joerghoh opened a new pull request, #101: URL: https://github.com/apache/sling-org-apache-sling-engine/pull/101
### Problem `RequestData.initResource()` re-derives the resolution path from the raw request URL (via `URL.getPath()`) whenever the URL contains a `;` that the container already stripped from `getPathInfo()`. This raw path was undecoded and unnormalized: - Percent-escapes stayed literal (e.g. `%20` instead of a space) - `..;x`-style segments the container normalized away remained intact As a result, the resource resolver could resolve a different path than the one evaluated by container-level or filter-level path-based controls (auth requirements, WAF/dispatcher rules, filter patterns). Additionally, the decoded `contextPath + servletPath` prefix was stripped from the raw path via an unguarded `substring()`, which threw an uncaught `StringIndexOutOfBoundsException` (surfacing as a 500) when the raw and decoded paths were misaligned, e.g. in non-root-context deployments. ### Fix - Switched from `URL.getPath()` to `URI.getPath()`, which percent-decodes the path so it's in the same canonical form as the container-provided `getPathInfo()`. - Guarded the prefix strip with `startsWith()` before calling `substring()`, so a non-matching or too-short prefix falls back to the container-provided path instead of throwing. - Added an equivalence check: the re-derived path is only used if it equals the container's path info once its `;name=value` segments are stripped (`stripPathParameters()`). If they diverge for any other reason (traversal segments, case differences, etc.), the container-provided path is used instead — so a mismatch can never resolve to something the container didn't already agree to. - Catch `URISyntaxException` instead of `MalformedURLException` and fall back to the container path on failure. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
