Re: Using encoded slashes safely

2009-04-29 Thread Mark Thomas
Bill Higgins wrote: > 1) Do you consider the automatic decoding of encoded slashes to be a > defect vs. the URI spec? It looks like it based on my reading so far. > 2) If so, do you think it would be worth it if I filed a bug report > (or does one already exist)? Please do. If there is a good reas

Re: Using encoded slashes safely

2009-04-29 Thread Tim Funk
IIRC, HttpServletRequest.getQueryString() should provide the query string you desire. -Tim Bill Higgins wrote: On Tue, Apr 28, 2009 at 3:19 AM, Mark Thomas wrote: Bill Higgins wrote: We have a servlet that acts as a proxy to other URLs from different origins. E.g. via your web app you could

Re: Using encoded slashes safely

2009-04-29 Thread Bill Higgins
On Tue, Apr 28, 2009 at 3:19 AM, Mark Thomas wrote: > Bill Higgins wrote: >> We have a servlet that acts as a proxy to other URLs from different >> origins. E.g. via your web app you could get to the Google home page >> via a URL like: >> >> http://localhost/myapp/proxy/http%3A%2F%2Fwww.google.com

Re: Using encoded slashes safely

2009-04-28 Thread Mark Thomas
Bill Higgins wrote: > We have a servlet that acts as a proxy to other URLs from different > origins. E.g. via your web app you could get to the Google home page > via a URL like: > > http://localhost/myapp/proxy/http%3A%2F%2Fwww.google.com%2F > > Using this URL pattern, we immediately hit the Tom

Using encoded slashes safely

2009-04-27 Thread Bill Higgins
We have a servlet that acts as a proxy to other URLs from different origins. E.g. via your web app you could get to the Google home page via a URL like: http://localhost/myapp/proxy/http%3A%2F%2Fwww.google.com%2F Using this URL pattern, we immediately hit the Tomcat "noSlash" restriction (Directo