markt-asf commented on PR #1065: URL: https://github.com/apache/tomcat/pull/1065#issuecomment-5597859946
This is a change to harden against (potentially) vulnerable web applications that are failing to validate/sanitise untrusted input. We need to weigh the benefits it brings to those broken applications against the cost it adds to applications that already do things properly and don't need this hardening. Broken applications only benefit if the application doesn't use cookies for session tracking. Are there (m)any of those these days? The cost is incurred by every application that uses the CsrfPreventionFilter. The cost of the path parameter stripping is minimal (compared to existing CsrfPreventionFilter processing) assuming there are no path parameters. Normalization is the potentially more expensive operation and the one that is more likely to be used. Given the above, the there is much less of a reason to skip the path parameter processing that I first thought. I will note that the fix could use the existing stripPathParams function and that the context path comparison can be simplified because getContextPath() will never return a value that ends with a "/". I'll apply a variation of this patch shortly. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
