]
Radoslav Husar edited comment on MODCLUSTER-285 at 7/31/15 5:42 AM:
--------------------------------------------------------------------
Note that this code (upstream Apache trunk) is still wrong and violates RFC. Imagine a
query string:
{noformat}/my.jsp;notJSESSIONID=wrong;JSESSIONID=correct{noformat}
this method would return "wrong" instead od "correct".
was (Author: rhusar):
Note that this code (upstream Apache trunk) is still wrong and violates RFC. Imagine a
query string:
{noformat}/my.jsp?notJSESSIONID=wrong;JSESSIONID=correct{noformat}
this method would return "wrong" instead od "correct".
get_path_param in mod_proxy_cluster doesn't expect ';' as
separator
-------------------------------------------------------------------
Key: MODCLUSTER-285
URL:
https://issues.jboss.org/browse/MODCLUSTER-285
Project: mod_cluster
Issue Type: Bug
Components: Native (httpd modules)
Affects Versions: 1.1.3.Final, 1.2.0.Final
Reporter: Stefano Nichele
Assignee: Radoslav Husar
Fix For: 1.3.2.Alpha1
Current version of get_path_param doesn't expect ';' as path parameters
separator so this urls are not correctly handled:
/test.jsp;jsessionid=123123.NODE01;name=vale
See for instance the mod_proxy_balancer implementation (in httpd 2.2.21):
{code}
/* Retrieve the parameter with the given name
* Something like 'JSESSIONID=12345...N'
*/
static char *get_path_param(apr_pool_t *pool, char *url,
const char *name, int scolon_sep)
{
char *path = NULL;
char *pathdelims = "?&";
if (scolon_sep) {
pathdelims = ";?&";
}
for (path = strstr(url, name); path; path = strstr(path + 1, name)) {
path += strlen(name);
if (*path == '=') {
/*
* Session path was found, get it's value
*/
++path;
if (strlen(path)) {
char *q;
path = apr_strtok(apr_pstrdup(pool, path), pathdelims, &q);
return path;
}
}
}
return NULL;
}
{code}
Severity of this bug to me is not so high since using more than one path parameters is
not so common.