Chenjp commented on PR #1065: URL: https://github.com/apache/tomcat/pull/1065#issuecomment-5595863823
> I can see the benefit of normalization but I'm not convinced path parameter stripping is necessary. The context path part of the resulting normalized string will have been provided by the application so there is no reason for path parameters to be present. Following story came from my partner [email protected] closed report, and we have talk it further: Consider the possibility of user-input relative uri path, e.g., wordpress-in-java ("/wp") author's publish an article with following metadata: ```xml <!--Malicious author adds new article --> <article id="1024" logo_relative_uri="/images/..;/../public/images/logo.png" raw_relative_uri="/public/docs/..;/../../wp/profile;jsessionid=$injected_session_id" title="Tomcat encodeURL / encodeRedirectURL weakness"/> ``` Server-side saves his article submission, failed to recognize the risks of insufficiently sanitized relative URI paths - most applications generally assume that the relative uri paths are safe. When another admin / public user visit /wp/articles/1024. ```jsp String logoRelativeUri="/images/..;/..;/public/images/logo.png"; ... <!--img node: Zero-click ? --> <img src="<%= response.encodeURL(application.getContextPath() + logoRelativeUri) %>" alt="Loading"/> ... ``` We think the present of path parameters in relative path is possible. And necessary to his resubmit? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
