Eclipse
/
jetty.project
mirror of https://github.com/jetty/jetty.project.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/jetty-9.3.x' into jetty-9.4.x

This commit is contained in:
Greg Wilkins 2017-04-20 13:19:28 +10:00
parent 9ce9832293 2f04b0f869
commit 02276974a8
18 changed files with 491 additions and 207 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
examples/embedded/src/main/java/org/eclipse/jetty/embedded/FastFileServer.java
View File

@ -111,8 +111,7 @@ public class FastFileServer
{
if (!request.getPathInfo().endsWith(URIUtil.SLASH))
{
response.sendRedirect(response.encodeRedirectURL(URIUtil
.addPaths(request.getRequestURI(), URIUtil.SLASH)));
response.sendRedirect(response.encodeRedirectURL(request.getRequestURI()+URIUtil.SLASH));
return;
}
String listing = Resource.newResource(file).getListHTML(

4
jetty-rewrite/src/main/java/org/eclipse/jetty/rewrite/handler/RedirectUtil.java
View File

@ -47,14 +47,14 @@ public final class RedirectUtil
if (location.startsWith("/"))
{
// absolute in context
location = URIUtil.canonicalPath(location);
location = URIUtil.canonicalEncodedPath(location);
}
else
{
// relative to request
String path = request.getRequestURI();
String parent = (path.endsWith("/")) ? path : URIUtil.parentPath(path);
location = URIUtil.canonicalPath(URIUtil.addPaths(parent,location));
location = URIUtil.canonicalPath(URIUtil.addEncodedPaths(parent,location));
if (!location.startsWith("/"))
url.append('/');
}

50
jetty-server/src/main/java/org/eclipse/jetty/server/Request.java
View File

@ -1283,7 +1283,7 @@ public class Request implements HttpServletRequest
relTo = relTo.substring(0,slash + 1);
else
relTo = "/";
path = URIUtil.addPaths(URIUtil.encodePath(relTo),path);
path = URIUtil.addPaths(relTo,path);
}
return _context.getRequestDispatcher(path);
@ -1754,47 +1754,37 @@ public class Request implements HttpServletRequest
*/
public void setMetaData(org.eclipse.jetty.http.MetaData.Request request)
{
_metaData=request;
_metaData = request;
setMethod(request.getMethod());
HttpURI uri = request.getURI();
_originalURI=uri.isAbsolute()&&request.getHttpVersion()!=HttpVersion.HTTP_2?uri.toString():uri.getPathQuery();
_originalURI = uri.isAbsolute()&&request.getHttpVersion()!=HttpVersion.HTTP_2?uri.toString():uri.getPathQuery();
String path = uri.getDecodedPath();
String info;
if (path==null || path.length()==0)
String encoded = uri.getPath();
String path;
if (encoded==null)
{
if (uri.isAbsolute())
{
path="/";
uri.setPath(path);
}
else
{
setPathInfo("");
throw new BadMessageException(400,"Bad URI");
}
info=path;
path = uri.isAbsolute()?"/":null;
}
else if (!path.startsWith("/"))
else if (encoded.startsWith("/"))
{
if (!"*".equals(path) && !HttpMethod.CONNECT.is(getMethod()))
{
setPathInfo(path);
throw new BadMessageException(400,"Bad URI");
}
info=path;
path = (encoded.length()==1)?"/":URIUtil.canonicalPath(URIUtil.decodePath(encoded));
}
else if ("*".equals(encoded) || HttpMethod.CONNECT.is(getMethod()))
{
path = encoded;
}
else
info = URIUtil.canonicalPath(path);// TODO should this be done prior to decoding???
if (info == null)
{
setPathInfo(path);
throw new BadMessageException(400,"Bad URI");
path = null;
}
setPathInfo(info);
if (path==null || path.isEmpty())
{
setPathInfo(encoded==null?"":encoded);
throw new BadMessageException(400,"Bad URI");
}
setPathInfo(path);
}
/* ------------------------------------------------------------ */

14
jetty-server/src/main/java/org/eclipse/jetty/server/ResourceService.java
View File

@ -20,8 +20,6 @@ package org.eclipse.jetty.server;
import static java.util.Arrays.stream;
import static java.util.Collections.emptyList;
import static org.eclipse.jetty.http.CompressedContentFormat.BR;
import static org.eclipse.jetty.http.CompressedContentFormat.GZIP;
import static org.eclipse.jetty.http.HttpHeaderValue.IDENTITY;
import java.io.FileNotFoundException;
@ -416,11 +414,13 @@ public class ResourceService
{
// Redirect to the index
response.setContentLength(0);
String uri = URIUtil.encodePath(URIUtil.addPaths(request.getContextPath(),welcome));
String q=request.getQueryString();
if (q!=null&&q.length()!=0)
response.sendRedirect(response.encodeRedirectURL(URIUtil.addPaths(request.getContextPath(),welcome)+"?"+q));
else
response.sendRedirect(response.encodeRedirectURL(URIUtil.addPaths(request.getContextPath(),welcome)));
if (q!=null&&!q.isEmpty())
uri+="?"+q;
response.sendRedirect(response.encodeRedirectURL(uri));
}
return;
}
@ -614,7 +614,7 @@ public class ResourceService
}
byte[] data=null;
String base = URIUtil.addPaths(request.getRequestURI(),URIUtil.SLASH);
String base = URIUtil.addEncodedPaths(request.getRequestURI(),URIUtil.SLASH);
String dir = resource.getListHTML(base,pathInContext.length()>1);
if (dir==null)
{

4
jetty-server/src/main/java/org/eclipse/jetty/server/Response.java
View File

@ -698,14 +698,14 @@ public class Response implements HttpServletResponse
if (location.startsWith("/"))
{
// absolute in context
location=URIUtil.canonicalPath(location);
location=URIUtil.canonicalEncodedPath(location);
}
else
{
// relative to request
String path=_channel.getRequest().getRequestURI();
String parent=(path.endsWith("/"))?path:URIUtil.parentPath(path);
location=URIUtil.canonicalPath(URIUtil.addPaths(parent,location));
location=URIUtil.canonicalEncodedPath(URIUtil.addEncodedPaths(parent,location));
if (!location.startsWith("/"))
buf.append('/');
}

2
jetty-server/src/main/java/org/eclipse/jetty/server/Server.java
View File

@ -593,7 +593,7 @@ public class Server extends HandlerWrapper implements Attributes
// this is a dispatch with a path
ServletContext context=event.getServletContext();
String query=baseRequest.getQueryString();
baseRequest.setURIPathQuery(URIUtil.addPaths(context==null?null:URIUtil.encodePath(context.getContextPath()), path));
baseRequest.setURIPathQuery(URIUtil.addEncodedPaths(context==null?null:URIUtil.encodePath(context.getContextPath()), path));
HttpURI uri = baseRequest.getHttpURI();
baseRequest.setPathInfo(uri.getDecodedPath());
if (uri.getQuery()!=null)

4
jetty-server/src/main/java/org/eclipse/jetty/server/handler/ContextHandler.java
View File

@ -1043,9 +1043,9 @@ public class ContextHandler extends ScopedHandler implements Attributes, Gracefu
// context request must end with /
baseRequest.setHandled(true);
if (baseRequest.getQueryString() != null)
response.sendRedirect(URIUtil.addPaths(baseRequest.getRequestURI(),URIUtil.SLASH) + "?" + baseRequest.getQueryString());
response.sendRedirect(baseRequest.getRequestURI() + "/?" + baseRequest.getQueryString());
else
response.sendRedirect(URIUtil.addPaths(baseRequest.getRequestURI(),URIUtil.SLASH));
response.sendRedirect(baseRequest.getRequestURI() + "/");
return false;
}

1
jetty-server/src/test/java/org/eclipse/jetty/server/HttpConnectionTest.java
View File

@ -372,6 +372,7 @@ public class HttpConnectionTest
@Test
public void testChunkNoTrailer() throws Exception
{
// Expect TimeoutException logged
String response=connector.getResponse("GET /R1 HTTP/1.1\r\n"+
"Host: localhost\r\n"+
"Transfer-Encoding: chunked\r\n"+

2
jetty-servlet/src/main/java/org/eclipse/jetty/servlet/DefaultServlet.java
View File

@ -509,7 +509,7 @@ public class DefaultServlet extends HttpServlet implements ResourceFactory, Welc
String welcome_in_context=URIUtil.addPaths(pathInContext,_welcomes[i]);
Resource welcome=getResource(welcome_in_context);
if (welcome!=null && welcome.exists())
return _welcomes[i];
return welcome_in_context;
if ((_welcomeServlets || _welcomeExactServlets) && welcome_servlet==null)
{

93
jetty-servlet/src/test/java/org/eclipse/jetty/servlet/DefaultServletTest.java
View File

@ -259,7 +259,7 @@ public class DefaultServletTest
defholder.setInitParameter("resourceBase", resBasePath);
String response;
response = connector.getResponse("GET /context/ HTTP/1.0\r\n\r\n");
assertResponseContains("<h1>Hello Index</h1>", response);
@ -326,11 +326,13 @@ public class DefaultServletTest
testdir.ensureEmpty();
File resBase = testdir.getPathFile("docroot").toFile();
FS.ensureDirExists(resBase);
File inde = new File(resBase, "index.htm");
File index = new File(resBase, "index.html");
File dir = new File(resBase, "dir");
assertTrue(dir.mkdirs());
File inde = new File(dir, "index.htm");
File index = new File(dir, "index.html");
String resBasePath = resBase.getAbsolutePath();
ServletHolder defholder = context.addServlet(DefaultServlet.class, "/");
defholder.setInitParameter("dirAllowed", "false");
defholder.setInitParameter("redirectWelcome", "false");
@ -344,25 +346,98 @@ public class DefaultServletTest
@SuppressWarnings("unused")
ServletHolder jspholder = context.addServlet(NoJspServlet.class, "*.jsp");
String response = connector.getResponse("GET /context/ HTTP/1.0\r\n\r\n");
String response = connector.getResponse("GET /context/dir/ HTTP/1.0\r\n\r\n");
assertResponseContains("403", response);
createFile(index, "<h1>Hello Index</h1>");
response = connector.getResponse("GET /context/ HTTP/1.0\r\n\r\n");
response = connector.getResponse("GET /context/dir/ HTTP/1.0\r\n\r\n");
assertResponseContains("<h1>Hello Index</h1>", response);
createFile(inde, "<h1>Hello Inde</h1>");
response = connector.getResponse("GET /context/ HTTP/1.0\r\n\r\n");
response = connector.getResponse("GET /context/dir/ HTTP/1.0\r\n\r\n");
assertResponseContains("<h1>Hello Index</h1>", response);
assertTrue(index.delete());
response = connector.getResponse("GET /context/ HTTP/1.0\r\n\r\n");
response = connector.getResponse("GET /context/dir/ HTTP/1.0\r\n\r\n");
assertResponseContains("<h1>Hello Inde</h1>", response);
assertTrue(inde.delete());
response = connector.getResponse("GET /context/ HTTP/1.0\r\n\r\n");
response = connector.getResponse("GET /context/dir/ HTTP/1.0\r\n\r\n");
assertResponseContains("403", response);
}
@Test
public void testWelcomeRedirect() throws Exception
{
testdir.ensureEmpty();
File resBase = testdir.getPathFile("docroot").toFile();
FS.ensureDirExists(resBase);
File dir = new File(resBase, "dir");
assertTrue(dir.mkdirs());
File inde = new File(dir, "index.htm");
File index = new File(dir, "index.html");
String resBasePath = resBase.getAbsolutePath();
ServletHolder defholder = context.addServlet(DefaultServlet.class, "/");
defholder.setInitParameter("dirAllowed", "false");
defholder.setInitParameter("redirectWelcome", "true");
defholder.setInitParameter("welcomeServlets", "false");
defholder.setInitParameter("gzip", "false");
defholder.setInitParameter("resourceBase", resBasePath);
defholder.setInitParameter("maxCacheSize", "1024000");
defholder.setInitParameter("maxCachedFileSize", "512000");
defholder.setInitParameter("maxCachedFiles", "100");
@SuppressWarnings("unused")
ServletHolder jspholder = context.addServlet(NoJspServlet.class, "*.jsp");
String response = connector.getResponses("GET /context/dir/ HTTP/1.0\r\n\r\n");
assertResponseContains("403", response);
createFile(index, "<h1>Hello Index</h1>");
response = connector.getResponses("GET /context/dir/ HTTP/1.0\r\n\r\n");
assertResponseContains("Location: http://0.0.0.0/context/dir/index.html", response);
createFile(inde, "<h1>Hello Inde</h1>");
response = connector.getResponses("GET /context/dir/ HTTP/1.0\r\n\r\n");
assertResponseContains("Location: http://0.0.0.0/context/dir/index.html", response);
assertTrue(index.delete());
response = connector.getResponses("GET /context/dir/ HTTP/1.0\r\n\r\n");
assertResponseContains("Location: http://0.0.0.0/context/dir/index.htm", response);
assertTrue(inde.delete());
response = connector.getResponses("GET /context/dir/ HTTP/1.0\r\n\r\n");
assertResponseContains("403", response);
}
@Test
public void testWelcomeDirWithQuestion() throws Exception
{
testdir.ensureEmpty();
File resBase = testdir.getPathFile("docroot").toFile();
FS.ensureDirExists(resBase);
context.setBaseResource(Resource.newResource(resBase));
File dir = new File(resBase, "dir?");
assertTrue(dir.mkdirs());
File index = new File(dir, "index.html");
createFile(index, "<h1>Hello Index</h1>");
ServletHolder defholder = context.addServlet(DefaultServlet.class, "/");
defholder.setInitParameter("dirAllowed", "false");
defholder.setInitParameter("redirectWelcome", "true");
defholder.setInitParameter("welcomeServlets", "false");
defholder.setInitParameter("gzip", "false");
String response = connector.getResponse("GET /context/dir%3F HTTP/1.0\r\n\r\n");
assertResponseContains("Location: http://0.0.0.0/context/dir%3F/", response);
response = connector.getResponse("GET /context/dir%3F/ HTTP/1.0\r\n\r\n");
assertResponseContains("Location: http://0.0.0.0/context/dir%3F/index.html", response);
}
@Test
public void testWelcomeServlet() throws Exception

4
jetty-servlets/src/main/java/org/eclipse/jetty/servlets/PutFilter.java
View File

@ -295,7 +295,7 @@ public class PutFilter implements Filter
public void handleMove(HttpServletRequest request, HttpServletResponse response, String pathInContext, File file)
throws ServletException, IOException, URISyntaxException
{
String newPath = URIUtil.canonicalPath(request.getHeader("new-uri"));
String newPath = URIUtil.canonicalEncodedPath(request.getHeader("new-uri"));
if (newPath == null)
{
response.sendError(HttpServletResponse.SC_BAD_REQUEST);
@ -312,7 +312,7 @@ public class PutFilter implements Filter
if (contextPath != null)
newInfo = newInfo.substring(contextPath.length());
String new_resource = URIUtil.addPaths(_baseURI,newInfo);
String new_resource = URIUtil.addEncodedPaths(_baseURI,newInfo);
File new_file=new File(new URI(new_resource));
file.renameTo(new_file);

181
jetty-util/src/main/java/org/eclipse/jetty/util/URIUtil.java
View File

@ -473,14 +473,14 @@ public class URIUtil
/* ------------------------------------------------------------ */
/** Add two URI path segments.
* Handles null and empty paths, path and query params (eg ?a=b or
* ;JSESSIONID=xxx) and avoids duplicate '/'
/** Add two encoded URI path segments.
* Handles null and empty paths, path and query params
* (eg ?a=b or ;JSESSIONID=xxx) and avoids duplicate '/'
* @param p1 URI path segment (should be encoded)
* @param p2 URI path segment (should be encoded)
* @return Legally combined path segments.
*/
public static String addPaths(String p1, String p2)
public static String addEncodedPaths(String p1, String p2)
{
if (p1==null || p1.length()==0)
{
@ -525,6 +525,54 @@ public class URIUtil
return buf.toString();
}
/* ------------------------------------------------------------ */
/** Add two Decoded URI path segments.
* Handles null and empty paths. Path and query params (eg ?a=b or
* ;JSESSIONID=xxx) are not handled
* @param p1 URI path segment (should be decoded)
* @param p2 URI path segment (should be decoded)
* @return Legally combined path segments.
*/
public static String addPaths(String p1, String p2)
{
if (p1==null || p1.length()==0)
{
if (p1!=null && p2==null)
return p1;
return p2;
}
if (p2==null || p2.length()==0)
return p1;
boolean p1EndsWithSlash = p1.endsWith(SLASH);
boolean p2StartsWithSlash = p2.startsWith(SLASH);
if (p1EndsWithSlash && p2StartsWithSlash)
{
if (p2.length()==1)
return p1;
if (p1.length()==1)
return p2;
}
StringBuilder buf = new StringBuilder(p1.length()+p2.length()+2);
buf.append(p1);
if (p1.endsWith(SLASH))
{
if (p2.startsWith(SLASH))
buf.setLength(buf.length()-1);
}
else
{
if (!p2.startsWith(SLASH))
buf.append(SLASH);
}
buf.append(p2);
return buf.toString();
}
/* ------------------------------------------------------------ */
/** Return the parent Path.
@ -542,6 +590,117 @@ public class URIUtil
return null;
}
/* ------------------------------------------------------------ */
/**
* Convert a decoded path to a canonical form.
* <p>
* All instances of "." and ".." are factored out.
* </p>
* <p>
* Null is returned if the path tries to .. above its root.
* </p>
* @param path the path to convert, decoded, with path separators '/' and no queries.
* @return the canonical path, or null if path traversal above root.
*/
public static String canonicalPath(String path)
{
if (path == null || path.isEmpty())
return path;
boolean slash = true;
int end = path.length();
int i = 0;
loop:
while (i<end)
{
char c = path.charAt(i);
switch(c)
{
case '/':
slash = true;
break;
case '.':
if (slash)
break loop;
slash = false;
break;
default:
slash = false;
}
i++;
}
if(i==end)
return path;
StringBuilder canonical = new StringBuilder(path.length());
canonical.append(path,0,i);
int dots = 1;
i++;
while (i<=end)
{
char c = i<end?path.charAt(i):'\0';
switch(c)
{
case '\0':
case '/':
switch(dots)
{
case 0:
if (c!='\0')
canonical.append(c);
break;
case 1:
break;
case 2:
if (canonical.length()<2)
return null;
canonical.setLength(canonical.length()-1);
canonical.setLength(canonical.lastIndexOf("/")+1);
break;
default:
while (dots-->0)
canonical.append('.');
if (c!='\0')
canonical.append(c);
}
slash = true;
dots = 0;
break;
case '.':
if (dots>0)
dots++;
else if (slash)
dots = 1;
else
canonical.append('.');
slash = false;
break;
default:
while (dots-->0)
canonical.append('.');
canonical.append(c);
dots = 0;
slash = false;
}
i++;
}
return canonical.toString();
}
/* ------------------------------------------------------------ */
/**
* Convert a path to a cananonical form.
@ -551,10 +710,10 @@ public class URIUtil
* <p>
* Null is returned if the path tries to .. above its root.
* </p>
* @param path the path to convert (expects URI/URL form, decoded, and with path separators '/')
* @param path the path to convert (expects URI/URL form, encoded, and with path separators '/')
* @return the canonical path, or null if path traversal above root.
*/
public static String canonicalPath(String path)
public static String canonicalEncodedPath(String path)
{
if (path == null || path.isEmpty())
return path;
@ -659,6 +818,8 @@ public class URIUtil
return canonical.toString();
}
/* ------------------------------------------------------------ */
/** Convert a path to a compact form.
* All instances of "//" and "///" etc. are factored out to single "/"
@ -899,7 +1060,12 @@ public class URIUtil
return equalsIgnoreEncodings(uriA.getPath(),uriB.getPath());
}
public static URI addDecodedPath(URI uri, String path)
/**
* @param uri A URI to add the path to
* @param path A decoded path element
* @return URI with path added.
*/
public static URI addPath(URI uri, String path)
{
String base = uri.toASCIIString();
StringBuilder buf = new StringBuilder(base.length()+path.length()*3);
@ -907,7 +1073,6 @@ public class URIUtil
if (buf.charAt(base.length()-1)!='/')
buf.append('/');
byte[] bytes=null;
int offset=path.charAt(0)=='/'?1:0;
encodePath(buf,path,offset);

2
jetty-util/src/main/java/org/eclipse/jetty/util/resource/FileResource.java
View File

@ -169,7 +169,7 @@ public class FileResource extends Resource
if (base.isDirectory())
{
// treat all paths being added as relative
uri=new URI(URIUtil.addPaths(base.toURI().toASCIIString(),encoded));
uri=new URI(URIUtil.addEncodedPaths(base.toURI().toASCIIString(),encoded));
}
else
{

2
jetty-util/src/main/java/org/eclipse/jetty/util/resource/PathResource.java
View File

@ -213,7 +213,7 @@ public class PathResource extends Resource
this.path = parent.path.getFileSystem().getPath(parent.path.toString(), childPath);
if (isDirectory() &&!childPath.endsWith("/"))
childPath+="/";
this.uri = URIUtil.addDecodedPath(parent.uri,childPath);
this.uri = URIUtil.addPath(parent.uri,childPath);
this.alias = checkAliasPath();
}

4
jetty-util/src/main/java/org/eclipse/jetty/util/resource/Resource.java
View File

@ -565,7 +565,7 @@ public abstract class Resource implements ResourceFactory, Closeable
if (parent)
{
buf.append("<TR><TD><A HREF=\"");
buf.append(URIUtil.addPaths(base,"../"));
buf.append(URIUtil.addEncodedPaths(base,"../"));
buf.append("\">Parent Directory</A></TD><TD></TD><TD></TD></TR>\n");
}
@ -578,7 +578,7 @@ public abstract class Resource implements ResourceFactory, Closeable
Resource item = addPath(ls[i]);
buf.append("\n<TR><TD><A HREF=\"");
String path=URIUtil.addPaths(encodedBase,URIUtil.encodePath(ls[i]));
String path=URIUtil.addEncodedPaths(encodedBase,URIUtil.encodePath(ls[i]));
buf.append(path);

2
jetty-util/src/main/java/org/eclipse/jetty/util/resource/URLResource.java
View File

@ -303,7 +303,7 @@ public class URLResource extends Resource
path = URIUtil.canonicalPath(path);
return newResource(URIUtil.addPaths(_url.toExternalForm(),URIUtil.encodePath(path)), _useCaches);
return newResource(URIUtil.addEncodedPaths(_url.toExternalForm(),URIUtil.encodePath(path)), _useCaches);
}
/* ------------------------------------------------------------ */

181
jetty-util/src/test/java/org/eclipse/jetty/util/URIUtilCanonicalPathTest.java
View File

@ -19,9 +19,7 @@
package org.eclipse.jetty.util;
import static org.hamcrest.CoreMatchers.is;
import static org.hamcrest.CoreMatchers.nullValue;
import static org.junit.Assert.assertThat;
import static org.junit.Assume.assumeFalse;
import java.util.Arrays;
import java.util.List;
@ -37,88 +35,88 @@ public class URIUtilCanonicalPathTest
public static List<String[]> data()
{
String[][] canonical =
{
// Basic examples (no changes expected)
{"/hello.html", "/hello.html"},
{"/css/main.css", "/css/main.css"},
{"/", "/"},
{"", ""},
{"/aaa/bbb/", "/aaa/bbb/"},
{"/aaa/bbb", "/aaa/bbb"},
{"aaa/bbb", "aaa/bbb"},
{"aaa/", "aaa/"},
{"aaa", "aaa"},
{"a", "a"},
{"a/", "a/"},
// Extra slashes
{"/aaa//bbb/", "/aaa//bbb/"},
{"/aaa//bbb", "/aaa//bbb"},
{"/aaa///bbb/", "/aaa///bbb/"},
// Path traversal with current references "./"
{"/aaa/./bbb/", "/aaa/bbb/"},
{"/aaa/./bbb", "/aaa/bbb"},
{"./bbb/", "bbb/"},
{"./aaa/../bbb/", "bbb/"},
{"/foo/.", "/foo/"},
{"./", ""},
{".", ""},
{".//", "/"},
{".///", "//"},
{"/.", "/"},
{"//.", "//"},
{"///.", "///"},
// Path traversal directory (but not past root)
{"/aaa/../bbb/", "/bbb/"},
{"/aaa/../bbb", "/bbb"},
{"/aaa..bbb/", "/aaa..bbb/"},
{"/aaa..bbb", "/aaa..bbb"},
{"/aaa/..bbb/", "/aaa/..bbb/"},
{"/aaa/..bbb", "/aaa/..bbb"},
{"/aaa/./../bbb/", "/bbb/"},
{"/aaa/./../bbb", "/bbb"},
{"/aaa/bbb/ccc/../../ddd/", "/aaa/ddd/"},
{"/aaa/bbb/ccc/../../ddd", "/aaa/ddd"},
{"/foo/../bar//", "/bar//"},
{"/ctx/../bar/../ctx/all/index.txt", "/ctx/all/index.txt"},
{"/down/.././index.html", "/index.html"},
// Path traversal up past root
{"..", null},
{"./..", null},
{"aaa/../..", null},
{"/foo/bar/../../..", null},
{"/../foo", null},
{"a/.", "a/"},
{"a/..", ""},
{"a/../..", null},
{"/foo/../../bar", null},
// Query parameter specifics
{"/ctx/dir?/../index.html", "/ctx/dir?/../index.html"},
{"/get-files?file=/etc/passwd", "/get-files?file=/etc/passwd"},
{"/get-files?file=../../../../../passwd", "/get-files?file=../../../../../passwd"},
// Known windows shell quirks
{"file.txt ", "file.txt "}, // with spaces
{"file.txt...", "file.txt..."}, // extra dots ignored by windows
// BREAKS Jenkins: {"file.txt\u0000", "file.txt\u0000"}, // null terminated is ignored by windows
{"file.txt\r", "file.txt\r"}, // CR terminated is ignored by windows
{"file.txt\n", "file.txt\n"}, // LF terminated is ignored by windows
{"file.txt\"\"\"\"", "file.txt\"\"\"\""}, // extra quotes ignored by windows
{"file.txt<<<>>><", "file.txt<<<>>><"}, // angle brackets at end of path ignored by windows
{"././././././file.txt", "file.txt"},
// Oddball requests that look like path traversal, but are not
{"/....", "/...."},
{"/..../ctx/..../blah/logo.jpg", "/..../ctx/..../blah/logo.jpg"},
// paths with encoded segments should remain encoded
// canonicalPath() is not responsible for decoding characters
{"%2e%2e/", "%2e%2e/"},
};
{
// Basic examples (no changes expected)
{"/hello.html", "/hello.html"},
{"/css/main.css", "/css/main.css"},
{"/", "/"},
{"", ""},
{"/aaa/bbb/", "/aaa/bbb/"},
{"/aaa/bbb", "/aaa/bbb"},
{"aaa/bbb", "aaa/bbb"},
{"aaa/", "aaa/"},
{"aaa", "aaa"},
{"a", "a"},
{"a/", "a/"},
// Extra slashes
{"/aaa//bbb/", "/aaa//bbb/"},
{"/aaa//bbb", "/aaa//bbb"},
{"/aaa///bbb/", "/aaa///bbb/"},
// Path traversal with current references "./"
{"/aaa/./bbb/", "/aaa/bbb/"},
{"/aaa/./bbb", "/aaa/bbb"},
{"./bbb/", "bbb/"},
{"./aaa/../bbb/", "bbb/"},
{"/foo/.", "/foo/"},
{"./", ""},
{".", ""},
{".//", "/"},
{".///", "//"},
{"/.", "/"},
{"//.", "//"},
{"///.", "///"},
// Path traversal directory (but not past root)
{"/aaa/../bbb/", "/bbb/"},
{"/aaa/../bbb", "/bbb"},
{"/aaa..bbb/", "/aaa..bbb/"},
{"/aaa..bbb", "/aaa..bbb"},
{"/aaa/..bbb/", "/aaa/..bbb/"},
{"/aaa/..bbb", "/aaa/..bbb"},
{"/aaa/./../bbb/", "/bbb/"},
{"/aaa/./../bbb", "/bbb"},
{"/aaa/bbb/ccc/../../ddd/", "/aaa/ddd/"},
{"/aaa/bbb/ccc/../../ddd", "/aaa/ddd"},
{"/foo/../bar//", "/bar//"},
{"/ctx/../bar/../ctx/all/index.txt", "/ctx/all/index.txt"},
{"/down/.././index.html", "/index.html"},
// Path traversal up past root
{"..", null},
{"./..", null},
{"aaa/../..", null},
{"/foo/bar/../../..", null},
{"/../foo", null},
{"a/.", "a/"},
{"a/..", ""},
{"a/../..", null},
{"/foo/../../bar", null},
// Query parameter specifics
{"/ctx/dir?/../index.html", "/ctx/index.html"},
{"/get-files?file=/etc/passwd", "/get-files?file=/etc/passwd"},
{"/get-files?file=../../../../../passwd", null},
// Known windows shell quirks
{"file.txt ", "file.txt "}, // with spaces
{"file.txt...", "file.txt..."}, // extra dots ignored by windows
// BREAKS Jenkins: {"file.txt\u0000", "file.txt\u0000"}, // null terminated is ignored by windows
{"file.txt\r", "file.txt\r"}, // CR terminated is ignored by windows
{"file.txt\n", "file.txt\n"}, // LF terminated is ignored by windows
{"file.txt\"\"\"\"", "file.txt\"\"\"\""}, // extra quotes ignored by windows
{"file.txt<<<>>><", "file.txt<<<>>><"}, // angle brackets at end of path ignored by windows
{"././././././file.txt", "file.txt"},
// Oddball requests that look like path traversal, but are not
{"/....", "/...."},
{"/..../ctx/..../blah/logo.jpg", "/..../ctx/..../blah/logo.jpg"},
// paths with encoded segments should remain encoded
// canonicalPath() is not responsible for decoding characters
{"%2e%2e/", "%2e%2e/"},
};
return Arrays.asList(canonical);
}
@ -134,19 +132,4 @@ public class URIUtilCanonicalPathTest
assertThat("Canonical", URIUtil.canonicalPath(input), is(expectedResult));
}
@Test
public void testCanonicalPathWithQuery()
{
// Skip this variation if the actual test contains a query already
assumeFalse(input.contains("?"));
if (expectedResult == null)
{
assertThat("Canonical with Query", URIUtil.canonicalPath(input + "?a=1"), nullValue());
}
else
{
assertThat("Canonical", URIUtil.canonicalPath(input + "?a=1"), is(expectedResult + "?a=1"));
}
}
}

145
jetty-util/src/test/java/org/eclipse/jetty/util/URIUtilTest.java
View File

@ -90,7 +90,96 @@ public class URIUtilTest
/* ------------------------------------------------------------ */
@Test
public void testAddPaths()
public void testAddEncodedPaths()
{
assertEquals("null+null", URIUtil.addEncodedPaths(null,null),null);
assertEquals("null+", URIUtil.addEncodedPaths(null,""),"");
assertEquals("null+bbb", URIUtil.addEncodedPaths(null,"bbb"),"bbb");
assertEquals("null+/", URIUtil.addEncodedPaths(null,"/"),"/");
assertEquals("null+/bbb", URIUtil.addEncodedPaths(null,"/bbb"),"/bbb");
assertEquals("+null", URIUtil.addEncodedPaths("",null),"");
assertEquals("+", URIUtil.addEncodedPaths("",""),"");
assertEquals("+bbb", URIUtil.addEncodedPaths("","bbb"),"bbb");
assertEquals("+/", URIUtil.addEncodedPaths("","/"),"/");
assertEquals("+/bbb", URIUtil.addEncodedPaths("","/bbb"),"/bbb");
assertEquals("aaa+null", URIUtil.addEncodedPaths("aaa",null),"aaa");
assertEquals("aaa+", URIUtil.addEncodedPaths("aaa",""),"aaa");
assertEquals("aaa+bbb", URIUtil.addEncodedPaths("aaa","bbb"),"aaa/bbb");
assertEquals("aaa+/", URIUtil.addEncodedPaths("aaa","/"),"aaa/");
assertEquals("aaa+/bbb", URIUtil.addEncodedPaths("aaa","/bbb"),"aaa/bbb");
assertEquals("/+null", URIUtil.addEncodedPaths("/",null),"/");
assertEquals("/+", URIUtil.addEncodedPaths("/",""),"/");
assertEquals("/+bbb", URIUtil.addEncodedPaths("/","bbb"),"/bbb");
assertEquals("/+/", URIUtil.addEncodedPaths("/","/"),"/");
assertEquals("/+/bbb", URIUtil.addEncodedPaths("/","/bbb"),"/bbb");
assertEquals("aaa/+null", URIUtil.addEncodedPaths("aaa/",null),"aaa/");
assertEquals("aaa/+", URIUtil.addEncodedPaths("aaa/",""),"aaa/");
assertEquals("aaa/+bbb", URIUtil.addEncodedPaths("aaa/","bbb"),"aaa/bbb");
assertEquals("aaa/+/", URIUtil.addEncodedPaths("aaa/","/"),"aaa/");
assertEquals("aaa/+/bbb", URIUtil.addEncodedPaths("aaa/","/bbb"),"aaa/bbb");
assertEquals(";JS+null", URIUtil.addEncodedPaths(";JS",null),";JS");
assertEquals(";JS+", URIUtil.addEncodedPaths(";JS",""),";JS");
assertEquals(";JS+bbb", URIUtil.addEncodedPaths(";JS","bbb"),"bbb;JS");
assertEquals(";JS+/", URIUtil.addEncodedPaths(";JS","/"),"/;JS");
assertEquals(";JS+/bbb", URIUtil.addEncodedPaths(";JS","/bbb"),"/bbb;JS");
assertEquals("aaa;JS+null", URIUtil.addEncodedPaths("aaa;JS",null),"aaa;JS");
assertEquals("aaa;JS+", URIUtil.addEncodedPaths("aaa;JS",""),"aaa;JS");
assertEquals("aaa;JS+bbb", URIUtil.addEncodedPaths("aaa;JS","bbb"),"aaa/bbb;JS");
assertEquals("aaa;JS+/", URIUtil.addEncodedPaths("aaa;JS","/"),"aaa/;JS");
assertEquals("aaa;JS+/bbb", URIUtil.addEncodedPaths("aaa;JS","/bbb"),"aaa/bbb;JS");
assertEquals("aaa;JS+null", URIUtil.addEncodedPaths("aaa/;JS",null),"aaa/;JS");
assertEquals("aaa;JS+", URIUtil.addEncodedPaths("aaa/;JS",""),"aaa/;JS");
assertEquals("aaa;JS+bbb", URIUtil.addEncodedPaths("aaa/;JS","bbb"),"aaa/bbb;JS");
assertEquals("aaa;JS+/", URIUtil.addEncodedPaths("aaa/;JS","/"),"aaa/;JS");
assertEquals("aaa;JS+/bbb", URIUtil.addEncodedPaths("aaa/;JS","/bbb"),"aaa/bbb;JS");
assertEquals("?A=1+null", URIUtil.addEncodedPaths("?A=1",null),"?A=1");
assertEquals("?A=1+", URIUtil.addEncodedPaths("?A=1",""),"?A=1");
assertEquals("?A=1+bbb", URIUtil.addEncodedPaths("?A=1","bbb"),"bbb?A=1");
assertEquals("?A=1+/", URIUtil.addEncodedPaths("?A=1","/"),"/?A=1");
assertEquals("?A=1+/bbb", URIUtil.addEncodedPaths("?A=1","/bbb"),"/bbb?A=1");
assertEquals("aaa?A=1+null", URIUtil.addEncodedPaths("aaa?A=1",null),"aaa?A=1");
assertEquals("aaa?A=1+", URIUtil.addEncodedPaths("aaa?A=1",""),"aaa?A=1");
assertEquals("aaa?A=1+bbb", URIUtil.addEncodedPaths("aaa?A=1","bbb"),"aaa/bbb?A=1");
assertEquals("aaa?A=1+/", URIUtil.addEncodedPaths("aaa?A=1","/"),"aaa/?A=1");
assertEquals("aaa?A=1+/bbb", URIUtil.addEncodedPaths("aaa?A=1","/bbb"),"aaa/bbb?A=1");
assertEquals("aaa?A=1+null", URIUtil.addEncodedPaths("aaa/?A=1",null),"aaa/?A=1");
assertEquals("aaa?A=1+", URIUtil.addEncodedPaths("aaa/?A=1",""),"aaa/?A=1");
assertEquals("aaa?A=1+bbb", URIUtil.addEncodedPaths("aaa/?A=1","bbb"),"aaa/bbb?A=1");
assertEquals("aaa?A=1+/", URIUtil.addEncodedPaths("aaa/?A=1","/"),"aaa/?A=1");
assertEquals("aaa?A=1+/bbb", URIUtil.addEncodedPaths("aaa/?A=1","/bbb"),"aaa/bbb?A=1");
assertEquals(";JS?A=1+null", URIUtil.addEncodedPaths(";JS?A=1",null),";JS?A=1");
assertEquals(";JS?A=1+", URIUtil.addEncodedPaths(";JS?A=1",""),";JS?A=1");
assertEquals(";JS?A=1+bbb", URIUtil.addEncodedPaths(";JS?A=1","bbb"),"bbb;JS?A=1");
assertEquals(";JS?A=1+/", URIUtil.addEncodedPaths(";JS?A=1","/"),"/;JS?A=1");
assertEquals(";JS?A=1+/bbb", URIUtil.addEncodedPaths(";JS?A=1","/bbb"),"/bbb;JS?A=1");
assertEquals("aaa;JS?A=1+null", URIUtil.addEncodedPaths("aaa;JS?A=1",null),"aaa;JS?A=1");
assertEquals("aaa;JS?A=1+", URIUtil.addEncodedPaths("aaa;JS?A=1",""),"aaa;JS?A=1");
assertEquals("aaa;JS?A=1+bbb", URIUtil.addEncodedPaths("aaa;JS?A=1","bbb"),"aaa/bbb;JS?A=1");
assertEquals("aaa;JS?A=1+/", URIUtil.addEncodedPaths("aaa;JS?A=1","/"),"aaa/;JS?A=1");
assertEquals("aaa;JS?A=1+/bbb", URIUtil.addEncodedPaths("aaa;JS?A=1","/bbb"),"aaa/bbb;JS?A=1");
assertEquals("aaa;JS?A=1+null", URIUtil.addEncodedPaths("aaa/;JS?A=1",null),"aaa/;JS?A=1");
assertEquals("aaa;JS?A=1+", URIUtil.addEncodedPaths("aaa/;JS?A=1",""),"aaa/;JS?A=1");
assertEquals("aaa;JS?A=1+bbb", URIUtil.addEncodedPaths("aaa/;JS?A=1","bbb"),"aaa/bbb;JS?A=1");
assertEquals("aaa;JS?A=1+/", URIUtil.addEncodedPaths("aaa/;JS?A=1","/"),"aaa/;JS?A=1");
assertEquals("aaa;JS?A=1+/bbb", URIUtil.addEncodedPaths("aaa/;JS?A=1","/bbb"),"aaa/bbb;JS?A=1");
}
/* ------------------------------------------------------------ */
@Test
public void testAddDecodedPaths()
{
assertEquals("null+null", URIUtil.addPaths(null,null),null);
assertEquals("null+", URIUtil.addPaths(null,""),"");
@ -124,57 +213,39 @@ public class URIUtilTest
assertEquals(";JS+null", URIUtil.addPaths(";JS",null),";JS");
assertEquals(";JS+", URIUtil.addPaths(";JS",""),";JS");
assertEquals(";JS+bbb", URIUtil.addPaths(";JS","bbb"),"bbb;JS");
assertEquals(";JS+/", URIUtil.addPaths(";JS","/"),"/;JS");
assertEquals(";JS+/bbb", URIUtil.addPaths(";JS","/bbb"),"/bbb;JS");
assertEquals(";JS+bbb", URIUtil.addPaths(";JS","bbb"),";JS/bbb");
assertEquals(";JS+/", URIUtil.addPaths(";JS","/"),";JS/");
assertEquals(";JS+/bbb", URIUtil.addPaths(";JS","/bbb"),";JS/bbb");
assertEquals("aaa;JS+null", URIUtil.addPaths("aaa;JS",null),"aaa;JS");
assertEquals("aaa;JS+", URIUtil.addPaths("aaa;JS",""),"aaa;JS");
assertEquals("aaa;JS+bbb", URIUtil.addPaths("aaa;JS","bbb"),"aaa/bbb;JS");
assertEquals("aaa;JS+/", URIUtil.addPaths("aaa;JS","/"),"aaa/;JS");
assertEquals("aaa;JS+/bbb", URIUtil.addPaths("aaa;JS","/bbb"),"aaa/bbb;JS");
assertEquals("aaa;JS+bbb", URIUtil.addPaths("aaa;JS","bbb"),"aaa;JS/bbb");
assertEquals("aaa;JS+/", URIUtil.addPaths("aaa;JS","/"),"aaa;JS/");
assertEquals("aaa;JS+/bbb", URIUtil.addPaths("aaa;JS","/bbb"),"aaa;JS/bbb");
assertEquals("aaa;JS+null", URIUtil.addPaths("aaa/;JS",null),"aaa/;JS");
assertEquals("aaa;JS+", URIUtil.addPaths("aaa/;JS",""),"aaa/;JS");
assertEquals("aaa;JS+bbb", URIUtil.addPaths("aaa/;JS","bbb"),"aaa/bbb;JS");
assertEquals("aaa;JS+/", URIUtil.addPaths("aaa/;JS","/"),"aaa/;JS");
assertEquals("aaa;JS+/bbb", URIUtil.addPaths("aaa/;JS","/bbb"),"aaa/bbb;JS");
assertEquals("aaa;JS+bbb", URIUtil.addPaths("aaa/;JS","bbb"),"aaa/;JS/bbb");
assertEquals("aaa;JS+/", URIUtil.addPaths("aaa/;JS","/"),"aaa/;JS/");
assertEquals("aaa;JS+/bbb", URIUtil.addPaths("aaa/;JS","/bbb"),"aaa/;JS/bbb");
assertEquals("?A=1+null", URIUtil.addPaths("?A=1",null),"?A=1");
assertEquals("?A=1+", URIUtil.addPaths("?A=1",""),"?A=1");
assertEquals("?A=1+bbb", URIUtil.addPaths("?A=1","bbb"),"bbb?A=1");
assertEquals("?A=1+/", URIUtil.addPaths("?A=1","/"),"/?A=1");
assertEquals("?A=1+/bbb", URIUtil.addPaths("?A=1","/bbb"),"/bbb?A=1");
assertEquals("?A=1+bbb", URIUtil.addPaths("?A=1","bbb"),"?A=1/bbb");
assertEquals("?A=1+/", URIUtil.addPaths("?A=1","/"),"?A=1/");
assertEquals("?A=1+/bbb", URIUtil.addPaths("?A=1","/bbb"),"?A=1/bbb");
assertEquals("aaa?A=1+null", URIUtil.addPaths("aaa?A=1",null),"aaa?A=1");
assertEquals("aaa?A=1+", URIUtil.addPaths("aaa?A=1",""),"aaa?A=1");
assertEquals("aaa?A=1+bbb", URIUtil.addPaths("aaa?A=1","bbb"),"aaa/bbb?A=1");
assertEquals("aaa?A=1+/", URIUtil.addPaths("aaa?A=1","/"),"aaa/?A=1");
assertEquals("aaa?A=1+/bbb", URIUtil.addPaths("aaa?A=1","/bbb"),"aaa/bbb?A=1");
assertEquals("aaa?A=1+bbb", URIUtil.addPaths("aaa?A=1","bbb"),"aaa?A=1/bbb");
assertEquals("aaa?A=1+/", URIUtil.addPaths("aaa?A=1","/"),"aaa?A=1/");
assertEquals("aaa?A=1+/bbb", URIUtil.addPaths("aaa?A=1","/bbb"),"aaa?A=1/bbb");
assertEquals("aaa?A=1+null", URIUtil.addPaths("aaa/?A=1",null),"aaa/?A=1");
assertEquals("aaa?A=1+", URIUtil.addPaths("aaa/?A=1",""),"aaa/?A=1");
assertEquals("aaa?A=1+bbb", URIUtil.addPaths("aaa/?A=1","bbb"),"aaa/bbb?A=1");
assertEquals("aaa?A=1+/", URIUtil.addPaths("aaa/?A=1","/"),"aaa/?A=1");
assertEquals("aaa?A=1+/bbb", URIUtil.addPaths("aaa/?A=1","/bbb"),"aaa/bbb?A=1");
assertEquals(";JS?A=1+null", URIUtil.addPaths(";JS?A=1",null),";JS?A=1");
assertEquals(";JS?A=1+", URIUtil.addPaths(";JS?A=1",""),";JS?A=1");
assertEquals(";JS?A=1+bbb", URIUtil.addPaths(";JS?A=1","bbb"),"bbb;JS?A=1");
assertEquals(";JS?A=1+/", URIUtil.addPaths(";JS?A=1","/"),"/;JS?A=1");
assertEquals(";JS?A=1+/bbb", URIUtil.addPaths(";JS?A=1","/bbb"),"/bbb;JS?A=1");
assertEquals("aaa;JS?A=1+null", URIUtil.addPaths("aaa;JS?A=1",null),"aaa;JS?A=1");
assertEquals("aaa;JS?A=1+", URIUtil.addPaths("aaa;JS?A=1",""),"aaa;JS?A=1");
assertEquals("aaa;JS?A=1+bbb", URIUtil.addPaths("aaa;JS?A=1","bbb"),"aaa/bbb;JS?A=1");
assertEquals("aaa;JS?A=1+/", URIUtil.addPaths("aaa;JS?A=1","/"),"aaa/;JS?A=1");
assertEquals("aaa;JS?A=1+/bbb", URIUtil.addPaths("aaa;JS?A=1","/bbb"),"aaa/bbb;JS?A=1");
assertEquals("aaa;JS?A=1+null", URIUtil.addPaths("aaa/;JS?A=1",null),"aaa/;JS?A=1");
assertEquals("aaa;JS?A=1+", URIUtil.addPaths("aaa/;JS?A=1",""),"aaa/;JS?A=1");
assertEquals("aaa;JS?A=1+bbb", URIUtil.addPaths("aaa/;JS?A=1","bbb"),"aaa/bbb;JS?A=1");
assertEquals("aaa;JS?A=1+/", URIUtil.addPaths("aaa/;JS?A=1","/"),"aaa/;JS?A=1");
assertEquals("aaa;JS?A=1+/bbb", URIUtil.addPaths("aaa/;JS?A=1","/bbb"),"aaa/bbb;JS?A=1");
assertEquals("aaa?A=1+bbb", URIUtil.addPaths("aaa/?A=1","bbb"),"aaa/?A=1/bbb");
assertEquals("aaa?A=1+/", URIUtil.addPaths("aaa/?A=1","/"),"aaa/?A=1/");
assertEquals("aaa?A=1+/bbb", URIUtil.addPaths("aaa/?A=1","/bbb"),"aaa/?A=1/bbb");
}