Re: URLs with '../' and 404s

2010-04-09 Thread Mark Thomas
On 08/04/2010 23:23, Nikita Tovstoles wrote: So, if the current URI is http://localhost/app/page; and sendRedirect method arg is ../../app/page.0 what does that violate? That relative URL is not valid. To construct the absolute URL, you strip of the file name from the path and append the

URLs with '../' and 404s

2010-04-08 Thread Nikita Tovstoles
We use Wicket that periodically redirects to relative URLs starting with '../'. I realize that's against the RFC (which says redirects are supposed to be absolute), but I am not clear on why doesn't Tomcat collapse those URLs in Response.toAbsolute()? Specifically: -assume client is at

Re: URLs with '../' and 404s

2010-04-08 Thread Nikita Tovstoles
Actually it was pointed out to me that it is the container not the app/framework that is generating the Location header, and so isn't the below a bug in toAbsolute()? On Thu, Apr 8, 2010 at 8:14 AM, Nikita Tovstoles nikita.tovsto...@gmail.com wrote: We use Wicket that periodically redirects

Re: URLs with '../' and 404s

2010-04-08 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Nikita, On 4/8/2010 11:14 AM, Nikita Tovstoles wrote: We use Wicket that periodically redirects to relative URLs starting with '../'. I realize that's against the RFC (which says redirects are supposed to be absolute), but I am not clear on why

Re: URLs with '../' and 404s

2010-04-08 Thread Nikita Tovstoles
Response.java in Tomcat src: http://kickjava.com/src/org/apache/catalina/connector/Response.java.htm On Thu, Apr 8, 2010 at 12:52 PM, Christopher Schultz ch...@christopherschultz.net wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Nikita, On 4/8/2010 11:14 AM, Nikita Tovstoles

Re: URLs with '../' and 404s

2010-04-08 Thread Caldarale, Charles R
On Apr 8, 2010, at 14:53, Christopher Schultz ch...@christopherschultz.net wrote: I see no toAbsolute method in the HttpServletResponse class. Are you talking about some other toolkit? It's an internal Tomcat method that the OP seems to think should rectify the RFC violations his code is

Re: URLs with '../' and 404s

2010-04-08 Thread David Smith
I strongly advocate server relative URLs which get rid of the whole problem. All that means is the URL becomes everything after the servername port in a full absolute URL. That way it just plain works and even minimizes the browser's understanding of how to compute an absolute URL from a

Re: URLs with '../' and 404s

2010-04-08 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Nikita, On 4/8/2010 4:03 PM, Nikita Tovstoles wrote: Response.java in Tomcat src: http://kickjava.com/src/org/apache/catalina/connector/Response.java.htm Hmm... a non-Apache site without a version reference? :( How about

Re: URLs with '../' and 404s

2010-04-08 Thread Nikita Tovstoles
Chuck, Without asserting that Wicket's is NOT breaking an RFC, I would appreciate a clarification on which RFC do you think the framework (or the app) is breaking? HttpServletResponse.sendRedirect allows relative URLs explicitly. From 1.4 EE Javadoc: Sends a temporary redirect response to the