> remm 01/07/16 18:04:29 > > Modified: catalina/src/share/org/apache/catalina/connector/http > HttpProcessor.java > Log: > - %25, %2F, %2E and %5C are now forbidden in the request URI. I > hope this > is not a problem with multi-byte characters. > - Medium risk fix : always finish the response. That could lead > to connection > management problems. That has to be changed since otherwise > no HTTP error > report would be generated when something bad happened when parsing > the request. > <snip> > + // Prevent encoding '%', '/', '.' and '\', which are > special reserved > + // characters > + if ((normalized.indexOf("%25") > 0) || > (normalized.indexOf("%2F") > 0) > + || (normalized.indexOf("%2E") > 0) > + || (normalized.indexOf("%5C") > 0)) { > + return null; > + } I think these comparisons should be >= instead of >.
- cvs commit: jakarta-tomcat-4.0/catalina/src/share/org/... remm
- cvs commit: jakarta-tomcat-4.0/catalina/src/share/org/... remm
- cvs commit: jakarta-tomcat-4.0/catalina/src/share/org/... remm
- Re: cvs commit: jakarta-tomcat-4.0/catalina/src/s... Craig R. McClanahan
- cvs commit: jakarta-tomcat-4.0/catalina/src/share/org/... remm
- cvs commit: jakarta-tomcat-4.0/catalina/src/share/org/... remm
- cvs commit: jakarta-tomcat-4.0/catalina/src/share/org/... remm
- cvs commit: jakarta-tomcat-4.0/catalina/src/share/org/... remm
- RE: cvs commit: jakarta-tomcat-4.0/catalina/src/s... Marc Saegesser
- Re: cvs commit: jakarta-tomcat-4.0/catalina/s... Remy Maucherat
- Re: cvs commit: jakarta-tomcat-4.0/catalina/src/s... Marc Saegesser
- Re: cvs commit: jakarta-tomcat-4.0/catalina/s... Remy Maucherat
- cvs commit: jakarta-tomcat-4.0/catalina/src/share/org/... remm
- cvs commit: jakarta-tomcat-4.0/catalina/src/share/org/... remm
- cvs commit: jakarta-tomcat-4.0/catalina/src/share/org/... craigmcc
- Re: cvs commit: jakarta-tomcat-4.0/catalina/src/s... Incze Lajos
- Re: cvs commit: jakarta-tomcat-4.0/catalina/s... Craig R. McClanahan
- cvs commit: jakarta-tomcat-4.0/catalina/src/share/org/... remm
- cvs commit: jakarta-tomcat-4.0/catalina/src/share/org/... remm
- cvs commit: jakarta-tomcat-4.0/catalina/src/share/org/... remm
- cvs commit: jakarta-tomcat-4.0/catalina/src/share/org/... remm