lprimak commented on code in PR #2836:
URL: https://github.com/apache/shiro/pull/2836#discussion_r3778605201
##########
web/src/main/java/org/apache/shiro/web/filter/mgt/PathMatchingFilterChainResolver.java:
##########
@@ -150,6 +150,15 @@ public FilterChain getChain(ServletRequest request,
ServletResponse response, Fi
}
}
+ // If no chain matched and the requestURI is null/empty, fall back to
the catch-all chain if one exists.
Review Comment:
This change should be reverted since this case will never be hit (since
exception is now thrown)
##########
web/src/main/java/org/apache/shiro/web/util/WebUtils.java:
##########
@@ -116,9 +116,18 @@ private WebUtils() {
*
* @param request current HTTP request
* @return the path within the web application
+ * @throws IllegalStateException if the path cannot be normalized, e.g.
when it
+ * traverses above the root ({@code "/.."}). Callers must fail closed
instead of
+ * operating on a {@code null} path, which would otherwise bypass the
filter chain.
*/
public static String getPathWithinApplication(HttpServletRequest request) {
- return normalize(removeSemicolon(getServletPath(request) +
getPathInfo(request)));
+ String servletPath = getServletPath(request);
Review Comment:
Move the next 2 lines inside the exception throwing `if()` statement so no
performance regressions appear
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
