Emit a warning when running on Tomcat without ALLOW_ENCODED_SLASH=true

[gitblit]

Originally reported on Google Code with ID 126

load this bundle into gitblit v1.1.0-SNAPSHOT , then browse to http://server/gitblit/blob/sandbox.git/6e509ff0e6fcc94de5d1fa1a4aed6fc39ecd75b7/bar%2Ftest.txt

Reported by jasonpyeron on 2012-08-30 17:58:52

---

- _Attachment: [sandbox.bundle](https://storage.googleapis.com/google-code-attachments/gitblit/issue-126/comment-0/sandbox.bundle)_

[gitblit]

You are likely running Gitblit on Tomcat OR are running Gitblit behind a proxy.

Set web.mountParameters = false
or web.forwardSlashCharacter = !

The demo, which sits behind a reverse proxy, must use ! as the folder delimiter because
the proxy re-encodes %2f back to / before passing the request to Gitblit.  This change
breaks Gitlbit url scheme.  Using ! or ~ will bypass the proxy's meddling.

example. https://demo-gitblit.rhcloud.com/tree/gitblit.git/1ab5b3081374c79867ceff2917bccae6dd1a2878/src!com!gitblit

Reported by James.Moger on 2012-08-30 19:46:39

[gitblit]

why does tomcat break it?

Reported by jasonpyeron on 2012-08-30 23:59:11

[gitblit]

the blob wicket page constructor is not even called, and if the %2f is placed as a /
then an exception for too many paramters is thrown as expected.

Reported by jasonpyeron on 2012-08-31 00:01:10

[gitblit]

Tomcat is openly hostile to %2F by default.  You have to explicitly allow Tomcat to
process %2F by passing a command line option to the JVM.  Running on Tomcat behind
a proxy will introduce two layers of trouble with %2F so even if you allow Tomcat to
process %2F, a proxy is equally likely to mangle urls too.

# Some servlet containers (e.g. Tomcat >= 6.0.10) disallow '/' (%2F) encoding
# in URLs as a security precaution for proxies. This setting tells Gitblit
# to preemptively replace '/' with '*' or '!' for url string parameters.
# 
# https://issues.apache.org/jira/browse/WICKET-1303
# http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.10
# Add -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true to your
# CATALINA_OPTS or to your JVM launch parameters
# 
# SINCE 0.5.2
web.forwardSlashCharacter = /

Reported by James.Moger on 2012-08-31 01:06:46

[gitblit]

going to make patch to emit warning on gitblit startup if tomcat based and invalid condition
exists.

I cannot change the summary of this issue to:

GitBlit does not emit a warning when the environment is not properly setup to process
paths.

Reported by jasonpyeron on 2012-08-31 01:23:40

[gitblit]

also change to enhancement

Reported by jasonpyeron on 2012-08-31 01:33:52

[gitblit]

Reported by James.Moger on 2012-08-31 01:36:48

• Labels added: Type-Enhancement
• Labels removed: Type-Defect

[gitblit]

2 questions:

1: what url should the warning message point to?
2: com.gitblit.GitBlit#configureContext(IStoredSettings settings, boolean startFederation)
now calls logCVE_2007_0450(). Do you want that code in GitBlit.java or should it go
in com.bitblit.utils?

Reported by jasonpyeron on 2012-08-31 14:08:24

[gitblit]

It's fine in GitBlit.java.

I would point to the Apache url and I would output the instruction about "add -D...".

Reported by James.Moger on 2012-08-31 14:22:04

[gitblit]

you would not point to the FAQ (http://gitblit.com/faq.html) for gitblit?

Reported by jasonpyeron on 2012-08-31 15:17:29