Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Return 400 status for invalid URI #25291

Closed
pmd1nh opened this issue May 17, 2023 · 0 comments · Fixed by #25295
Closed

Return 400 status for invalid URI #25291

pmd1nh opened this issue May 17, 2023 · 0 comments · Fixed by #25295
Assignees
Labels
in:Web Components release bug This bug is present in a released version of Open Liberty release:23009 team:Sirius

Comments

@pmd1nh
Copy link
Member

pmd1nh commented May 17, 2023

Describe the bug
com.ibm.ws.webcontainer.set400SCOnTooManyParentDirs="true" does not have an effect. Default value is false.
Also need a shortname for it in Liberty

Steps to Reproduce
When a request URI has too many traverse path characters (i.e /contextRoot/../../../../../index.jsp ), the request is rejected with a 500 status code. It should have rejected with a 400 (Bad Request).

Expected behavior
After set com.ibm.ws.webcontainer.set400SCOnTooManyParentDirs="true", request with too many path traversal character (i.e /../../ ) should be returned with 400 Bad Request.

Diagnostic information:

  • OpenLiberty Version: [23.0.0.7 and below]
  • Affected feature(s) [servlet-5.0 and below]

Additional context
Note: Servlet-6.0+ returns 400 Bad Request without any additional property.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in:Web Components release bug This bug is present in a released version of Open Liberty release:23009 team:Sirius
Projects
Archived in project
Web Tier Team
  
Completed Tasks
Development

Successfully merging a pull request may close this issue.

3 participants