dev@jersey.java.net

Re: reducing double slash to a single slash (//->/) in http servlet request path info ? bug or feature ?

From: Paul Sandoz <Paul.Sandoz_at_Sun.COM>
Date: Tue, 31 Jul 2007 12:17:37 +0200

Jakub Podlesak wrote:
> On Mon, Jul 30, 2007 at 02:41:17PM +0200, Paul Sandoz wrote:
>>> Attaching a patch for the "URI in URI case", but I think
>>> it is not the right way to go.
>>>
>> Hmm... not sure. We need to make this independent of the container and
>> my gut feeling is the ensureStringIsPartOfURI is a bit of a hack.
>
> +1, it is a hack, but without such a hack an exception is thrown.
> I am going to file a bug report for getPathInfo method.
>

OK,

Oh! i got very confused and mixed up URI.normalize() with getPathInfo(),
and the former does as expected, sorry!

Perhaps we could work around this by utilizing the getRequestURI(),
getContextPath() and getServletPath() instead of using a regex on
erroneous information?

My understand is that for servlet the complete URI path (requestURI) is
composed of three parts:

    requestURI = contextPath + servletPath + pathInfo
  (baseURIPath = contextPath + servletPath)

We should ensure that we are always working consistently in URI path
decoded or encoded space and not mix the two.

The workaround mixes the encoded and decoded URI spaces because
getPathInfo() returns a decoded path and it is matched against the
string of the URI. (Actually the same issue is with
HttpRequestContextImpl.getBaseURI so we need to fix this as well).


>>
>> 1) Change isRedirectToNormalizedURI to be isRedirectToCanonicalURI
>> and clearly specify this as being URI normalization + changing '/+'
>> to '/'; and
>>
>> 2) Specify an APT processing option to switch redirection off.
>>
>> it might make sense to split 1 into two options: normalization; and
>> normalization with '/+' -> '/'.
>
> +1 for having the 2 options.

Yes, especially given my confusion over normalize.


> Can you give me some guidance,
> how to implement?
> (I see isRedirectToNormalizedURI is hardcoded in ResourceConfigImpl
> in ContainerFactory).
>

ResourceConfig is an iface. Impls of this class are generated from the
APT processor (e.g. search in a build example and also search for uses
of ResourceConfig).

The one you found is for the case where the ContainerFactory methods
pass in a set of classes and therefore default values are required for
features.

IMHO i think we need to change things and modify the iface to return a
r/o feature bag:

public interface ResourceConfig {
     Set<Class> getResourceClasses();

     Map<String, Boolean> getFeatures();
}

then we need to add relevant options to the APT tool and modify it to
generate the correct ResourceConfig code and modify the runtime accordingly.

Paul.

> Thanks,
>
> ~Jakub
>
>
>> Paul.
>>
>>> ~Jakub
>>>
>>>> Paul.
>>>>
>>>> [1] http://gbiv.com/protocols/uri/rfc/rfc3986.html#relative-dot-segments
>>>>
>>>>> The following code:
>>>>> --cuthere--
>>>>> URI baseURI = new URI("http://host/path1//path2");
>>>>> System.out.println("baseURI.toString() = " + baseURI.toString());
>>>>> System.out.println("baseURI.normalize().toString() = " +
>>>>> baseURI.normalize().toString());
>>>>> --cuthere--
>>>>>
>>>>> Generates:
>>>>> --cuthere--
>>>>> baseURI.toString() = http://host/path1//path2
>>>>> baseURI.normalize().toString() = http://host/path1/path2
>>>>> --cuthere--
>>>>>
>>>>> ~Jakub
>>>>>
>>>>>
>>>>> On Thu, Jul 26, 2007 at 01:19:43PM -0400, Marc Hadley wrote:
>>>>>> According to RFC 3986[1], section 3.3 the : is allowed in a path
>>>>>> segment so there shouldn't be any reason to encode it. In addition I
>>>>>> don't see anything about removing double '/' characters so I think
>>>>>> that getPathInfo has a bug.
>>>>>>
>>>>>> Marc.
>>>>>>
>>>>>> [1] http://ietf.org/rfc/rfc3986.txt
>>>>>>
>>>>>> On Jul 25, 2007, at 9:03 AM, Jakub Podlesak wrote:
>>>>>>
>>>>>>> Hi all,
>>>>>>>
>>>>>>> I have tried following url:
>>>>>>>
>>>>>>> http://localhost:8080/Bookmark/resources/users/japod/bookmarks/
>>>>>>> ftp://any.net/file.txt
>>>>>>>
>>>>>>> and noticed, that corresponding HttpServletRequest (tested on
>>>>>>> glassfish) provides:
>>>>>>>
>>>>>>> getRequestURI() ->"/Bookmark/resources/users/japod/bookmarks/ftp://
>>>>>>> any.net/file.txt"
>>>>>>> getPathInfo()->"/users/japod/bookmarks/ftp:/any.net/file.txt"
>>>>>>> ^^^^^^^^
>>>>>>>
>>>>>>> Please note the missing slash in the latter (ftp:/any.net instead
>>>>>>> of ftp://any.net)
>>>>>>>
>>>>>>> Is this a bug or a feature?
>>>>>>>
>>>>>>> ~Jakub
>>>>>>>
>>>>>>>
>>>>>>> P.S. It causes an exception in [setURIs] method of
>>>>>>> [com.sun.ws.rest.impl.container.servlet.HttpRequestAdaptor]
>>>>>> ---
>>>>>> Marc Hadley <marc.hadley at sun.com>
>>>>>> CTO Office, Sun Microsystems.
>>>>>>
>>>>>>
>>>> --
>>>> | ? + ? = To question
>>>> ----------------\
>>>> Paul Sandoz
>>>> x38109
>>>> +33-4-76188109
>>>>
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail: dev-unsubscribe_at_jersey.dev.java.net
>>>> For additional commands, e-mail: dev-help_at_jersey.dev.java.net
>>>>
>>>>
>>>> ------------------------------------------------------------------------
>>>>
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail: dev-unsubscribe_at_jersey.dev.java.net
>>>> For additional commands, e-mail: dev-help_at_jersey.dev.java.net
>> --
>> | ? + ? = To question
>> ----------------\
>> Paul Sandoz
>> x38109
>> +33-4-76188109
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe_at_jersey.dev.java.net
>> For additional commands, e-mail: dev-help_at_jersey.dev.java.net
>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe_at_jersey.dev.java.net
> For additional commands, e-mail: dev-help_at_jersey.dev.java.net
>

-- 
| ? + ? = To question
----------------\
    Paul Sandoz
         x38109
+33-4-76188109