https://issues.apache.org/bugzilla/show_bug.cgi?id=53062
--- Comment #6 from Konstantin Preißer <prei...@web.de> ---
Hi,
it seems that the URL normalization which has been added to Tomcat 7.0.28
includes the querystring part of the URL in the normalization process.
I'm not 100% sure if the character '/' is allowed to appear unencoded in the
query string part, but according to some sites which reference RFC 3986 [1], it
is.
Although most commonly used URL-encoding methods (like
java.net.URLEncoder.encode()) encode the '/' character as "%2F", it maybe
possible that some applications use that char directly in a querystring, which
is then given to response.sendRedirect().
Imaging a servlet available at URL
http://localhost/Test/SomeServlet
calls
response.sendRedirect("OtherServlet?someText=A/../B");
then the resulting HTTP 302 header will be:
Location: http://localhost/Test/B
instead of
Location: http://localhost/Test/OtherServlet?someText=A/../B
so the querystring part is unintentionally modified. Maybe this needs to be
fixed?
[1]
http://www.456bereastreet.com/archive/201008/what_characters_are_allowed_unencoded_in_query_strings/
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
