Joerg Hoh created SLING-13371:
---------------------------------
Summary: Path resolution diverges from container path info when
URL contains a ';' path parameter
Key: SLING-13371
URL: https://issues.apache.org/jira/browse/SLING-13371
Project: Sling
Issue Type: Bug
Components: Engine
Affects Versions: Engine 2.16.8, Engine 3.0.2
Reporter: Joerg Hoh
{{RequestData.initResource()}} re-derives the resolution path from the raw
request URL (via {{URL.getPath()}}) whenever the URL contains a {{;}} that the
container already stripped from {{getPathInfo()}}. This raw path is undecoded
and unnormalized:
* Percent-escapes stay literal (e.g. {{%20}} instead of a space)
* {{..;x}}-style segments the container normalized away remain intact
As a result, the resource resolver can resolve a different path than the one
any container-level or filter-level path-based control (auth requirements,
WAF/dispatcher rules, filter patterns) evaluated.
Additionally, the decoded {{contextPath + servletPath}} prefix is stripped from
the raw path via an unguarded {{substring()}}, which throws an uncaught
{{StringIndexOutOfBoundsException}} (surfacing as a 500) when the raw and
decoded paths are misaligned, e.g. in non-root-context deployments.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
