcat/util/http/RequestUtil.java
URL:
http://svn.apache.org/viewvc/tomcat/tc8.5.x/trunk/java/org/apache/tomcat/util/http/RequestUtil.java?rev=1740132&r1=1740131&r2=1740132&view=diff
==============================================================================
--- tomcat/tc8.5.x/trunk/java/org/apache/tomcat/util/http/RequestUtil.java
(original)
+++ tomcat/tc8.5.x/trunk/java/org/apache/tomcat/util/http/RequestUtil.java Wed
Apr 20 12:21:00 2016
@@ -67,6 +67,12 @@ public class RequestUtil {
if (!normalized.startsWith("/"))
normalized = "/" + normalized;
+ boolean addedTrailingSlash = false;
+ if (normalized.endsWith("/.") || normalized.endsWith("/..")) {
+ normalized = normalized + "/";
+ addedTrailingSlash = true;
+ }
+
// Resolve occurrences of "//" in the normalized path
while (true) {
int index = normalized.indexOf("//");
@@ -98,12 +104,10 @@ public class RequestUtil {
normalized = normalized.substring(0, index2) +
normalized.substring(index + 3);
}
- if (normalized.equals("/.")) {
- return "/";
- }
-
- if (normalized.equals("/..")) {
- return null; // Trying to go outside our context
+ if (normalized.length() > 1 && addedTrailingSlash) {
+ // Remove the trailing '/' we added to that input and output are
+ // consistent w.r.t. to the presence of the trailing '/'.
+ normalized = normalized.substring(0, normalized.length() - 1);
}
// Return the normalized path that we have completed
Modified:
tomcat/tc8.5.x/trunk/test/org/apache/tomcat/util/http/TestRequestUtil.java
URL:
http://svn.apache.org/viewvc/tomcat/tc8.5.x/trunk/test/org/apache/tomcat/util/http/TestRequestUtil.java?rev=1740132&r1=1740131&r2=1740132&view=diff
==============================================================================
--- tomcat/tc8.5.x/trunk/test/org/apache/tomcat/util/http/TestRequestUtil.java
(original)
+++ tomcat/tc8.5.x/trunk/test/org/apache/tomcat/util/http/TestRequestUtil.java
Wed Apr 20 12:21:00 2016
@@ -117,6 +117,46 @@ public class TestRequestUtil {
doTestNormalize("/a/../../", null);
}
+ @Test
+ public void testNormalize20() {
+ doTestNormalize("/a/..", "/");
+ }
+
+ @Test
+ public void testNormalize21() {
+ doTestNormalize("/a/.", "/a");
+ }
+
+ @Test
+ public void testNormalize22() {
+ doTestNormalize("/a/../", "/");
+ }
+
+ @Test
+ public void testNormalize23() {
+ doTestNormalize("/a/./", "/a/");
+ }
+
+ @Test
+ public void testNormalize24() {
+ doTestNormalize("/a/b/..", "/a");
+ }
+
+ @Test
+ public void testNormalize25() {
+ doTestNormalize("/a/b/.", "/a/b");
+ }
+
+ @Test
+ public void testNormalize26() {
+ doTestNormalize("/a/b/../", "/a/");
+ }
+
+ @Test
+ public void testNormalize27() {
+ doTestNormalize("/a/b/./", "/a/b/");
+ }
+
private void doTestNormalize(String input, String expected) {
assertEquals(expected,RequestUtil.normalize(input));
}
Modified: tomcat/tc8.5.x/trunk/webapps/docs/changelog.xml
URL:
http://svn.apache.org/viewvc/tomcat/tc8.5.x/trunk/webapps/docs/changelog.xml?rev=1740132&r1=1740131&r2=1740132&view=diff
==============================================================================
--- tomcat/tc8.5.x/trunk/webapps/docs/changelog.xml (original)
+++ tomcat/tc8.5.x/trunk/webapps/docs/changelog.xml Wed Apr 20 12:21:00 2016
@@ -149,6 +149,12 @@
custom responses to <code>HEAD</code> requests that do not set a
<code>Content-Length</code> value. (markt)
</fix>
+ <fix>
+ When normalizing paths, improve the handling when paths end with
+ <code>/.</code> or <code>/..</code> and ensure that input and output
are
+ consistent with respect to whether or not they end with <code>/</code>.
+ (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
