eclipse-ee4j / eclipse-ee4j/jersey

Allow encoded slashes for JAX-RS application by default

Open
#1,728 17 comments 0 reactions 0 assignees View on GitHub
Component: core Priority: Major Type: Improvement
Dominant language
Java
Stars
730
Forks
382
PR merge metrics
No merged PRs in 30d

Description

GlassFish does not allow encoded slashes in URLs by default. It is told that this would be for security reasons. But, encoded slashes are allowed by default for "admin-listener". I suspect the reason is that somebody noticed that there now is a JAX-RS based admin interface at that port which otherwise will not work.

So it is doubtful why user's JAX-RS application are still not allowed to receive encoded slashes, as the implementation (Jersey) has no security problems to handle them. People are forced to find out how to enable this explicitly (in fact I did not find it in the manuals at all but needed to ask in a forum, where someone told me the cryptic spell to cast, so GlassFish will magically work as virtually all JAX-RS deployers and application vendors wants it to work like:

```
asadmin set
configs.config.server-config.network-config.protocols.protocol.http-listener-1.http.encoded-slash-enabled=true
```

).

I want to propose two things to reduce the level of torture one have to bear:

(1) The deployment manual should clearly contain that above code line and it should be marked in a colourful way that everbody will directly find it when about to deploy a JAX-RS application on GlassFish.

(2) JAX-RS applications by default should be allowed to receive encoded slashes. A JAX-RS application prodiver is coding according to the JAX-RS specification, which does not prevent slashes, and nobody at the Jersey team so far mentioned any problems with slashes in the Jersey product. The risk covered by the prevention of slash, in my opinion, mostly exists in Servlet applications. But, again, a JAX-RS application is not a servlet by definition (the Jersey container is one, but that is not suffering from that security problem with slashes).
#### Environment
Win7 Pro SP1 64 Bit de_DE
#### Affected Versions
[2.0-m13]

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.