(tomcat) branch 11.0.x updated: Encode redirect URL used by the rewrite valve with session id

[remm]

This is an automated email from the ASF dual-hosted git repository.

remm pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/11.0.x by this push:
     new 90306d971b Encode redirect URL used by the rewrite valve with session 
id
90306d971b is described below

commit 90306d971bb8b8393336d893644124fb2ca11d21
Author: remm <r...@apache.org>
AuthorDate: Tue Jun 3 13:53:01 2025 +0200

    Encode redirect URL used by the rewrite valve with session id
    
    Handle different cross context session configuration.
    BZ69699
---
 java/org/apache/catalina/connector/Request.java           | 2 +-
 java/org/apache/catalina/valves/rewrite/RewriteValve.java | 7 +++++--
 webapps/docs/changelog.xml                                | 5 +++++
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/java/org/apache/catalina/connector/Request.java 
b/java/org/apache/catalina/connector/Request.java
index c4c1a2db08..ab1397d9a2 100644
--- a/java/org/apache/catalina/connector/Request.java
+++ b/java/org/apache/catalina/connector/Request.java
@@ -519,7 +519,7 @@ public class Request implements HttpServletRequest {
     }
 
 
-    protected void recycleSessionInfo() {
+    public void recycleSessionInfo() {
         if (session != null) {
             try {
                 session.endAccess();
diff --git a/java/org/apache/catalina/valves/rewrite/RewriteValve.java 
b/java/org/apache/catalina/valves/rewrite/RewriteValve.java
index 347e2d04f9..980dde353c 100644
--- a/java/org/apache/catalina/valves/rewrite/RewriteValve.java
+++ b/java/org/apache/catalina/valves/rewrite/RewriteValve.java
@@ -461,11 +461,13 @@ public class RewriteValve extends ValveBase {
                     if (context && urlStringEncoded.charAt(0) == '/' && 
!UriUtil.hasScheme(urlStringEncoded)) {
                         urlStringEncoded.insert(0, 
request.getContext().getEncodedPath());
                     }
+                    String redirectPath;
                     if (rule.isNoescape()) {
-                        
response.sendRedirect(UDecoder.URLDecode(urlStringEncoded.toString(), 
uriCharset));
+                        redirectPath = 
UDecoder.URLDecode(urlStringEncoded.toString(), uriCharset);
                     } else {
-                        response.sendRedirect(urlStringEncoded.toString());
+                        redirectPath = urlStringEncoded.toString();
                     }
+                    
response.sendRedirect(response.encodeRedirectURL(redirectPath));
                     response.setStatus(rule.getRedirectCode());
                     done = true;
                     break;
@@ -577,6 +579,7 @@ public class RewriteValve extends ValveBase {
                         chunk.append(host.toString());
                     }
                     request.getMappingData().recycle();
+                    request.recycleSessionInfo();
                     // Reinvoke the whole request recursively
                     Connector connector = request.getConnector();
                     try {
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index ba9ce658c8..d74e301ae5 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -125,6 +125,11 @@
         in a single URL segment. Based on pull request <pr>860</pr> by Chenjp.
         (markt)
       </fix>
+      <fix>
+        <bug>69699</bug>: Encode redirect URL used by the rewrite valve with
+        the session id if appropriate, and handle cross context with different
+        session configuration when using rewrite. (remm)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org