[JBoss JIRA] Created: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[JBoss JIRA] Created: (JBAS-6130)...

[JBoss JIRA] Created: (JBREM-1061)...

Igor (JIRA)

Thursday, 18 September 2008 Thu, 18 Sep '08

4:39 p.m.

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public (Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR2, JBossAS-5.0.0.CR1 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor Assignee: Remy Maucherat Priority: Critical Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

Show replies by date

Igor (JIRA)

Thursday, 18 September Thu, 18 Sep

4:53 p.m.

New subject: [JBoss JIRA] Updated: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Igor updated JBAS-5976: ----------------------- Attachment: index.jsp web.xml Encoding test page from Tomcat FAQ and WEB-INF/web.xml descriptor with security options.

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

-- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

Igor (JIRA)

4:55 p.m.

New subject: [JBoss JIRA] Updated: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Igor updated JBAS-5976: ----------------------- Workaround Description: no workaround foud (was: no workaround find)

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

Remy Maucherat (JIRA)

5:33 p.m.

New subject: [JBoss JIRA] Resolved: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Remy Maucherat resolved JBAS-5976. ---------------------------------- Resolution: Rejected Generally it helps if the problem can be reproduced with the most current Tomcat 6.0. However, here, I would not bother, as your example is broken: setCharacterEncoding will not do anything for a GET in most configurations. It only applies to the entity body (none here, the parameters are on the query string).

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor A Tarasov Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

Igor A Tarasov (JIRA)

6:50 p.m.

New subject: [JBoss JIRA] Commented: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Igor A Tarasov commented on JBAS-5976: -------------------------------------- 1) Tomcat version included in JBoss 5.0.0.CR2 is known. Bug is not reproduced in clear Tomcat. 2) Right options used in server.xml Quote: "If you set the URIEncoding="UTF-8" on the connector, it will also work with method="GET" 3) No difference with GET and POST request - they both work without security and they both don't work if used security-constraint. No workaround can be applied to make it really work !!!

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor A Tarasov Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

Igor A Tarasov (JIRA)

6:52 p.m.

New subject: [JBoss JIRA] Reopened: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Igor A Tarasov reopened JBAS-5976: ---------------------------------- This bug is presented since JBoss 5.0.0.CR1 and not reproduced in any other environments.

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor A Tarasov Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

Igor A Tarasov (JIRA)

7:03 p.m.

New subject: [JBoss JIRA] Commented: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Igor A Tarasov commented on JBAS-5976: -------------------------------------- 5) This is not my example - it is taken from official Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) for testing GET and POST character encoding issues.

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor A Tarasov Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

Remy Maucherat (JIRA)

7:06 p.m.

New subject: [JBoss JIRA] Resolved: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Remy Maucherat resolved JBAS-5976. ---------------------------------- Resolution: Done Since you are using GET, with URIEncoding="UTF-8", your bug unfortunately does not make any sense at all, as the encoding is set way earlier (setCharacterEncoding is actually useless). Since you are writing conflicting statements, I will close this report again. Feel free to comment but please do not reopen the issue.

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor A Tarasov Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

Igor A Tarasov (JIRA)

7:17 p.m.

New subject: [JBoss JIRA] Commented: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Igor A Tarasov commented on JBAS-5976: -------------------------------------- Before I wrote: "3) No difference with GET and POST request - they both work without security and they both don't work if used security-constraint. " Please, read carefully :)

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor A Tarasov Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

Igor A Tarasov (JIRA)

7:19 p.m.

New subject: [JBoss JIRA] Commented: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Igor A Tarasov commented on JBAS-5976: -------------------------------------- Can anybody post international characters to form with secure web application on JBoss 5 CR2 ?

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor A Tarasov Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

Remy Maucherat (JIRA)

8:06 p.m.

New subject: [JBoss JIRA] Reopened: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Remy Maucherat reopened JBAS-5976: ----------------------------------

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor A Tarasov Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

Remy Maucherat (JIRA)

8:12 p.m.

New subject: [JBoss JIRA] Resolved: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Remy Maucherat resolved JBAS-5976. ---------------------------------- Resolution: Cannot Reproduce Bug Better resolution. I tried to reproduce it with a simple GET (http://127.0.0.1:8080/test.jsp?mydata=%E5%8F%B6) with URIEncoding="UTF-8" on the Connector (I am using GET) and BASIC protection (first access to the server, so it produces a 401). Your claim was that this scenario did not work. Unsurprisingly, both JBoss Web and AS CR 2 work as expected. If you insist this does not work, please post a ready to run WAR (really ready to run, including a jboss-web.xml which could use the admin user from the jmx-console realm), with the usage scenario and URL(s) that I should access (with expected result).

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor A Tarasov Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

Igor A Tarasov (JIRA)

Wednesday, 24 September Wed, 24 Sep

4:43 p.m.

New subject: [JBoss JIRA] Updated: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Igor A Tarasov updated JBAS-5976: --------------------------------- Attachment: test.war Attached test.war Test PASS in clean installation of Tomcat 6 Server version: Apache Tomcat/6.0.18 Server built: Jul 22 2008 02:00:36 Server number: 6.0.18.0 Test FAIL in clean installation of Jboss 5 RC2 Release ID: JBoss [Morpheus] 5.0.0.CR2 (build: SVNTag=JBoss_5_0_0_CR2 date=200809171139) Configuration requirement: 1) add URIEncofing="UTF-8" to <Connector> element in server.xml 2) configure security of server for user authentication in role 'test' (this role is described in web.xml of test.war) # For Tomcat add this to conf/tomcat-users.xml: <role rolename="test"/> <user username="test" password="test" roles="test"/> # For jboss use server/${name}/conf/roles.properties and users.properties for application-policy "other" in login-config.xml After authentication Jboss server corrupt posted data by converting non-ascii chars in UTF-8 to ISO-8859-1 Without authentication all work fine. It's impossible to use Jboss with authentication to post <FORM> data in non-ascii. Tomcat work fine in both case. You can simply say, that you have no time and are not interested in my report. I'm not interested to convince someone. I just point at a potential problem in your software and give enough detail information about it to make your software release better. You need only some minimal attention to reproduce it. Also this test pass in Jetty 6 and Resin 3.x servers.

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor A Tarasov Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, test.war, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

Remy Maucherat (JIRA)

4:57 p.m.

New subject: [JBoss JIRA] Commented: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Remy Maucherat commented on JBAS-5976: -------------------------------------- If you are reverting to using a POST, then "1) add URIEncofing="UTF-8" to <Connector> element in server.xml" does not do anything. I did give out the URL I tested with, which uses UTF-8 chars. So, I did look at it, and it looks to me like it is working. I won't spend more time on this until I get further reports or a support request. Thanks for your understanding.

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor A Tarasov Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, test.war, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

Igor A Tarasov (JIRA)

7:09 p.m.

New subject: [JBoss JIRA] Updated: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Igor A Tarasov updated JBAS-5976: --------------------------------- Attachment: scrshot.gif

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor A Tarasov Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, scrshot.gif, test.war, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

jimyip (JIRA)

Wednesday, 19 November Wed, 19 Nov

3:55 a.m.

New subject: [JBoss JIRA] Commented: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] jimyip commented on JBAS-5976: ------------------------------ Hi all, I also found the problem as stated by Igor. After several days work, it is the problem of JBoss SX layer which 'touch' ServletRequest.getParameterNames() (From "AbstractJavaEEHelper" and "WebResource.deriveUsefulInfo()") and caused the encoding set according to the OS before any character encoding filter can be applied. I use a wrapper Request to show the calling path. Below are the stacktrace: at my.tomcat.hack.RequestHack.getParameterNames(RequestHack.java:420) at org.jboss.security.authorization.resources.WebResource.deriveUsefulInfo(WebResource.java:152) at org.jboss.security.authorization.resources.WebResource.toString(WebResource.java:123) at org.jboss.security.javaee.AbstractJavaEEHelper.authorizationAudit(AbstractJavaEEHelper.java:100) at org.jboss.security.plugins.javaee.WebAuthorizationHelper.hasUserDataPermission(WebAuthorizationHelper.java:183) at org.jboss.web.tomcat.security.JBossWebRealm.hasUserDataPermission(JBossWebRealm.java:636) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:461) at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:91) at org.jboss.web.tomcat.security.SecurityContextEstablishmentValve.invoke(SecurityContextEstablishmentValve.java:92) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:157) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:325) at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:828) at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:601) at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447) at java.lang.Thread.run(Thread.java:595) I suggest to re-open this issue and it is a very serious bug to non-english users. Hope this help.

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor A Tarasov Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, scrshot.gif, test.war, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

Anil Saldhana (JIRA)

4:13 a.m.

New subject: [JBoss JIRA] Commented: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Anil Saldhana commented on JBAS-5976: ------------------------------------- Question is who sets the encoding after authentication. What should JBossSX do such that the encoding stays the same?

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor A Tarasov Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, scrshot.gif, test.war, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

Igor A Tarasov (JIRA)

9:14 a.m.

New subject: [JBoss JIRA] Commented: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Igor A Tarasov commented on JBAS-5976: -------------------------------------- Thanks jimyip, you stack trace confirms my opinion about accessing Request by server before user filters. So, please vote this bug to pay attention of developers. I think that it makes sense to reopen this bug again. (Тест - Test)

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor A Tarasov Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, scrshot.gif, test.war, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

Igor A Tarasov (JIRA)

9:18 a.m.

New subject: [JBoss JIRA] Commented: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Igor A Tarasov commented on JBAS-5976: -------------------------------------- As you can see at the end of my previous post, even this jira site work incorrectly with non-ASCII UTF8 chars too :) Instead of chars '?' there was russian UTF-8 chars :) Seems, that many developers use only ASCII chars and do not warry about peoples in other half of the World :)

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor A Tarasov Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, scrshot.gif, test.war, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

Anil Saldhana (JIRA)

9:20 a.m.

New subject: [JBoss JIRA] Commented: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Anil Saldhana commented on JBAS-5976: ------------------------------------- https://jira.jboss.org/jira/browse/JBAS-6213 Have u tested the form authenticator configuration in context.xml?

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor A Tarasov Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, scrshot.gif, test.war, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

Igor A Tarasov (JIRA)

9:22 a.m.

New subject: [JBoss JIRA] Reopened: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Igor A Tarasov reopened JBAS-5976: ---------------------------------- Predictably, this bug is confirmed by other users too.

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor A Tarasov Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, scrshot.gif, test.war, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

Remy Maucherat (JIRA)

9:30 a.m.

New subject: [JBoss JIRA] Resolved: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Remy Maucherat resolved JBAS-5976. ---------------------------------- Resolution: Duplicate Issue See JBAS-6213

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor A Tarasov Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, scrshot.gif, test.war, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

Igor A Tarasov (JIRA)

2:22 p.m.

New subject: [JBoss JIRA] Closed: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data

[ https://jira.jboss.org/jira/browse/JBAS-5976?page=com.atlassian.jira.plug... ] Igor A Tarasov closed JBAS-5976. -------------------------------- Reopened as JBAS-6213

...

Securing web-app cause incorrect character encoding in GET/POST data -------------------------------------------------------------------- Key: JBAS-5976 URL: https://jira.jboss.org/jira/browse/JBAS-5976 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Tomcat) service Affects Versions: JBossAS-5.0.0.CR1, JBossAS-5.0.0.CR2 Environment: Fedora Linux 10 JDK 1.6.0 Firefox 3.0.1 Reporter: Igor A Tarasov Assignee: Remy Maucherat Priority: Critical Attachments: index.jsp, scrshot.gif, test.war, web.xml Simple test page from Tomcat FAQ (http://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q4) work right in non-secure web-app. After apply BASIC web authentication, character encoding of posted data is broken. After authentication, request.setCharactEncoding("UTF-8") in request filter does no effect too. No matter which login module in use, org.jboss.security.auth.spi.UsersRolesLoginModule or my own login module. Seems that authentication cause access the Request object in app server _before_ it can be accessed in user request filter. After that, setting request.setCharacterEncoding not work. Insecure web-application work fine and non-ASCII characters appear correctly. This bug starts in CR-releases of JBoss 5.

6458

days inactive

6520

days old

jboss-jira@lists.jboss.org

Manage subscription

22 comments

5 participants

tags (0)

participants (5)

Anil Saldhana (JIRA)
Igor (JIRA)
Igor A Tarasov (JIRA)
jimyip (JIRA)
Remy Maucherat (JIRA)

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

[JBoss JIRA] Created: (JBAS-5976) Securing web-app cause incorrect character encoding in GET/POST data