Author: remy.maucherat(a)jboss.com
Date: 2008-08-05 09:28:16 -0400 (Tue, 05 Aug 2008)
New Revision: 739
Modified:
branches/2.0.x/src/share/classes/org/apache/catalina/core/ApplicationContext.java
Log:
- CVE-2008-2370: Request dispatcher query string.
Modified:
branches/2.0.x/src/share/classes/org/apache/catalina/core/ApplicationContext.java
===================================================================
---
branches/2.0.x/src/share/classes/org/apache/catalina/core/ApplicationContext.java 2008-08-05
13:24:00 UTC (rev 738)
+++
branches/2.0.x/src/share/classes/org/apache/catalina/core/ApplicationContext.java 2008-08-05
13:28:16 UTC (rev 739)
@@ -368,10 +368,21 @@
throw new IllegalArgumentException
(sm.getString
("applicationContext.requestDispatcher.iae", path));
+
+ // Get query string
+ String queryString = null;
+ int pos = path.indexOf('?');
+ if (pos >= 0) {
+ queryString = path.substring(pos + 1);
+ path = path.substring(0, pos);
+ }
+
path = normalize(path);
if (path == null)
return (null);
+ pos = path.length();
+
// Use the thread local URI and mapping data
DispatchData dd = dispatchData.get();
if (dd == null) {
@@ -381,15 +392,6 @@
MessageBytes uriMB = dd.uriMB;
uriMB.recycle();
-
- // Get query string
- String queryString = null;
- int pos = path.indexOf('?');
- if (pos >= 0) {
- queryString = path.substring(pos + 1);
- } else {
- pos = path.length();
- }
// Use the thread local mapping data
MappingData mappingData = dd.mappingData;
Show replies by date