Re: URLs with '../' and 404s

2010-04-09 Thread Mark Thomas
On 08/04/2010 23:23, Nikita Tovstoles wrote: So, if the current URI is "http://localhost/app/page"; and sendRedirect method arg is "../../app/page.0" what does that violate? That relative URL is not valid. To construct the absolute URL, you strip of the file name from the path and append the r

Re: URLs with '../' and 404s

2010-04-08 Thread Caldarale, Charles R
On Apr 8, 2010, at 18:24, "Nikita Tovstoles" mailto:nikita.tovsto...@gmail.com>> wrote: Without asserting that Wicket's is NOT breaking an RFC, I would appreciate a clarification on which RFC do you think the framework (or the app) is breaking? Since I'm sitting in a terminal at JFK right now,

Re: URLs with '../' and 404s

2010-04-08 Thread Nikita Tovstoles
Chuck, Without asserting that Wicket's is NOT breaking an RFC, I would appreciate a clarification on which RFC do you think the framework (or the app) is breaking? HttpServletResponse.sendRedirect allows relative URLs explicitly. From 1.4 EE Javadoc: "Sends a temporary redirect response to the cl

Re: URLs with '../' and 404s

2010-04-08 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Nikita, On 4/8/2010 4:03 PM, Nikita Tovstoles wrote: > Response.java in Tomcat src: > http://kickjava.com/src/org/apache/catalina/connector/Response.java.htm Hmm... a non-Apache site without a version reference? :( How about http://svn.apache.org/r

Re: URLs with '../' and 404s

2010-04-08 Thread David Smith
I strongly advocate server relative URLs which get rid of the whole problem. All that means is the URL becomes everything after the servername & port in a full absolute URL. That way it just plain works and even minimizes the browser's understanding of how to compute an absolute URL from a relati

Re: URLs with '../' and 404s

2010-04-08 Thread Caldarale, Charles R
On Apr 8, 2010, at 14:53, "Christopher Schultz" wrote: > I see no toAbsolute method in the HttpServletResponse class. Are you > talking about some other toolkit? It's an internal Tomcat method that the OP seems to think should rectify the RFC violations his code is making. (I don't have a whol

Re: URLs with '../' and 404s

2010-04-08 Thread Nikita Tovstoles
Response.java in Tomcat src: http://kickjava.com/src/org/apache/catalina/connector/Response.java.htm On Thu, Apr 8, 2010 at 12:52 PM, Christopher Schultz < ch...@christopherschultz.net> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Nikita, > > On 4/8/2010 11:14 AM, Nikita Tovstol

Re: URLs with '../' and 404s

2010-04-08 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Nikita, On 4/8/2010 11:14 AM, Nikita Tovstoles wrote: > We use Wicket that periodically redirects to relative URLs starting with > '../'. I realize that's against the RFC (which says redirects are supposed > to be absolute), but I am not clear on why

Re: URLs with '../' and 404s

2010-04-08 Thread Nikita Tovstoles
Actually it was pointed out to me that it is the container & not the app/framework that is generating the Location header, and so isn't the below a bug in toAbsolute()? On Thu, Apr 8, 2010 at 8:14 AM, Nikita Tovstoles wrote: > We use Wicket that periodically redirects to relative URLs starting w

URLs with '../' and 404s

2010-04-08 Thread Nikita Tovstoles
We use Wicket that periodically redirects to relative URLs starting with '../'. I realize that's against the RFC (which says redirects are supposed to be absolute), but I am not clear on why doesn't Tomcat collapse those URLs in Response.toAbsolute()? Specifically: -assume client is at http://loca