This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/11.0.x by this push:
new f00ab28725 Fix unintentional conversion of `+` to ` ` during rule
processing
f00ab28725 is described below
commit f00ab28725a18c7fffda421e9858c27badcac1e4
Author: Mark Thomas <[email protected]>
AuthorDate: Tue Jun 30 22:51:46 2026 +0100
Fix unintentional conversion of `+` to ` ` during rule processing
Also silences exception logging when running tests or when using the
RewriteValve in embedded mode and setting the configuration directly.
---
java/org/apache/catalina/valves/rewrite/RewriteValve.java | 14 +++++++++++---
.../apache/catalina/valves/rewrite/TestRewriteValve.java | 10 ++++++++--
webapps/docs/changelog.xml | 4 ++++
3 files changed, 23 insertions(+), 5 deletions(-)
diff --git a/java/org/apache/catalina/valves/rewrite/RewriteValve.java
b/java/org/apache/catalina/valves/rewrite/RewriteValve.java
index 28dcaa5b0a..b879128a7c 100644
--- a/java/org/apache/catalina/valves/rewrite/RewriteValve.java
+++ b/java/org/apache/catalina/valves/rewrite/RewriteValve.java
@@ -17,11 +17,11 @@
package org.apache.catalina.valves.rewrite;
import java.io.BufferedReader;
+import java.io.FileNotFoundException;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.StringReader;
-import java.net.URLDecoder;
import java.nio.charset.Charset;
import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
@@ -173,7 +173,8 @@ public class RewriteValve extends ValveBase {
String webInfResourcePath = "/WEB-INF/" + resourcePath;
is = ((Context)
getContainer()).getServletContext().getResourceAsStream(webInfResourcePath);
if (is == null) {
- if (containerLog.isInfoEnabled()) {
+ // Don't log if the rules have been set directly via
setConfiguration()
+ if (containerLog.isInfoEnabled() && rules == null) {
containerLog.info(sm.getString("rewriteValve.noConfiguration",
webInfResourcePath));
}
} else {
@@ -186,6 +187,13 @@ public class RewriteValve extends ValveBase {
try {
ConfigurationSource.Resource resource =
ConfigFileLoader.getSource().getResource(resourceName);
is = resource.getInputStream();
+ } catch (FileNotFoundException fnfe) {
+ // Don't log if the rules have been set directly via
setConfiguration()
+ if (rules == null) {
+ if (containerLog.isInfoEnabled()) {
+
containerLog.info(sm.getString("rewriteValve.noConfiguration", resourceName),
fnfe);
+ }
+ }
} catch (IOException ioe) {
if (containerLog.isInfoEnabled()) {
containerLog.info(sm.getString("rewriteValve.noConfiguration", resourceName),
ioe);
@@ -584,7 +592,7 @@ public class RewriteValve extends ValveBase {
chunk.append(REWRITE_DEFAULT_ENCODER.encode(urlStringRewriteEncoded,
uriCharset));
// Rewriting may have denormalized the URL and added
encoded characters
// Decode then normalize
- String urlStringRewriteDecoded =
URLDecoder.decode(urlStringRewriteEncoded, uriCharset);
+ String urlStringRewriteDecoded =
UDecoder.URLDecode(urlStringRewriteEncoded, uriCharset);
urlStringRewriteDecoded =
RequestUtil.normalize(urlStringRewriteDecoded);
if (urlStringRewriteDecoded == null) {
// Assume bad input caused the re-write to try and
escape root
diff --git a/test/org/apache/catalina/valves/rewrite/TestRewriteValve.java
b/test/org/apache/catalina/valves/rewrite/TestRewriteValve.java
index df6f517d18..dd7658c080 100644
--- a/test/org/apache/catalina/valves/rewrite/TestRewriteValve.java
+++ b/test/org/apache/catalina/valves/rewrite/TestRewriteValve.java
@@ -20,7 +20,6 @@ import java.io.File;
import java.io.IOException;
import java.io.PrintWriter;
import java.net.HttpURLConnection;
-import java.net.URLDecoder;
import java.nio.charset.StandardCharsets;
import java.util.Arrays;
import java.util.HashMap;
@@ -45,6 +44,7 @@ import org.apache.catalina.startup.Tomcat;
import org.apache.catalina.startup.TomcatBaseTest;
import org.apache.catalina.valves.ValveBase;
import org.apache.tomcat.util.buf.ByteChunk;
+import org.apache.tomcat.util.buf.UDecoder;
import org.apache.tomcat.util.http.Method;
/*
@@ -1081,6 +1081,12 @@ public class TestRewriteValve extends TomcatBaseTest {
}
+ @Test
+ public void testEncodedUriPlus() throws Exception {
+ doTestRewriteWithEncoding("a+b");
+ }
+
+
private void doTestRewriteWithEncoding(String segment) throws Exception {
doTestRewriteWithEncoding(segment, segment, null);
}
@@ -1111,7 +1117,7 @@ public class TestRewriteValve extends TomcatBaseTest {
String body = res.toString();
Assert.assertTrue(body, body.contains("REQUEST-URI: /target/" +
expectedSegment));
Assert.assertTrue(body, body.contains("PATH-INFO: /" +
- URLDecoder.decode(expectedSegment, StandardCharsets.UTF_8)));
+ UDecoder.URLDecode(expectedSegment, StandardCharsets.UTF_8)));
Assert.assertTrue(body, body.contains("REQUEST-QUERY-STRING: " +
expectedQueryString));
}
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index dd7babc29d..f84849ee10 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -148,6 +148,10 @@
<fix>
Various edge cases for SSI substitutions, quoting and escaping. (remm)
</fix>
+ <fix>
+ Fix unintentional conversion of literal <code>+</code> to a space
during
+ rule processing in the <code>RewriteValve</code>. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
