[jbossweb-commits] JBossWeb SVN: r731 - branches/JBOSSWEB_2_0_0_GA_CP/src/share/classes/org/apache/catalina/connector.
Author: jfrederic.clere(a)jboss.com
Date: 2008-07-25 12:29:30 -0400 (Fri, 25 Jul 2008)
New Revision: 731
Modified:
branches/JBOSSWEB_2_0_0_GA_CP/src/share/classes/org/apache/catalina/connector/CoyoteAdapter.java
Log:
Add checkNormalize method to verify that the URI is still normalized after character
decoding.
Modified:
branches/JBOSSWEB_2_0_0_GA_CP/src/share/classes/org/apache/catalina/connector/CoyoteAdapter.java
===================================================================
---
branches/JBOSSWEB_2_0_0_GA_CP/src/share/classes/org/apache/catalina/connector/CoyoteAdapter.java 2008-07-25
16:26:00 UTC (rev 730)
+++
branches/JBOSSWEB_2_0_0_GA_CP/src/share/classes/org/apache/catalina/connector/CoyoteAdapter.java 2008-07-25
16:29:30 UTC (rev 731)
@@ -351,6 +351,12 @@
}
// Character decoding
convertURI(decodedURI, request);
+ // Check that the URI is still normalized
+ if (!checkNormalize(req.decodedURI())) {
+ res.setStatus(400);
+ res.setMessage("Invalid URI character encoding");
+ return false;
+ }
} else {
// The URL is chars or String, and has been sent using an in-memory
// protocol handler, we have to assume the URL has been properly
@@ -715,6 +721,67 @@
}
+ /**
+ * Check that the URI is normalized following character decoding.
+ * <p>
+ * This method checks for "\", "//", "/./" and
"/../". This method will
+ * return false if sequences that are supposed to be normalized still
+ * present in the URI.
+ *
+ * @param uriMB URI to be normalized
+ */
+ public static boolean checkNormalize(MessageBytes uriMB) {
+
+ CharChunk uriCC = uriMB.getCharChunk();
+ char[] c = uriCC.getChars();
+ int start = uriCC.getStart();
+ int end = uriCC.getEnd();
+
+ int pos = 0;
+
+ // Check for '\' and for null byte
+ for (pos = start; pos < end; pos++) {
+ if (c[pos] == '\\') {
+ return false;
+ }
+ if (c[pos] == 0) {
+ return false;
+ }
+ }
+
+ // Check for "//"
+ for (pos = start; pos < (end - 1); pos++) {
+ if (c[pos] == '/') {
+ if (c[pos + 1] == '/') {
+ return false;
+ }
+ }
+ }
+
+ // Check for URI ending with "/." or "/.."
+ if (((end - start) >= 2) && (c[end - 1] == '.')) {
+ if ((c[end - 2] == '/')
+ || ((c[end - 2] == '.')
+ && (c[end - 3] == '/'))) {
+ return false;
+ }
+ }
+
+ // Check for "/./"
+ if (uriCC.indexOf("/./", 0, 3, 0) >= 0) {
+ return false;
+ }
+
+ // Check for "/./"
+ if (uriCC.indexOf("/../", 0, 4, 0) >= 0) {
+ return false;
+ }
+
+ return true;
+
+ }
+
+
// ------------------------------------------------------ Protected Methods