Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

lookupPath for Request not getting normalized path leading to HTTP Status 404 – Not Found for relative path forward requests [SPR-17354] #21888

Closed
spring-issuemaster opened this issue Oct 9, 2018 · 6 comments
Assignees

Comments

@spring-issuemaster
Copy link
Collaborator

@spring-issuemaster spring-issuemaster commented Oct 9, 2018

manish9396 opened SPR-17354 and commented

Tomcat upgraded behavior to return non-normalized requestURI in ApplicationDispatcher. apache/tomcat80@21f57c2#diff-8b91a9296e19012bf6be4bdf975fab0dR499

Spring relies on request.getRequestURI() for lookupPath which is used to find matching servlet. https://github.com/spring-projects/spring-framework/blob/v4.3.16.RELEASE/spring-web/src/main/java/org/springframework/web/util/UrlPathHelper.java#L232

As a result of this, after upgrading to the latest tomcat, v8.0.45 and above, v8.5.16 and above, forwarding to relative paths leads to 404 not found, error being reported as,

 

o.s.web.servlet.PageNotFound No mapping found for HTTP request with URI [/context/asdf/../asdf/zxcv] in DispatcherServlet with name 'DispatcherServlet'

 


Affects: 4.3.16

Attachments:

@spring-issuemaster
Copy link
Collaborator Author

@spring-issuemaster spring-issuemaster commented Oct 9, 2018

Juergen Hoeller commented

Brian Clozel, could you have a look at this one please? Seems we need to explicitly normalize the path ourselves there...

@spring-issuemaster
Copy link
Collaborator Author

@spring-issuemaster spring-issuemaster commented Oct 10, 2018

Brian Clozel commented

manish9396 Could you provide a sample application that shows the issue? I can't seem to reproduce properly the problem.

I've created a Spring Boot application (version 1.5.16) on start.spring.io with the Web and Thymeleaf starters. I've also added the following controller:

@Controller
public class TestController {

	@GetMapping("/")
	public String index() {
		return "index";
	}

	@GetMapping("/test")
	public String test() {
		return "forward:/something/../other";
	}

	@GetMapping("/other")
	public String other() {
		return "other";
	}
}

Browsing http://localhost:8080/test does show the other.html view, as expected. The tomcat version is 8.5.34.

I'm probably missing something here, could you help me reproduce this issue?

@spring-issuemaster
Copy link
Collaborator Author

@spring-issuemaster spring-issuemaster commented Oct 11, 2018

manish9396 commented

Brian Clozel Even I faced problem while trying to reproduce it as the request was not going to the desired point https://github.com/spring-projects/spring-framework/blob/master/spring-webmvc/src/main/java/org/springframework/web/servlet/handler/AbstractUrlHandlerMapping.java#L122

I debugged with my actual system.

Right now I'm engaged in some other project. I'll give a sample application to reproduce this by the end of next week. Is that okay?

@spring-issuemaster
Copy link
Collaborator Author

@spring-issuemaster spring-issuemaster commented Oct 22, 2018

manish9396 commented

Brian ClozelI'm attaching a sample application which can be used to reproduce the bug. 
The tar file also has two images as test results, one using Tomcat-8.0.43 (path resolved) and other using Tomcat-8.0.53 (path not resolved)

[^RelativePathBug.tar.gz]

@spring-issuemaster
Copy link
Collaborator Author

@spring-issuemaster spring-issuemaster commented Oct 22, 2018

Brian Clozel commented

Hi manish9396

Thanks a lot for this repro project, this helps a lot.

Unfortunately, your sample shows that you're directly using the Servlet API (and the underlying Tomcat implementation), not the support provided by Spring Framework for the view resolution:

RequestDispatcher rd = request.getRequestDispatcher("../../main");
rd.forward(request, response);

 

In this case, there's nothing Spring Framework can do since Spring is not involved in this case. Maybe you'll get more help on that very topic with a message on the Tomcat user list?

@spring-issuemaster
Copy link
Collaborator Author

@spring-issuemaster spring-issuemaster commented Oct 23, 2018

Vishal Raj commented

Brian Clozel The above reproduction does suggest the problem is with tomcat but it translates to spring issue too.

In org.springframework.web.servlet.view.InternalResourceView#renderMergedOutputModel spring gets the dispatcherPath and then uses RequestDispatcher to forward it

String dispatcherPath = prepareForRendering(request, response);
// Obtain a RequestDispatcher for the target resource (typically a JSP).
RequestDispatcher rd = getRequestDispatcher(request, dispatcherPath);
...
rd.forward(request, response);

So, if we handle the normalization in Spring side in InternalResourceView#prepareForRendering then this problem can be resolved

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
2 participants
You can’t perform that action at this time.