eclipse-ee4j / eclipse-ee4j/jersey
Allow encoded slashes for JAX-RS application by default
- Dominant language
- Java
- Stars
- 730
- Forks
- 382
- PR merge metrics
- No merged PRs in 30d
Description
GlassFish does not allow encoded slashes in URLs by default. It is told that this would be for security reasons. But, encoded slashes are allowed by default for "admin-listener". I suspect the reason is that somebody noticed that there now is a JAX-RS based admin interface at that port which otherwise will not work.
So it is doubtful why user's JAX-RS application are still not allowed to receive encoded slashes, as the implementation (Jersey) has no security problems to handle them. People are forced to find out how to enable this explicitly (in fact I did not find it in the manuals at all but needed to ask in a forum, where someone told me the cryptic spell to cast, so GlassFish will magically work as virtually all JAX-RS deployers and application vendors wants it to work like:
```
asadmin set
configs.config.server-config.network-config.protocols.protocol.http-listener-1.http.encoded-slash-enabled=true
```
).
I want to propose two things to reduce the level of torture one have to bear:
(1) The deployment manual should clearly contain that above code line and it should be marked in a colourful way that everbody will directly find it when about to deploy a JAX-RS application on GlassFish.
(2) JAX-RS applications by default should be allowed to receive encoded slashes. A JAX-RS application prodiver is coding according to the JAX-RS specification, which does not prevent slashes, and nobody at the Jersey team so far mentioned any problems with slashes in the Jersey product. The risk covered by the prevention of slash, in my opinion, mostly exists in Servlet applications. But, again, a JAX-RS application is not a servlet by definition (the Jersey container is one, but that is not suffering from that security problem with slashes).
#### Environment
Win7 Pro SP1 64 Bit de_DE
#### Affected Versions
[2.0-m13]
Contributor guide
Assessment
This issue has not been assessed yet.