[Bug 56005] ISAPI redirector WEB-INF/META-INF Path Check false positive (#51769 is back)

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=56005

Rainer Jung  changed:

   What|Removed |Added

 Resolution|--- |INVALID
 Status|NEEDINFO|RESOLVED

--- Comment #3 from Rainer Jung  ---
No feedback providedfor 1.5 years. I can't see any error with web-inf /
meta-inf handling currently. So closing as INVALID.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 56005] ISAPI redirector WEB-INF/META-INF Path Check false positive (#51769 is back)

[bugzilla]

https://issues.apache.org/bugzilla/show_bug.cgi?id=56005

Rainer Jung rainer.j...@kippdata.de changed:

   What|Removed |Added

 Status|NEW |NEEDINFO

--- Comment #2 from Rainer Jung rainer.j...@kippdata.de ---
Can we please get any feedback on the open questions? I need some more details
about your test case.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 56005] ISAPI redirector WEB-INF/META-INF Path Check false positive (#51769 is back)

[bugzilla]

https://issues.apache.org/bugzilla/show_bug.cgi?id=56005

--- Comment #1 from Rainer Jung rainer.j...@kippdata.de ---
Note that PR 51769 was about erroneously rejecting a request as invalid,
because not only requests to objects underneath web-inf and meta-inf were
blocked, but also requests to resources that contained web-inf or meta-inf as
substrings in their uri, like /a/b/c/web-inf.xml. Such requests are allowed
though and after fixing 51769 should work. Only requests to metra-inf or
web-inf or any resource underneath them must be rejected.

Can you please clarify:

- which URL are you using when you observe a problem
- what is the expected response
- what is the actual response
- what are the contents of access and error logs (iis, tomcat) if any

Thanks!

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 56005] ISAPI redirector WEB-INF/META-INF Path Check false positive (#51769 is back)

[bugzilla]

https://issues.apache.org/bugzilla/show_bug.cgi?id=56005

ringz...@nym.hush.com changed:

   What|Removed |Added

 CC||ringz...@nym.hush.com
 OS||All

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org