[jboss-jira] [JBoss JIRA] Commented: (JBAS-4085) failing org.jboss.test.web.test.WebIntegrationUnitTestCase
[ http://jira.jboss.com/jira/browse/JBAS-4085?page=comments#action_12353880 ]
Brian Stansberry commented on JBAS-4085:
----------------------------------------
Based on following e-mail discussion w/ Remy, I'm going to change these tests to
assert a 400 rather than a 403:
Brian Stansberry wrote:
I suspect the test below is failing due to a change in Tomcat, where
TC may be correct and the test just needs an update.
Test does this:
GET of http://localhost:8080/jbosstest//restricted3//SecureServlet
which fails with a 403, as the test expects.
Then it does a GET of http://localhost:8080/jbosstest/%2frestricted3//SecureServlet
(replace a / with %2f) and TC responds with a 400 -- Bad Request. Test fails because it
expects a 403.
Is http://localhost:8080/jbosstest/%2frestricted3//SecureServlet an invalid request? If
so, the 400 is fine, and the test just needs to be updated. The purpose of the test is to
ensure that tricks with the URL don't allow unauthorized access
(http://jira.jboss.com/jira/browse/JBAS-3279).
There are new security constraints by default for the path portion of URLs:
- no %xx encoded '/'
- no '\', %xx encoded or not
(obviously, this sort of cute tricks are highly suspicious from a security standpoint)
The reason for that change is because proxies may or may not normalize the URL the way
Tomcat does, and may be incorrectly passing requests to Tomcat (there's a minor
security advisory about that coming). There are two new system properties which may be
used to allow this stuff:
- "org.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH" to
"true"
- "org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH" to "true"
Rémy
failing org.jboss.test.web.test.WebIntegrationUnitTestCase
----------------------------------------------------------
Key: JBAS-4085
URL: http://jira.jboss.com/jira/browse/JBAS-4085
Project: JBoss Application Server
Issue Type: Sub-task
Security Level: Public(Everyone can see)
Components: Test Suite, Web (Tomcat) service
Reporter: Scott M Stark
Assigned To: Brian Stansberry
<testcase classname="org.jboss.test.web.test.WebIntegrationUnitTestCase"
name="testBadWarRedeploy" time="1.093">
<error message="Expected reply code:200, actual=503"
type="java.io.IOException">java.io.IOException: Expected reply code:200,
actual=503
at org.jboss.test.util.web.HttpUtils.accessURL(HttpUtils.java:137)
at org.jboss.test.util.web.HttpUtils.accessURL(HttpUtils.java:108)
at org.jboss.test.util.web.HttpUtils.accessURL(HttpUtils.java:96)
at
org.jboss.test.web.test.WebIntegrationUnitTestCase.testBadWarRedeploy(WebIntegrationUnitTestCase.java:373)
at
jrockit.reflect.VirtualNativeMethodInvoker.invoke(Ljava.lang.Object;[Ljava.lang.Object;)Ljava.lang.Object;(Unknown
Source)
at junit.extensions.TestDecorator.basicRun(TestDecorator.java:22)
at junit.extensions.TestSetup$1.protect(TestSetup.java:19)
at junit.extensions.TestSetup.run(TestSetup.java:23)
</error>
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira