Uploaded image for project: 'Undertow'
  1. Undertow
  2. UNDERTOW-2295

Stop registering managed default servlet if another one is configured

    XMLWordPrintable

Details

    • Enhancement
    • Resolution: Unresolved
    • Major
    • None
    • 2.3.7.Final
    • Servlet
    • None

    Description

      Hi,

      in the course of applying mitigations for https://spring.io/security/cve-2023-34035 it came up that Undertow always creates a default servlet in https://github.com/undertow-io/undertow/blob/2.3.7.Final/servlet/src/main/java/io/undertow/servlet/handlers/ServletPathMatches.java#L308 that is causing very vanilla Spring-Boot applications to fail on startup due to the mappings not being clearly assignable to a specific servlet registration (without any further code).

      While there are workarounds posted and discussions going on the improve the migration path for Spring-Security https://github.com/spring-projects/spring-security/issues/13568 I wondered why this needs to be registered in the first place if a default servlet is given.

      Unfortunately, I couldn't find a ticket that references the decision behind the default servlet registration, but only the commit 71c5a691 which is unfortunately not providing more info.

      There is https://issues.redhat.com/browse/UNDERTOW-149 which introduced a check for the managed default servlet not being registered twice, which the PR still kept.

      I'll shortly provide a PR to address & discuss this. See

      https://github.com/undertow-io/undertow/pull/1506

       

      Attachments

        Activity

          People

            flaviarnn Flavia Rainone
            christophdreis Christoph Dreis (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated: