eclipse-ee4j / eclipse-ee4j/jersey

GrizzlyHttpContainer throws exception if query string contains unsafe characters

Open
#3,322 5 comments 0 reactions 0 assignees View on GitHub
Component: containers Priority: Major Type: Bug
Dominant language
Java
Stars
730
Forks
382
PR merge metrics
No merged PRs in 30d

Description

eg if we send an HTTP request on the following type
curl -X GET 'http://abc.xyz.com:8990/abcd?alert(1)'

we get the following response:
Grizzly 2.3.19<!--div.header

{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#003300;font-size:22px;-moz-border-radius-topleft: 10px;border-top-left-radius: 10px;-moz-border-radius-topright: 10px;border-top-right-radius: 10px;padding-left: 5px}

div.body

{font-family:Tahoma,Arial,sans-serif;color:black;background-color:#FFFFCC;font-size:16px;padding-top:10px;padding-bottom:10px;padding-left:10px}

div.footer

{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#666633;font-size:14px;-moz-border-radius-bottomleft: 10px;border-bottom-left-radius: 10px;-moz-border-radius-bottomright: 10px;border-bottom-right-radius: 10px;padding-left: 5px}

BODY

{font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;}

B

{font-family:Tahoma,Arial,sans-serif;color:black;}

A

{color : black;}

HR

{color : #999966;}

-->

Internal Server Error
Illegal character in query at index 7: /abcd?alert(1)
 1: java.net.URI.create(URI.java:852)

2: java.net.URI.resolve(URI.java:1036)
3: org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.getRequestUri(GrizzlyHttpContainer.java:470)
4: org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:359)
5: org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:224)
6: org.glassfish.grizzly.threadpool.AbstractThreadPool$Worker.doWork(AbstractThreadPool.java:565)
7: org.glassfish.grizzly.threadpool.AbstractThreadPool$Worker.run(AbstractThreadPool.java:545)
8: java.lang.Thread.run(Thread.java:745)
Root Cause: java.net.URISyntaxException: Illegal character in query at index 15: /admin/v1/Apps?alert(1)
 1: java.net.URI$Parser.fail(URI.java:2848)

2: java.net.URI$Parser.checkChars(URI.java:3021)
3: java.net.URI$Parser.parseHierarchical(URI.java:3111)
4: java.net.URI$Parser.parse(URI.java:3063)
5: java.net.URI.(URI.java:588)
6: java.net.URI.create(URI.java:850)
7: java.net.URI.resolve(URI.java:1036)
8: org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.getRequestUri(GrizzlyHttpContainer.java:470)
9: org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:359)
10: org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:224)
... 3 more
Please see the log for more detail.

In this case the failure is because of the presence of '<' and '>' characters in the query string. Though most of the latest browsers encode these characters, but some of the older versions don't. Hence, in case the client does not encode the url properly, the container is expected to do one of the following

1\. Encode the URL on the server side. The GrizzlyHTTPContainer is already doing it some of the characters like '\' ( Refer [https://java.net/jira/browse/JERSEY-2850](https://java.net/jira/browse/JERSEY-2850))

2\. If for some reason, the server side encoding is not feasible, the failure should be handled more gracefully by returning a simple descriptive message instead of returning the stacktrace in the response.
#### Environment
GrizzlyHttpContainer 2.18
#### Affected Versions
[2.18]

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.