https://issues.apache.org/bugzilla/show_bug.cgi?id=52157
Bug #: 52157
Summary: 7.0.21 change can use undesired Writer object. Wrapper
circumvention. Servlet 2.3
Product: Tomcat 7
Version: 7.0.21
Platform: PC
Status: NEW
Severity: normal
Priority: P2
Component: Servlet & JSP API
AssignedTo: dev@tomcat.apache.org
ReportedBy: bpl...@bulliondirect.com
Classification: Unclassified
in 7.0.21 the commit:
"41718: Include a response body when sending a redirect. (markt)"
...catalina.connector.Response.sendRedirect() now calls getWriter() in order to
write the body of the http response. However the committed implementation will
bypass any wrappers. Note that Servlet 2.3 defines
HttpServletResponseWrapper.getWriter()
http://download.oracle.com/javaee/6/api/javax/servlet/ServletResponseWrapper.html#getWriter%28%29
which would allow someone to return an alternate Writer than the default.
catalina.connector.Response
line 1335 (sendRedirect()):
String absolute = toAbsolute(location);
setStatus(SC_FOUND);
setHeader("Location", absolute);
PrintWriter writer = getWriter(); // <<<<<< circumvents wrapping by
HttpServletResponseWrapper.getWriter()
// .. This directly commits a response to the client without allowing
the Wrapper the opportunity to do something different.
writer.print(sm.getString("coyoteResponse.sendRedirect.note",
RequestUtil.filter(absolute)));
flushBuffer();
So if someone calls wrapper.sendRedirect(location) it invokes the
Reponse.sendRedirect(). That Reponse.sendRedirect() gets a reference to a
Writer relative to itself and not the Wrapper's. In a case where the user
application desires to intercept a redirect and do something different, the
response has already been committed and will cause an IllegalStateException.
Not sure what would be the best way to fix this.
Possible areas to consider
http://svn.apache.org/repos/asf/tomcat/tc7.0.x/trunk/java/javax/servlet/ServletResponseWrapper.java
or
http://svn.apache.org/repos/asf/tomcat/tc7.0.x/trunk/java/javax/servlet/http/HttpServletResponseWrapper.java
or
http://svn.apache.org/repos/asf/tomcat/tc7.0.x/trunk/java/org/apache/catalina/connector/Response.java
Bottom line is Servlet 2.3 HttpServletResponseWrapper allows you to control
what Writer to return, and the current Tomcat 7.0.21 implementation will get a
reference to a default Writer which may be undesirable, commit a response to
the undesired Writer, and expose a scenario for an IllegalStateException.
7.0.20 and previous did not have this problem.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
