moresandeep opened a new pull request #378: URL: https://github.com/apache/knox/pull/378
## What changes were proposed in this pull request? This PR is to upgrade Shiro library to 1.6.0. Shiro 1.6.0 introduces some drastic changes in response to a security issue (see [Global Filters](https://shiro.apache.org/web.html#global-filters)) these changes will break some of the proxying services that include `;` `\` in the URL. `;` is most commonly used for `jsessionid` so that likely will introduce some breakage. We try to mitigate this breakage by turning off blocking `;`, `\` and non-ascii characters by setting the following properties to false out of the box. 1. `invalidRequest.blockBackslash = false` 2. `invalidRequest.blockSemicolon = false` 3. `invalidRequest.blockNonAscii = false` These properties can be set to true in Knox topology (by adding shiro providers param section). This PR also adds unit tests to test these changes. ## How was this patch tested? This patch was tested locally. ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected]
