Author: markt
Date: Wed Apr 20 12:14:43 2016
New Revision: 1740131
URL: http://svn.apache.org/viewvc?rev=1740131&view=rev
Log:
When normalizing paths, improve the handling when paths end with'/.' or '/..'
and ensure that input and output are consistent with respect to whether or not
they end with '/'.
Modified:
tomcat/trunk/java/org/apache/tomcat/util/http/RequestUtil.java
tomcat/trunk/test/org/apache/tomcat/util/http/TestRequestUtil.java
tomcat/trunk/webapps/docs/changelog.xml
Modified: tomcat/trunk/java/org/apache/tomcat/util/http/RequestUtil.java
URL:
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/tomcat/util/http/RequestUtil.java?rev=1740131&r1=1740130&r2=1740131&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/tomcat/util/http/RequestUtil.java (original)
+++ tomcat/trunk/java/org/apache/tomcat/util/http/RequestUtil.java Wed Apr 20
12:14:43 2016
@@ -67,6 +67,12 @@ public class RequestUtil {
if (!normalized.startsWith("/"))
normalized = "/" + normalized;
+ boolean addedTrailingSlash = false;
+ if (normalized.endsWith("/.") || normalized.endsWith("/..")) {
+ normalized = normalized + "/";
+ addedTrailingSlash = true;
+ }
+
// Resolve occurrences of "//" in the normalized path
while (true) {
int index = normalized.indexOf("//");
@@ -98,12 +104,10 @@ public class RequestUtil {
normalized = normalized.substring(0, index2) +
normalized.substring(index + 3);
}
- if (normalized.equals("/.")) {
- return "/";
- }
-
- if (normalized.equals("/..")) {
- return null; // Trying to go outside our context
+ if (normalized.length() > 1 && addedTrailingSlash) {
+ // Remove the trailing '/' we added to that input and output are
+ // consistent w.r.t. to the presence of the trailing '/'.
+ normalized = normalized.substring(0, normalized.length() - 1);
}
// Return the normalized path that we have completed
Modified: tomcat/trunk/test/org/apache/tomcat/util/http/TestRequestUtil.java
URL:
http://svn.apache.org/viewvc/tomcat/trunk/test/org/apache/tomcat/util/http/TestRequestUtil.java?rev=1740131&r1=1740130&r2=1740131&view=diff
==============================================================================
--- tomcat/trunk/test/org/apache/tomcat/util/http/TestRequestUtil.java
(original)
+++ tomcat/trunk/test/org/apache/tomcat/util/http/TestRequestUtil.java Wed Apr
20 12:14:43 2016
@@ -117,6 +117,46 @@ public class TestRequestUtil {
doTestNormalize("/a/../../", null);
}
+ @Test
+ public void testNormalize20() {
+ doTestNormalize("/a/..", "/");
+ }
+
+ @Test
+ public void testNormalize21() {
+ doTestNormalize("/a/.", "/a");
+ }
+
+ @Test
+ public void testNormalize22() {
+ doTestNormalize("/a/../", "/");
+ }
+
+ @Test
+ public void testNormalize23() {
+ doTestNormalize("/a/./", "/a/");
+ }
+
+ @Test
+ public void testNormalize24() {
+ doTestNormalize("/a/b/..", "/a");
+ }
+
+ @Test
+ public void testNormalize25() {
+ doTestNormalize("/a/b/.", "/a/b");
+ }
+
+ @Test
+ public void testNormalize26() {
+ doTestNormalize("/a/b/../", "/a/");
+ }
+
+ @Test
+ public void testNormalize27() {
+ doTestNormalize("/a/b/./", "/a/b/");
+ }
+
private void doTestNormalize(String input, String expected) {
assertEquals(expected,RequestUtil.normalize(input));
}
Modified: tomcat/trunk/webapps/docs/changelog.xml
URL:
http://svn.apache.org/viewvc/tomcat/trunk/webapps/docs/changelog.xml?rev=1740131&r1=1740130&r2=1740131&view=diff
==============================================================================
--- tomcat/trunk/webapps/docs/changelog.xml (original)
+++ tomcat/trunk/webapps/docs/changelog.xml Wed Apr 20 12:14:43 2016
@@ -154,6 +154,12 @@
custom responses to <code>HEAD</code> requests that do not set a
<code>Content-Length</code> value. (markt)
</fix>
+ <fix>
+ When normalizing paths, improve the handling when paths end with
+ <code>/.</code> or <code>/..</code> and ensure that input and output
are
+ consistent with respect to whether or not they end with <code>/</code>.
+ (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
