Uploaded image for project: 'Undertow'
  1. Undertow
  2. UNDERTOW-1308

Incorrect handling of non http(s) scheme urls in sendRedirect

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Major
    • 2.0.2.Final, 1.4.24.Final
    • 1.4.23.Final, 2.0.1.Final
    • Servlet
    • None

    Description

      HttpServletResponseImpl#sendRedirect checks for absolute urls by recognizing string "://".

      The schema part of URLs ends with colon, not colon double slash. This is not an issue for http(s) protocol URLs but for redirect URLs for native mobile apps.

      Defining redirect URLs for OAuth as defined in
      https://tools.ietf.org/html/rfc8252#section-7.1
      will result in relative URL redirects.

      Attachments

        Issue Links

          causes

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-16826 [GSS](7.2.z) UNDERTOW-1567 - Redirect to absolute URL with special characters broken

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Verified

          Bug - A problem that impairs or prevents the functions of the product. UNDERTOW-1567 Redirect to absolute URL with special characters broken

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Resolved
          is triggering

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-27014 [GSS](7.4.z) UNDERTOW-2383 - Canonicalized query string in redirect location can break included links

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Open

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-27015 [GSS](8.0.z) UNDERTOW-2383 - Canonicalized query string in redirect location can break included links

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Pull Request Sent

          Bug - A problem that impairs or prevents the functions of the product. UNDERTOW-2383 Canonicalized query string in redirect location can break included links

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Pull Request Sent

          Activity

            People

              sdouglas1@redhat.com Stuart Douglas
              andre.schaefer André Schäfer (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: