mitre/HTTP-Proxy-Servlet

Handle URL with special characters []

phuongnq opened this issue · 5 comments

If the URL has encoded special chracter such as ] (Encoded value %5D), the proxy seem not work properly as in the HTTP request, GET followed by a full URL instead of a path.

To reproduce:
In the test file ProxyServletTest.java, modify line 171:

GetMethodWebRequest request = makeGetMethodRequest(sourceBaseUri + "/%64%69%72%2F%5D%2F");

Notice that I added %5D%2F (decoded value: ]/).

Run the test case:

mvn test -Dtest=ProxyServletTest#testRedirect

Notice that in the console:

13:47:09.864 [main] DEBUG org.apache.http.impl.execchain.MainClientExec - Opening connection {}->http://localhost:43923
13:47:09.866 [main] DEBUG org.apache.http.impl.conn.DefaultHttpClientConnectionOperator - Connecting to localhost/127.0.0.1:43923
13:47:09.867 [main] DEBUG org.apache.http.impl.conn.DefaultHttpClientConnectionOperator - Connection established 127.0.0.1:56258<->127.0.0.1:43923
13:47:09.867 [main] DEBUG org.apache.http.impl.execchain.MainClientExec - Executing request GET http://localhost:43923/targetPath/dir/[/ HTTP/1.1
13:47:09.867 [main] DEBUG org.apache.http.impl.execchain.MainClientExec - Target auth state: UNCHALLENGED
13:47:09.867 [main] DEBUG org.apache.http.impl.execchain.MainClientExec - Proxy auth state: UNCHALLENGED
13:47:09.868 [main] DEBUG org.apache.http.headers - http-outgoing-0 >> GET http://localhost:43923/targetPath/dir/[/ HTTP/1.1
13:47:09.869 [main] DEBUG org.apache.http.headers - http-outgoing-0 >> User-Agent: httpunit/1.5
13:47:09.869 [main] DEBUG org.apache.http.headers - http-outgoing-0 >> Accept-Encoding: gzip
13:47:09.869 [main] DEBUG org.apache.http.headers - http-outgoing-0 >> xxTarget: /dummy
13:47:09.869 [main] DEBUG org.apache.http.headers - http-outgoing-0 >> X-Forwarded-For: 127.0.0.1
13:47:09.869 [main] DEBUG org.apache.http.headers - http-outgoing-0 >> X-Forwarded-Proto: http
13:47:09.869 [main] DEBUG org.apache.http.headers - http-outgoing-0 >> Content-Length: 0
13:47:09.869 [main] DEBUG org.apache.http.headers - http-outgoing-0 >> Host: localhost:43923
13:47:09.869 [main] DEBUG org.apache.http.headers - http-outgoing-0 >> Connection: Keep-Alive

As you can see, it sent:

GET http://localhost:43923/targetPath/dir/[/ HTTP/1.1

Expected:

GET /targetPath/dir/%5D/ HTTP/1.1 

get_full_url

Thanks for the PR!

Thank you for the merge. Do you know how long until we can release the next version?

I wasn't planning on doing soon but since you ask; perhaps ~this New Years break sometime. You may have to prod me again ;-)

I just releases 1.12.1. It should be on Maven central very soon.

Thank you!