----- Original Message ----- From: "Eric Johnson" <[EMAIL PROTECTED]>
> Problem #2, I think, deserves an exception, rather than a silent > adjustment. If you sent "http://a/../g"; to either Tomcat or Apache, I I think so, except for IIS. ;) > believe both will actually ignore the request and log it as an attempted > hack, so we definitely shouldn't take that option. The result of > "http://a/g"; is misleading, and will lead to unintended consequences > that are harder to identify and figure out than if you threw an > exception in the first place. Imagine, for example, that your client Reasonable... ;) > application follows a link in an HTML that generated this URL, and the > file "g" actually exists on the server. Everything will appear to be > operating correctly, but it is not. If an exception is thrown, then probably some might happen to try to find a higher virtual server? It's very unusual though... ^^; Sung-Gu --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
