From 7abb1e62f2a881ada5cf0dfa30ee6930f813e8ae Mon Sep 17 00:00:00 2001 From: Lachlan Roberts Date: Tue, 30 Nov 2021 16:51:58 +1100 Subject: [PATCH] Issue #7160- Add AMBIGUOUS_PATH_ENCODING to default UriCompliance mode. Signed-off-by: Lachlan Roberts --- .../main/java/org/eclipse/jetty/http/UriCompliance.java | 4 +++- .../test/java/org/eclipse/jetty/server/RequestTest.java | 7 ++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/jetty-http/src/main/java/org/eclipse/jetty/http/UriCompliance.java b/jetty-http/src/main/java/org/eclipse/jetty/http/UriCompliance.java index 76cb2ee5749..904b119a533 100644 --- a/jetty-http/src/main/java/org/eclipse/jetty/http/UriCompliance.java +++ b/jetty-http/src/main/java/org/eclipse/jetty/http/UriCompliance.java @@ -104,7 +104,9 @@ public final class UriCompliance implements ComplianceViolation.Mode * additional violations to avoid most ambiguous URIs. * This mode does allow {@link Violation#AMBIGUOUS_PATH_SEPARATOR}, but disallows all out {@link Violation}s. */ - public static final UriCompliance DEFAULT = new UriCompliance("DEFAULT", of(Violation.AMBIGUOUS_PATH_SEPARATOR)); + public static final UriCompliance DEFAULT = new UriCompliance("DEFAULT", + of(Violation.AMBIGUOUS_PATH_SEPARATOR, + Violation.AMBIGUOUS_PATH_ENCODING)); /** * LEGACY compliance mode that models Jetty-9.4 behavior by allowing {@link Violation#AMBIGUOUS_PATH_SEGMENT}, diff --git a/jetty-server/src/test/java/org/eclipse/jetty/server/RequestTest.java b/jetty-server/src/test/java/org/eclipse/jetty/server/RequestTest.java index f2b0ac124ea..0a4af46e424 100644 --- a/jetty-server/src/test/java/org/eclipse/jetty/server/RequestTest.java +++ b/jetty-server/src/test/java/org/eclipse/jetty/server/RequestTest.java @@ -1812,13 +1812,18 @@ public class RequestTest "Host: whatever\r\n" + "\r\n"; _connector.getBean(HttpConnectionFactory.class).getHttpConfiguration().setUriCompliance(UriCompliance.DEFAULT); - assertThat(_connector.getResponse(request), startsWith("HTTP/1.1 400")); + assertThat(_connector.getResponse(request), startsWith("HTTP/1.1 200")); _connector.getBean(HttpConnectionFactory.class).getHttpConfiguration().setUriCompliance(UriCompliance.LEGACY); assertThat(_connector.getResponse(request), startsWith("HTTP/1.1 200")); _connector.getBean(HttpConnectionFactory.class).getHttpConfiguration().setUriCompliance(UriCompliance.RFC3986); assertThat(_connector.getResponse(request), startsWith("HTTP/1.1 200")); _connector.getBean(HttpConnectionFactory.class).getHttpConfiguration().setUriCompliance(UriCompliance.UNSAFE); assertThat(_connector.getResponse(request), startsWith("HTTP/1.1 200")); + + UriCompliance custom = new UriCompliance("Custom", EnumSet.complementOf( + EnumSet.of(UriCompliance.Violation.AMBIGUOUS_PATH_ENCODING))); + _connector.getBean(HttpConnectionFactory.class).getHttpConfiguration().setUriCompliance(custom); + assertThat(_connector.getResponse(request), startsWith("HTTP/1.1 400")); } @Test