juanpablo-santos commented on code in PR #521:
URL: https://github.com/apache/jspwiki/pull/521#discussion_r4045768229
##########
jspwiki-util/src/main/java/org/apache/wiki/util/HttpUtil.java:
##########
@@ -292,40 +292,34 @@ public static void clearCookie( final HttpServletResponse
response, final String
/**
* Generates an absolute URL based on the given HttpServletRequest and a
relative URL.
- * This method takes into account various headers like X-Forwarded-Host,
X-Forwarded-Proto,
- * and X-Forwarded-Server to construct the absolute URL.
+ * Only the container-resolved scheme, server name and port are used;
forwarded headers
+ * such as {@code X-Forwarded-Host}, {@code X-Forwarded-Proto} and {@code
X-Forwarded-Server}
+ * are deliberately ignored, because they are client-supplied and must
only be honored by
+ * the container itself (e.g. Tomcat's RemoteIpValve) after validating
that they were set
+ * by a trusted proxy. Trusting them here allowed any client to poison
generated URLs
+ * (e.g. the shared RSS feed cache and e-mailed login links).
*
* @param request The HttpServletRequest object, used to obtain scheme,
server name, and port.
* @param relativeUrl The relative URL to be appended to the base URL. Can
be null.
* @return The absolute URL as a String.
* @since 2.12.2
*/
public static String getAbsoluteUrl(final HttpServletRequest request,
final String relativeUrl) {
Review Comment:
not sure about the best way of handling this, as this would break the RSS if
JSPWiki is served behind some kind of proxy / web server. IIRC, initially we
had a jspwiki property for the url, then, as it was only used on the rss feed
we tried to resolve from path (as this PR does now). Unfortunately, this broke
the RSS and we ended up with today's code. Perhaps we should bring back the
baseUrl property? I'll chime in at JSPWIKI-1294 with some more remarks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
