lprimak commented on code in PR #2836:
URL: https://github.com/apache/shiro/pull/2836#discussion_r3633091310
##########
web/src/main/java/org/apache/shiro/web/filter/mgt/PathMatchingFilterChainResolver.java:
##########
@@ -150,6 +150,15 @@ public FilterChain getChain(ServletRequest request,
ServletResponse response, Fi
}
}
+ // If no chain matched and the requestURI is null/empty, fall back to
the catch-all chain if one exists.
Review Comment:
This change also needs to be introduced in
support/guice/src/main/java/org/apache/shiro/guice/web/SimpleFilterChainResolver.java
##########
web/src/main/java/org/apache/shiro/web/util/WebUtils.java:
##########
@@ -118,7 +118,11 @@ private WebUtils() {
* @return the path within the web application
*/
public static String getPathWithinApplication(HttpServletRequest request) {
- return normalize(removeSemicolon(getServletPath(request) +
getPathInfo(request)));
+ String path = normalize(removeSemicolon(getServletPath(request) +
getPathInfo(request)));
Review Comment:
This change is very risky, and possibly introduces bypass vectors.
I think this needs to be reverted
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
