On Tue, 2012-07-31 at 09:20 -0300, Alejandro Mehring wrote:
> First of all, thank you very much for your quick response! I'm too having a
> hard time believing that tomcat would do something like that... I even
> tried on a new web project and it didn't remove the parent directory
> reference! I'm very confused right now...
> 
> The base url of the application is of the form
> 
> http://host/app/servlets/FrontController
> 
> So when in Tomcat 4 the page fetches the stylesheet (using the
> href="../lightStyle.css" form), it resolves to
> http://host/app/lightStyle.css, whereas in Tomcat 7 it goes to
> http://host/app/servlets/lightStyle.css.
> 

In your 4->7 migration process have you made any source code changes
(e.g. using <base> tags)?


> Here's the output of the JSP (the header part) for both 4 and 7 version.
> 
> TOMCAT 4
> ========
> 
> <html>
> <style type="text/css">
> @import URL("../lightStyle.css")
> </style>
> <head>
> <!--meta http-equiv=Content-Type content="text/html;
> charset=windows-1252"-->
> <meta http-equiv=Content-Type content="text/html; charset=ISO-8859-1">
> <meta http-equiv="Expires" content="0">
> <meta http-equiv="Pragma" content="no-cache">
> <meta http-equiv="cache-control" content="no-cache">
> <title>Consulta de usuarios</title>
> <link rel="stylesheet" href="../lightStyle.css" type="text/css">
> ...
> </head>
> ...
> 
> 
> 
> TOMCAT 7
> ========
> <HTML>
> <style type="text/css">
> @import URL("lightStyle.css")
> </style>
> <head>
> <title>Error</title>
> <link rel="stylesheet" href="lightStyle.css" type="text/css">
> <meta http-equiv=Content-Type content="text/html; charset=ISO-8859-1">
> <meta http-equiv="Expires" content="0">
> <meta http-equiv="Pragma" content="no-cache">
> <meta http-equiv="cache-control" content="no-cache">
> ...
> </head>
> ...
> 
> 
> Thanks again for anything you can think of!
> Cheers!
> Ale
> 
> 
> On Tue, Jul 31, 2012 at 5:10 AM, André Warnier <a...@ice-sa.com> wrote:
> 
> > Christopher Schultz wrote:
> >
> >> -----BEGIN PGP SIGNED MESSAGE-----
> >> Hash: SHA1
> >>
> >> Alejandro,
> >>
> >> On 7/30/12 5:48 PM, Alejandro Mehring wrote:
> >>
> >>> I'm migrating to Tomcat 7 a web system that used to run on Tomcat
> >>> 4...
> >>>
> >>
> >> Been there (though I went through 5.5 and 6.0 to get there in a
> >> relatively short amount of time).
> >>
> >>  So far, I've been able to sort out all of the issues I've faced,
> >>> but I'm stuck at one point. When a page loads in Tomcat 4, it goes
> >>> and fetches the stylesheet from the server with a link of the form
> >>>
> >>> <link type="text/css" href="../lightStyle.css" rel="stylesheet">
> >>>
> >>
> >> Although this should work, I always recommend using context-relative
> >> URLs like this:
> >>
> >> <link type="text/css" href="<%=
> >> response.encodeURL(request.**getContextPath() + "/lightStyle.css") %>" />
> >>
> >> This will ensure that your URLs resolve properly no matter how the
> >> .jsp is being evaluated (for instance, in an include or after a
> >> forward, where the client's URL may not match what your JSP expects).
> >>
> >>  But on Tomcat 7, the parent directory indirection is removed, and I
> >>> can't seem to find the way to prevent this from happening!
> >>>
> >>
> >> That doesn't seem right.
> >>
> >>  What confuses me more, is that when Tomcat generates the *_jsp.java
> >>> files, both 4 and 7 versions generate a line of code like this
> >>> one:
> >>>
> >>> out.write("<link rel=\"stylesheet\" href=\"../lightStyle.css\"
> >>> type=\"text/css\">\r\n\r\n");
> >>>
> >>> So i can't figure out why the rendering process is removing the
> >>> '../' bit of the link!
> >>>
> >>
> >> I have a hard time believing that Tomcat is modifying anything: in the
> >> case above, Tomcat does not interpret anything at all. As far as
> >> Tomcat is concerned, the above is just a string of characters like
> >> "Hello, World" and has no URL context or anything like that.
> >>
> >> Are you sure this isn't being included by another JSP or forwarded
> >> from another URL?
> >>
> >>  Has anyone faced this problem before? I haven't found any parent
> >>> directory restriction configuration or something that would point
> >>> me in that direction.
> >>>
> >>
> >> What does the output of the JSP look like? That is, what is the actual
> >> content of the page as seen by the client?
> >>
> >>
> > +1
> >
> > And, what does that request for the stylesheet actually look like, when it
> > is sent by the client (the browser) to the server ?
> > You can find that out by using one of the browser plugins like Fiddler2
> > (for IE), HttpFox (for Firefox) or similar.
> > The point is : this "href" is interpreted *by the client* and converted to
> > a full HTTP request URL (with hostname, path and all), before being sent to
> > the server.
> > The server always receives an absolute URL, starting at the root.
> >
> >
> > ------------------------------**------------------------------**---------
> > To unsubscribe, e-mail: 
> > users-unsubscribe@tomcat.**apache.org<users-unsubscr...@tomcat.apache.org>
> > For additional commands, e-mail: users-h...@tomcat.apache.org
> >
> >

Attachment: signature.asc
Description: This is a digitally signed message part

Reply via email to