eclipse-ee4j / eclipse-ee4j/jersey
GrizzlyHttpContainer throws exception if query string contains unsafe characters
- Dominant language
- Java
- Stars
- 730
- Forks
- 382
- PR merge metrics
- No merged PRs in 30d
Description
eg if we send an HTTP request on the following type
curl -X GET 'http://abc.xyz.com:8990/abcd?alert(1)'
we get the following response:
Grizzly 2.3.19<!--div.header
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#003300;font-size:22px;-moz-border-radius-topleft: 10px;border-top-left-radius: 10px;-moz-border-radius-topright: 10px;border-top-right-radius: 10px;padding-left: 5px}
div.body
{font-family:Tahoma,Arial,sans-serif;color:black;background-color:#FFFFCC;font-size:16px;padding-top:10px;padding-bottom:10px;padding-left:10px}
div.footer
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#666633;font-size:14px;-moz-border-radius-bottomleft: 10px;border-bottom-left-radius: 10px;-moz-border-radius-bottomright: 10px;border-bottom-right-radius: 10px;padding-left: 5px}
BODY
{font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;}
B
{font-family:Tahoma,Arial,sans-serif;color:black;}
A
{color : black;}
HR
{color : #999966;}
-->
1: java.net.URI.create(URI.java:852)Root Cause: java.net.URISyntaxException: Illegal character in query at index 15: /admin/v1/Apps?alert(1)
2: java.net.URI.resolve(URI.java:1036)
3: org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.getRequestUri(GrizzlyHttpContainer.java:470)
4: org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:359)
5: org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:224)
6: org.glassfish.grizzly.threadpool.AbstractThreadPool$Worker.doWork(AbstractThreadPool.java:565)
7: org.glassfish.grizzly.threadpool.AbstractThreadPool$Worker.run(AbstractThreadPool.java:545)
8: java.lang.Thread.run(Thread.java:745)
1: java.net.URI$Parser.fail(URI.java:2848)Please see the log for more detail.
2: java.net.URI$Parser.checkChars(URI.java:3021)
3: java.net.URI$Parser.parseHierarchical(URI.java:3111)
4: java.net.URI$Parser.parse(URI.java:3063)
5: java.net.URI.(URI.java:588)
6: java.net.URI.create(URI.java:850)
7: java.net.URI.resolve(URI.java:1036)
8: org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.getRequestUri(GrizzlyHttpContainer.java:470)
9: org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:359)
10: org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:224)
... 3 more
In this case the failure is because of the presence of '<' and '>' characters in the query string. Though most of the latest browsers encode these characters, but some of the older versions don't. Hence, in case the client does not encode the url properly, the container is expected to do one of the following
1\. Encode the URL on the server side. The GrizzlyHTTPContainer is already doing it some of the characters like '\' ( Refer [https://java.net/jira/browse/JERSEY-2850](https://java.net/jira/browse/JERSEY-2850))
2\. If for some reason, the server side encoding is not feasible, the failure should be handled more gracefully by returning a simple descriptive message instead of returning the stacktrace in the response.
#### Environment
GrizzlyHttpContainer 2.18
#### Affected Versions
[2.18]
Contributor guide
Assessment
This issue has not been assessed yet.