lookupPath for Request not getting normalized path leading to HTTP Status 404 – Not Found for relative path forward requests [SPR-17354]

[spring-issuemaster]

manish9396 opened SPR-17354 and commented

Tomcat upgraded behavior to return non-normalized requestURI in ApplicationDispatcher. apache/tomcat80@21f57c2#diff-8b91a9296e19012bf6be4bdf975fab0dR499

Spring relies on request.getRequestURI() for lookupPath which is used to find matching servlet. https://github.com/spring-projects/spring-framework/blob/v4.3.16.RELEASE/spring-web/src/main/java/org/springframework/web/util/UrlPathHelper.java#L232

As a result of this, after upgrading to the latest tomcat, v8.0.45 and above, v8.5.16 and above, forwarding to relative paths leads to 404 not found, error being reported as,

 

o.s.web.servlet.PageNotFound No mapping found for HTTP request with URI [/context/asdf/../asdf/zxcv] in DispatcherServlet with name 'DispatcherServlet'

 

---

Affects: 4.3.16

Attachments:

• RelativePathBug.tar.gz (36.13 kB)
• RelativePathBug.tar.gz (2.13 kB)
• Tomcat-8.0.43-path-resolved.png (11.90 kB)
• Tomcat-8.0.53-path-not-resolved.png (22.65 kB)

[spring-issuemaster]

Juergen Hoeller commented

Brian Clozel, could you have a look at this one please? Seems we need to explicitly normalize the path ourselves there...

[spring-issuemaster]

Brian Clozel commented

manish9396 Could you provide a sample application that shows the issue? I can't seem to reproduce properly the problem.

I've created a Spring Boot application (version 1.5.16) on start.spring.io with the Web and Thymeleaf starters. I've also added the following controller:

@Controller
public class TestController {

	@GetMapping("/")
	public String index() {
		return "index";
	}

	@GetMapping("/test")
	public String test() {
		return "forward:/something/../other";
	}

	@GetMapping("/other")
	public String other() {
		return "other";
	}
}

Browsing http://localhost:8080/test does show the other.html view, as expected. The tomcat version is 8.5.34.

I'm probably missing something here, could you help me reproduce this issue?

[spring-issuemaster]

manish9396 commented

Brian Clozel Even I faced problem while trying to reproduce it as the request was not going to the desired point https://github.com/spring-projects/spring-framework/blob/master/spring-webmvc/src/main/java/org/springframework/web/servlet/handler/AbstractUrlHandlerMapping.java#L122

I debugged with my actual system.

Right now I'm engaged in some other project. I'll give a sample application to reproduce this by the end of next week. Is that okay?

[spring-issuemaster]

manish9396 commented

Brian ClozelI'm attaching a sample application which can be used to reproduce the bug. 
The tar file also has two images as test results, one using Tomcat-8.0.43 (path resolved) and other using Tomcat-8.0.53 (path not resolved)

[^RelativePathBug.tar.gz]

[spring-issuemaster]

Brian Clozel commented

Hi manish9396

Thanks a lot for this repro project, this helps a lot.

Unfortunately, your sample shows that you're directly using the Servlet API (and the underlying Tomcat implementation), not the support provided by Spring Framework for the view resolution:

RequestDispatcher rd = request.getRequestDispatcher("../../main");
rd.forward(request, response);

 

In this case, there's nothing Spring Framework can do since Spring is not involved in this case. Maybe you'll get more help on that very topic with a message on the Tomcat user list?

[spring-issuemaster]

Vishal Raj commented

Brian Clozel The above reproduction does suggest the problem is with tomcat but it translates to spring issue too.

In org.springframework.web.servlet.view.InternalResourceView#renderMergedOutputModel spring gets the dispatcherPath and then uses RequestDispatcher to forward it

String dispatcherPath = prepareForRendering(request, response);
// Obtain a RequestDispatcher for the target resource (typically a JSP).
RequestDispatcher rd = getRequestDispatcher(request, dispatcherPath);
...
rd.forward(request, response);

So, if we handle the normalization in Spring side in InternalResourceView#prepareForRendering then this problem can be resolved