Eclipse
/
jetty.project
mirror of https://github.com/jetty/jetty.project.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

decode the request uri and validate that

This commit is contained in:
Jesse McConnell 2012-11-29 11:23:16 -06:00
parent a5081abc55
commit 51bb01e14b
2 changed files with 21 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
jetty-rewrite/src/main/java/org/eclipse/jetty/rewrite/handler/ValidUrlRule.java
View File

@ -23,6 +23,8 @@ import java.io.IOException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.eclipse.jetty.util.URIUtil;
public class ValidUrlRule extends Rule
{
String _code = "400";
@ -60,11 +62,12 @@ public class ValidUrlRule extends Rule
@Override
public String matchAndApply(String target, HttpServletRequest request, HttpServletResponse response) throws IOException
{
String uri = request.getRequestURI();
// best to decide the request uri and validate that
String uri = URIUtil.decodePath(request.getRequestURI());
for (int i = 0; i < uri.length(); ++i)
{
if (!isPrintableChar(uri.charAt(i)))
if (!isValidChar(uri.charAt(i)))
{
int code = Integer.parseInt(_code);
@ -85,7 +88,7 @@ public class ValidUrlRule extends Rule
return null;
}
protected boolean isPrintableChar(char c)
protected boolean isValidChar(char c)
{
Character.UnicodeBlock block = Character.UnicodeBlock.of(c);

17
jetty-rewrite/src/test/java/org/eclipse/jetty/rewrite/handler/ValidUrlRuleTest.java
View File

@ -50,20 +50,31 @@ public class ValidUrlRuleTest extends AbstractRuleTestCase
public void testInvalidUrl() throws Exception
{
_rule.setCode("404");
_request.setRequestURI("/invalid\u000c/uri.html");
_request.setRequestURI("/invalid%0c/uri.html");
String result = _rule.matchAndApply(_request.getRequestURI(), _request, _response);
assertEquals(404,_response.getStatus());
}
@Test
public void testInvalidUrl2() throws Exception
{
_rule.setCode("404");
_request.setRequestURI("/%00/");
String result = _rule.matchAndApply(_request.getRequestURI(), _request, _response);
assertEquals(404,_response.getStatus());
}
@Test
public void testCharacters() throws Exception
{
// space
Assert.assertTrue( _rule.isPrintableChar("\u0020".charAt(0)));
Assert.assertTrue( _rule.isValidChar("\u0020".charAt(0)));
// form feed
Assert.assertFalse( _rule.isPrintableChar("\u000c".charAt(0)));
Assert.assertFalse( _rule.isValidChar("\u000c".charAt(0)));
}
}