ServletContext.getRealPath(String) needs clarification

[glassfishrobot]

The Javadoc for getRealPath() uses the term "virtual path" but doesn't define it anywhere. Clearly, the virtual path is relative to the context root but the following are not clear:

1. Must the path start with '/'?
2. If the path must start with '/', what happens if it does not?
3. If the path doesn't have to start with '/' how do you get from the provided path to a path relative to the content root?

My personal view is:
1. Yes.
2. Throw an IllegalArgumentException
3. N/A

One caveat to the above is that we might allow paths of "" which are treated as equivalent to "/".

[glassfishrobot]

@glassfishrobot Commented
Reported by markt_asf

[glassfishrobot]

@glassfishrobot Commented
markt_asf said:
Ping. Does anyone else on the EG have a view on this?

[glassfishrobot]

@glassfishrobot Commented
This issue was imported from java.net JIRA SERVLET_SPEC-105

[glassfishrobot]

@stuartwdouglas Commented

1. I don't think we can add a requirement that paths need to start with a '/', as it could break many existing applications.
2. N/A
3. You treat /index.html and index.html the same

[glassfishrobot]

@marat-gainullin Commented

1. No.
2. If provided path starts with '/' then it means that an application refers to file system root and path is not relative. If it does not, provided path is treated as relative to context root similarly with Path.resolve()
3. N/A.

Paths “” should be treated as context root and ‘/‘ should not.

[glassfishrobot]

• Issue Imported From: https://github.com/javaee/servlet-spec/issues/105
• Original Issue Raised By:@glassfishrobot
• Original Issue Assigned To: @glassfishrobot

[markt-asf]

I'd like to see if we can clear this one up. The Javadoc (which is essentially unchanged all the way back to Servlet 2.4) is

For example, if path is equal to /index.html, this method will return the absolute file path on the server's filesystem to which a request of the form http://<host>:<port>/<contextPath>/index.html would be mapped, where <contextPath> corresponds to the context path of this ServletContext.

My reading of the above is that the path passed into this method is appended to http://<host>:<port>/<contextPath> to identify the resource in question. For that to work, the path has to start with "/". This is consistent with other methods in the API that accept paths relative to the context root such as getResource().

Given the above, I'd like to make the Javadoc explicit that the path must start with "/".

That then raises the question what to do if the path doesn't start with "/". Other methods throw a MalformedURLException. However, the Javadoc for this method states:

This method returns null if the servlet container is unable to translate the given virtual path to a real path.

Given this, I'd like to make it explicit that the method returns null if a path is passed that does not start with "/".

This approach may create backwards compatibility concerns. If that is the case my alternative proposal is that if the method is called with a path that does not start with "/", a "/" is pre-pended to the provided path and then processing continues as above.

[stuartwdouglas]

Undertow does not require a leading slash, if it is omitted it basically just does:

            if(!canonicalPath.startsWith("/")) {
                canonicalPath = "/" + canonicalPath;
            }

From our POV requiring a / would be a backwards compatibility concern. I also don't think the 'starts with a slash' requirement is particularly helpful or user friendly. I would much prefer that we just say that all paths are effectively absolute, so a leading slash is implied (or something like that, TBH I think the current text already implies that).

[gregw]

Jetty also will prepend a leading '/' if there is not one. I would not mind text that encouraged the argument to have a leading slash as it is just generating garbage to have to create another string. So let's say something like "the path should start with a '/' and is interpreted relative to the ServletContext".

…

On Thu, 26 Nov 2020 at 23:54, Stuart Douglas ***@***.***> wrote: Undertow does not require a leading slash, if it is omitted it basically just does: if(!canonicalPath.startsWith("/")) { canonicalPath = "/" + canonicalPath; } From our POV requiring a / would be a backwards compatibility concern. I also don't think the 'starts with a slash' requirement is particularly helpful or user friendly. I would much prefer that we just say that all paths are effectively absolute, so a leading slash is implied (or something like that, TBH I think the current text already implies that). — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#105 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAARJLLIAU2OHCQ7X54XUOLSR3MDNANCNFSM4UDR2PGQ> .

-- Greg Wilkins <[email protected]> CTO http://webtide.com

[markt-asf]

Thanks for the feedback. I'll put together a PR that says something along the lines of:

• path is relative to the context root
• path should start with a "/"
• if path doesn't start with a "/" the container must behave as if the method was called with "/" + path

and update Tomcat to be less strict (Tomcat currently requires a "/").