RE: CRLF Stripped in Tomcat Response Header

2011-09-04 Thread Nadav Katz
Thank you very much for your input, you raised several points that hadn't occurred to me. I will redesign my original solution around them. Thanks also for this mailing list, it's a tremendous help. -Original Message- From: Mark Thomas [mailto:ma...@apache.org] Sent: Sunday, September 0

Re: servlet unavailable

2011-09-04 Thread Daniel Baktiar
Hi Adam, I'm not checking any references, but it may be because you are not allowed to have space on the servlet name. Can you try by not using space in the servlet name "Show Bikes", try to change to "ShowBikes" in both instance of configuration in web.xml. The and . --- daniel baktiar On Sun

Re: servlet unavailable

2011-09-04 Thread Pid
On 03/09/2011 22:36, Adam Posner wrote: > Posner to users > show details 8:16 PM (2 minutes ago) > > Hello all: > > > I am hoping someone can help with this. Tomcat 6.0.28 keeps giving me, > saying 'Servlet Front Controller is not available' > I am using struts 1, the jar file is struts-core-1

Re: CGIServlet - php

2011-09-04 Thread throwsCode
Thanks Mark: If I'm reading this right you did in a couple hours what I have been working on for eight days. FM! Retracing my steps is proving difficult, so many paths taken and abandoned. Thanks for demonstrating one definitive solution. TC -- View this message in context: http://old.nabbl

Re: CRLF Stripped in Tomcat Response Header

2011-09-04 Thread Mark Thomas
On 04/09/2011 12:16, Nadav Katz wrote: > Sorry Mark, I just noticed your input regarding the filter. I am > really only worried about attackers tampering with request headers. > The reason is that we may have (now or in the future) code that gets > request headers and inserts them to the response.

RE: CRLF Stripped in Tomcat Response Header

2011-09-04 Thread Nadav Katz
Sorry Mark, I just noticed your input regarding the filter. I am really only worried about attackers tampering with request headers. The reason is that we may have (now or in the future) code that gets request headers and inserts them to the response. Since I know I never expect request headers

RE: CRLF Stripped in Tomcat Response Header

2011-09-04 Thread Nadav Katz
Thanks a lot for the reply Mark. I agree with you that it probably exists in most (if not all) containers, but we (I..) are forced to provide our own implementation as well. Thanks again for your help! -Original Message- From: Mark Thomas [mailto:ma...@apache.org] Sent: Sunday, Septemb

Re: CRLF Stripped in Tomcat Response Header

2011-09-04 Thread Mark Thomas
On 04/09/2011 05:54, Nadav Katz wrote: > Hi All! > > First, let me assure everyone that I am not a hacker, exactly the > opposite, but I have a related problem. I am in the process of > implementing code that protects against header manipulation. I > created a filter that strips line feed and carr