Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve #4275 ambiguous URIs (#6939) #6978

Merged
merged 1 commit into from
Oct 21, 2021

Conversation

lachlan-roberts
Copy link
Contributor

Closes #4275

Merge of changes from #6939 to 10.0.x.

A URI like /foo/%2e%2e;/bar should be ambiguous both because of the encoded dots and because of the parameters. This means that the default setting of jetty-9 is a bit more secure as this path is considered ambiguous if either Violation.SEGMENT or Violation.PARAM is set.

* Improve #4275 ambiguous URIs

A URI like `/foo/%2e%2e;/bar` should be ambiguous both because of the encoded dots and because of the parameters.  This means that the default setting of jetty-9 is a bit more secure as this path is considered ambiguous if either Violation.SEGMENT or Violation.PARAM is set.

Signed-off-by: Lachlan Roberts <[email protected]>
@joakime joakime added Bug For general bugs on Jetty side Enhancement and removed Bug For general bugs on Jetty side labels Oct 20, 2021
@lachlan-roberts lachlan-roberts merged commit ec22186 into jetty-10.0.x Oct 21, 2021
@lachlan-roberts lachlan-roberts deleted the jetty-10.0.x-4275-ambiguousparam branch October 21, 2021 06:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Path Normalization/Traversal - Context Matching
3 participants