Uploaded image for project: 'Undertow'
  1. Undertow
  2. UNDERTOW-1185

Undertow does not allow UTF-8 characters in URLs

    XMLWordPrintable

Details

    Description

      We receive a 400 response code if using UTF-8 characters for a request, due to this check:

      https://github.com/undertow-io/undertow/blob/master/core/src/main/java/io/undertow/server/protocol/http/HttpRequestParser.java#L375

      This was introduced in UNDERTOW-1101. We want to understand why it is necessary for the CVE/CWE regarding request smuggling, but this ticket is to at least make this check optional as it goes against the URL_ENCODING UndertowOption when set to UTF-8 (default).

      Attachments

        Issue Links

          causes

          Feature Request - Feature requests from customers and/or users WFLY-9724 Undertow does not allow UTF-8 characters in URLs

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-13710 [GSS](7.1.z) UNDERTOW-1185 - Undertow does not allow UTF-8 characters in URLs

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Verified
          duplicates

          Bug - A problem that impairs or prevents the functions of the product. UNDERTOW-1256 Allow special characters in HTTP request

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Resolved
          relates to

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-15994 [GSS](7.2.z) Unescaped characters in URL from client does not work correctly when allowed for HTTP and HTTPS listeners

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed

          Bug - A problem that impairs or prevents the functions of the product. WFLY-10929 Unescaped characters in URL from client does not work correctly when allowed for HTTP and HTTPS listeners

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Coding In Progress

          Activity

            People

              sdouglas1@redhat.com Stuart Douglas
              abellina Alessandro Bellina (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: