8272758: Improve HttpServer to avoid partial file name matches while mapping request path to context path

[vy]

Currently HttpServer allows matching a request path /foobar to context path /foo. Replace this surprising behaviour with a safer approach by requiring exact path prefix matches.

         |           Request path
 Context +------+-------+----------+---------
  path   | /foo | /foo/ | /foo/bar | /foobar
---------+------+-------+----------+---------
 /       |   Y  |   Y   |     Y    |    Y
 /foo    |   Y  |   Y   |     Y    |    N
 /foo/   |   N  |   Y   |     Y    |    N

---

Progress

• Change must be properly reviewed (1 review required, with at least 1 Reviewer)
• Change must not contain extraneous whitespace
• Commit message must refer to an issue
• Change requires CSR request JDK-8377174 to be approved

Issues

• JDK-8272758: Improve HttpServer to avoid partial file name matches while mapping request path to context path (Bug - P4)
• JDK-8377174: Improve HttpServer to avoid partial file name matches while mapping request path to context path (CSR)

Reviewers

• Daniel Fuchs (@dfuch - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/29264/head:pull/29264
$ git checkout pull/29264

Update a local copy of the PR:
$ git checkout pull/29264
$ git pull https://git.openjdk.org/jdk.git pull/29264/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 29264

View PR using the GUI difftool:
$ git pr show -t 29264

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/29264.diff

Using Webrev

Link to Webrev Comment

[bridgekeeper]

👋 Welcome back vyazici! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

@vy This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8272758: Improve HttpServer to avoid partial file name matches while mapping request path to context path

Reviewed-by: dfuchs

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 40 new commits pushed to the master branch:

• a20a1ac: 8378119: GenShen: Restore log message about characteristics of promotion efforts
• 6777985: 8378191: [BACKOUT] JDK-8378076 Improve inlining around oop_oop_iterate
• d02ac57: 8377983: (zipfs) ZipFileSystem.initCEN needlessly reads END header
• ... and 37 more: https://git.openjdk.org/jdk/compare/ef0851d8adbb834e1cd5aff5b3b973b953e57e2d...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

[openjdk]

@vy Unknown command foo - for a list of valid commands use /help.

[openjdk]

@vy The following label will be automatically applied to this pull request:

• net

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

[mlbridge]

Webrevs

• 06: Full - Incremental (ed44cf3e)
• 05: Full - Incremental (7116aa2f)
• 04: Full - Incremental (24fca745)
• 03: Full - Incremental (03cab635)
• 02: Full - Incremental (e55e6050)
• 01: Full - Incremental (e80aabcb)
• 00: Full (f44d4b35)

[vy]

/csr

[openjdk]

@vy has indicated that a compatibility and specification (CSR) request is needed for this pull request.

@vy please create a CSR request for issue JDK-8272758 with the correct fix version. This pull request cannot be integrated until the CSR request is approved.

[vy]

@Michael-Mc-Mahon, @dfuch, in e80aabc, I've added the sun.net.httpserver.pathMatcher property to switch between path-prefix and string-prefix matching schemes. See the following screenshots showcasing relevant parts:

Module Summary page

HttpServer page

[dfuch]

I wonder if we will be asked to change the name of the property in the CSR review. We typically do not use the sun. prefix for new properties.

[vy]

I wonder if we will be asked to change the name of the property in the CSR review. We typically do not use the sun. prefix for new properties.

I see. I was not aware of this convention for new properties. I presume we will iron that out in the CSR review.

[dfuch]

The latest changes LGTM.

[vy]

@dfuch, @Michael-Mc-Mahon, thanks so much for your patience and kind assistance. Using ed44cf3, I've verified that the HTML-rendered API specification (using make docs) looks good and Tier 1-2 is clear.

/integrate

[openjdk]

Going to push as commit bea48b5.
Since your change was applied there have been 45 commits pushed to the master branch:

• 759fe58: 8376186: [VectorAPI] Nomenclature change for concrete vector classes
• 33c9f20: 8377712: ConstantPool of WeakReferenceKey is not deterministic in CDS archive
• 7d2b6ed: 8378149: [s390] Non-C2 / minimal JVM crashes in the build
• ... and 42 more: https://git.openjdk.org/jdk/compare/ef0851d8adbb834e1cd5aff5b3b973b953e57e2d...master

Your commit was automatically rebased without conflicts.

[openjdk]

@vy Pushed as commit bea48b5.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.