https://bz.apache.org/bugzilla/show_bug.cgi?id=70208
--- Comment #1 from Mark Thomas <[email protected]> --- (In reply to Chen Jp from comment #0) > If the uri is controlled by attacker (article author or media poster) and > unsanitized, the recommended encodedURL/encodeRedirectURL may allow > unexpected session leakage or fixation. If an application is reguritating user provided data without validation / sanitisation that is an application issue not a Tomcat issue. > Assumption: Cross-Context session false, session tracking with url > rewriting, current context path is "/admin". Fairly unlikely these days. Cookies are everywhere. > 1. response.encodeURL("/admin/foo"): isSameWebApplication TRUE, encoded it - > append current session id in URL, as expected. > > 2. response.encodeURL("/admin/../public/foo"): isSameWebApplication - > Expected: False, Actual: True, -> > "/admin/../public/foo;jsessionid=<USER_SESSION>" > > 3. > response.encodeURL("/public/../admin/foo;jsessionid=INJECTED_ADMIN_SESSION"): > isSameWebApplication - Expected: True, Actual: False, -> > "/public/../admin/foo;jsessionid=INJECTED_ADMIN_SESSION" UNCHANGED. > > Strip Path Param and normalize before context-path matching. That is a reasonable hardening, with the usual caveats around complexity and performance. -- You are receiving this mail because: You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
