[
https://issues.apache.org/jira/browse/SLING-13371?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Joerg Hoh resolved SLING-13371.
-------------------------------
Fix Version/s: Engine 3.0.4
Resolution: Fixed
> Path resolution diverges from container path info when URL contains a ';'
> path parameter
> -----------------------------------------------------------------------------------------
>
> Key: SLING-13371
> URL: https://issues.apache.org/jira/browse/SLING-13371
> Project: Sling
> Issue Type: Bug
> Components: Engine
> Affects Versions: Engine 3.0.2, Engine 2.16.8
> Reporter: Joerg Hoh
> Priority: Major
> Fix For: Engine 3.0.4
>
>
> {{RequestData.initResource()}} re-derives the resolution path from the raw
> request URL (via {{URL.getPath()}}) whenever the URL contains a {{;}} that
> the container already stripped from {{getPathInfo()}}. This raw path is
> undecoded and unnormalized:
> * Percent-escapes stay literal (e.g. {{%20}} instead of a space)
> * {{..;x}}-style segments the container normalized away remain intact
> As a result, the resource resolver can resolve a different path than the one
> any container-level or filter-level path-based control (auth requirements,
> WAF/dispatcher rules, filter patterns) evaluated.
> Additionally, the decoded {{contextPath + servletPath}} prefix is stripped
> from the raw path via an unguarded {{substring()}}, which throws an uncaught
> {{StringIndexOutOfBoundsException}} (surfacing as a 500) when the raw and
> decoded paths are misaligned, e.g. in non-root-context deployments.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
