mitre / mitre/HTTP-Proxy-Servlet
IETF RFC 7231 tolerates relative urls in header location
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.5k
- Forks
- 557
- PR merge metrics
- No merged PRs in 30d
Description
When the location is rewritten by the proxy, it does not take into consideration that the url can be relative
Follwoing excerpt is from https://en.wikipedia.org/wiki/HTTP_location:
An obsolete version of the HTTP 1.1 specifications (IETF RFC 2616) required a complete absolute URI for redirection.[2] The IETF HTTP working group found that the most popular web browsers tolerate the passing of a relative URL[3] and, consequently, the updated HTTP 1.1 specifications (IETF RFC 7231) relaxed the original constraint, allowing the use of relative URLs in Location headers.[4]
So when an relative url is used, the proxy fails to rewrite the relative url (see method rewriteUrlFromResponse), since the location will will never start with the targetUri.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting the rewriteUrlFromResponse method and trace how response Location headers are handled. Verify the behavior for a relative URL and confirm that the proxy rewrites it correctly without relying on the URL starting with the target URI.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend, networking
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100