Skip to content
This repository was archived by the owner on May 28, 2018. It is now read-only.

Commit e4a975e

Browse files
author
Adam Lindenthal
committed
JERSEY-2654: ServletContainer#doFilter attempts template substitution
Change-Id: Id17bd15137efa103030ecff063e1bfe7d4cde3bf
1 parent 102a289 commit e4a975e

File tree

6 files changed

+374
-1
lines changed

6 files changed

+374
-1
lines changed

‎containers/jersey-servlet-core/src/main/java/org/glassfish/jersey/servlet/ServletContainer.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -528,7 +528,7 @@ private void doFilter(HttpServletRequest request, HttpServletResponse response,
528528
build();
529529

530530
final URI requestUri = absoluteUriBuilder.replacePath(requestURI).
531-
replaceQuery(queryString).
531+
replaceQuery(ContainerUtils.encodeUnsafeCharacters(queryString)).
532532
build();
533533

534534
final int status = service(baseUri, requestUri, request, response).get();

‎tests/integration/jersey-2654/pom.xml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
4+
DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
5+
6+
Copyright (c) 2014 Oracle and/or its affiliates. All rights reserved.
7+
8+
The contents of this file are subject to the terms of either the GNU
9+
General Public License Version 2 only ("GPL") or the Common Development
10+
and Distribution License("CDDL") (collectively, the "License"). You
11+
may not use this file except in compliance with the License. You can
12+
obtain a copy of the License at
13+
http://glassfish.java.net/public/CDDL+GPL_1_1.html
14+
or packager/legal/LICENSE.txt. See the License for the specific
15+
language governing permissions and limitations under the License.
16+
17+
When distributing the software, include this License Header Notice in each
18+
file and include the License file at packager/legal/LICENSE.txt.
19+
20+
GPL Classpath Exception:
21+
Oracle designates this particular file as subject to the "Classpath"
22+
exception as provided by Oracle in the GPL Version 2 section of the License
23+
file that accompanied this code.
24+
25+
Modifications:
26+
If applicable, add the following below the License Header, with the fields
27+
enclosed by brackets [] replaced by your own identifying information:
28+
"Portions Copyright [year] [name of copyright owner]"
29+
30+
Contributor(s):
31+
If you wish your version of this file to be governed by only the CDDL or
32+
only the GPL Version 2, indicate your decision by adding "[Contributor]
33+
elects to include this software in this distribution under the [CDDL or GPL
34+
Version 2] license." If you don't indicate a single choice of license, a
35+
recipient has the option to distribute your version of this file under
36+
either the CDDL, the GPL Version 2 or to extend the choice of license to
37+
its licensees as provided above. However, if you add GPL Version 2 code
38+
and therefore, elected the GPL Version 2 license, then the option applies
39+
only if the new code is made subject to such option by the copyright
40+
holder.
41+
42+
-->
43+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
44+
<modelVersion>4.0.0</modelVersion>
45+
<parent>
46+
<groupId>org.glassfish.jersey.tests.integration</groupId>
47+
<artifactId>project</artifactId>
48+
<version>2.14-SNAPSHOT</version>
49+
</parent>
50+
51+
<artifactId>jersey-2654</artifactId>
52+
<packaging>war</packaging>
53+
<name>jersey-tests-integration-jersey-2654</name>
54+
55+
<description>Jersey test web application - servlet/filter, JERSEY-2654 reproducer</description>
56+
57+
<dependencies>
58+
<dependency>
59+
<groupId>org.glassfish.jersey.containers</groupId>
60+
<artifactId>jersey-container-servlet-core</artifactId>
61+
</dependency>
62+
63+
<dependency>
64+
<groupId>org.glassfish.jersey.test-framework.providers</groupId>
65+
<artifactId>jersey-test-framework-provider-external</artifactId>
66+
<scope>test</scope>
67+
</dependency>
68+
</dependencies>
69+
70+
<build>
71+
<plugins>
72+
<plugin>
73+
<groupId>org.apache.maven.plugins</groupId>
74+
<artifactId>maven-compiler-plugin</artifactId>
75+
</plugin>
76+
<plugin>
77+
<groupId>org.apache.maven.plugins</groupId>
78+
<artifactId>maven-failsafe-plugin</artifactId>
79+
</plugin>
80+
<plugin>
81+
<groupId>org.mortbay.jetty</groupId>
82+
<artifactId>jetty-maven-plugin</artifactId>
83+
</plugin>
84+
</plugins>
85+
</build>
86+
</project>

‎tests/integration/jersey-2654/src/main/java/org/glassfish/jersey/tests/integration/jersey2654/ServletFilterTestResource.java‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
/*
2+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
3+
*
4+
* Copyright (c) 2014 Oracle and/or its affiliates. All rights reserved.
5+
*
6+
* The contents of this file are subject to the terms of either the GNU
7+
* General Public License Version 2 only ("GPL") or the Common Development
8+
* and Distribution License("CDDL") (collectively, the "License"). You
9+
* may not use this file except in compliance with the License. You can
10+
* obtain a copy of the License at
11+
* http://glassfish.java.net/public/CDDL+GPL_1_1.html
12+
* or packager/legal/LICENSE.txt. See the License for the specific
13+
* language governing permissions and limitations under the License.
14+
*
15+
* When distributing the software, include this License Header Notice in each
16+
* file and include the License file at packager/legal/LICENSE.txt.
17+
*
18+
* GPL Classpath Exception:
19+
* Oracle designates this particular file as subject to the "Classpath"
20+
* exception as provided by Oracle in the GPL Version 2 section of the License
21+
* file that accompanied this code.
22+
*
23+
* Modifications:
24+
* If applicable, add the following below the License Header, with the fields
25+
* enclosed by brackets [] replaced by your own identifying information:
26+
* "Portions Copyright [year] [name of copyright owner]"
27+
*
28+
* Contributor(s):
29+
* If you wish your version of this file to be governed by only the CDDL or
30+
* only the GPL Version 2, indicate your decision by adding "[Contributor]
31+
* elects to include this software in this distribution under the [CDDL or GPL
32+
* Version 2] license." If you don't indicate a single choice of license, a
33+
* recipient has the option to distribute your version of this file under
34+
* either the CDDL, the GPL Version 2 or to extend the choice of license to
35+
* its licensees as provided above. However, if you add GPL Version 2 code
36+
* and therefore, elected the GPL Version 2 license, then the option applies
37+
* only if the new code is made subject to such option by the copyright
38+
* holder.
39+
*/
40+
package org.glassfish.jersey.tests.integration.jersey2654;
41+
42+
43+
import javax.ws.rs.DefaultValue;
44+
import javax.ws.rs.GET;
45+
import javax.ws.rs.Path;
46+
import javax.ws.rs.QueryParam;
47+
import javax.ws.rs.core.Response;
48+
49+
/**
50+
* Test resource to be called within an ServletContainer registered as servlet filter.
51+
*
52+
* @author Adam Lindenthal (adam.lindenthal at oracle.com)
53+
*/
54+
@Path("filter")
55+
public class ServletFilterTestResource {
56+
57+
@GET
58+
public Response whatYouSendIsWhatYouGet(@DefaultValue("") @QueryParam("json") final String json) {
59+
return Response.ok().entity(json).build();
60+
}
61+
}

‎tests/integration/jersey-2654/src/main/java/org/glassfish/jersey/tests/integration/jersey2654/TestApplication.java‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
/*
2+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
3+
*
4+
* Copyright (c) 2014 Oracle and/or its affiliates. All rights reserved.
5+
*
6+
* The contents of this file are subject to the terms of either the GNU
7+
* General Public License Version 2 only ("GPL") or the Common Development
8+
* and Distribution License("CDDL") (collectively, the "License"). You
9+
* may not use this file except in compliance with the License. You can
10+
* obtain a copy of the License at
11+
* http://glassfish.java.net/public/CDDL+GPL_1_1.html
12+
* or packager/legal/LICENSE.txt. See the License for the specific
13+
* language governing permissions and limitations under the License.
14+
*
15+
* When distributing the software, include this License Header Notice in each
16+
* file and include the License file at packager/legal/LICENSE.txt.
17+
*
18+
* GPL Classpath Exception:
19+
* Oracle designates this particular file as subject to the "Classpath"
20+
* exception as provided by Oracle in the GPL Version 2 section of the License
21+
* file that accompanied this code.
22+
*
23+
* Modifications:
24+
* If applicable, add the following below the License Header, with the fields
25+
* enclosed by brackets [] replaced by your own identifying information:
26+
* "Portions Copyright [year] [name of copyright owner]"
27+
*
28+
* Contributor(s):
29+
* If you wish your version of this file to be governed by only the CDDL or
30+
* only the GPL Version 2, indicate your decision by adding "[Contributor]
31+
* elects to include this software in this distribution under the [CDDL or GPL
32+
* Version 2] license." If you don't indicate a single choice of license, a
33+
* recipient has the option to distribute your version of this file under
34+
* either the CDDL, the GPL Version 2 or to extend the choice of license to
35+
* its licensees as provided above. However, if you add GPL Version 2 code
36+
* and therefore, elected the GPL Version 2 license, then the option applies
37+
* only if the new code is made subject to such option by the copyright
38+
* holder.
39+
*/
40+
package org.glassfish.jersey.tests.integration.jersey2654;
41+
42+
import java.util.HashSet;
43+
import java.util.Set;
44+
45+
import javax.ws.rs.core.Application;
46+
47+
/**
48+
* JAX-RS application to configure resources for JERSEY-2525 reproducer.
49+
*
50+
* @author Adam Lindenthal (adam.lindenthal at oracle.com)
51+
*/
52+
public class TestApplication extends Application {
53+
@Override
54+
public Set<Class<?>> getClasses() {
55+
final Set<Class<?>> classes = new HashSet<>();
56+
classes.add(ServletFilterTestResource.class);
57+
return classes;
58+
}
59+
}

‎tests/integration/jersey-2654/src/main/webapp/WEB-INF/web.xml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
4+
DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
5+
6+
Copyright (c) 2014 Oracle and/or its affiliates. All rights reserved.
7+
8+
The contents of this file are subject to the terms of either the GNU
9+
General Public License Version 2 only ("GPL") or the Common Development
10+
and Distribution License("CDDL") (collectively, the "License"). You
11+
may not use this file except in compliance with the License. You can
12+
obtain a copy of the License at
13+
http://glassfish.java.net/public/CDDL+GPL_1_1.html
14+
or packager/legal/LICENSE.txt. See the License for the specific
15+
language governing permissions and limitations under the License.
16+
17+
When distributing the software, include this License Header Notice in each
18+
file and include the License file at packager/legal/LICENSE.txt.
19+
20+
GPL Classpath Exception:
21+
Oracle designates this particular file as subject to the "Classpath"
22+
exception as provided by Oracle in the GPL Version 2 section of the License
23+
file that accompanied this code.
24+
25+
Modifications:
26+
If applicable, add the following below the License Header, with the fields
27+
enclosed by brackets [] replaced by your own identifying information:
28+
"Portions Copyright [year] [name of copyright owner]"
29+
30+
Contributor(s):
31+
If you wish your version of this file to be governed by only the CDDL or
32+
only the GPL Version 2, indicate your decision by adding "[Contributor]
33+
elects to include this software in this distribution under the [CDDL or GPL
34+
Version 2] license." If you don't indicate a single choice of license, a
35+
recipient has the option to distribute your version of this file under
36+
either the CDDL, the GPL Version 2 or to extend the choice of license to
37+
its licensees as provided above. However, if you add GPL Version 2 code
38+
and therefore, elected the GPL Version 2 license, then the option applies
39+
only if the new code is made subject to such option by the copyright
40+
holder.
41+
42+
-->
43+
44+
<web-app xmlns="http://java.sun.com/xml/ns/javaee"
45+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
46+
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
47+
version="3.0">
48+
<filter>
49+
<filter-name>MyApplication</filter-name>
50+
<filter-class>org.glassfish.jersey.servlet.ServletContainer</filter-class>
51+
<init-param>
52+
<param-name>javax.ws.rs.Application</param-name>
53+
<param-value>org.glassfish.jersey.tests.integration.jersey2654.TestApplication</param-value>
54+
</init-param>
55+
</filter>
56+
<filter-mapping>
57+
<filter-name>MyApplication</filter-name>
58+
<url-pattern>/*</url-pattern>
59+
</filter-mapping>
60+
</web-app>
61+
62+

‎tests/integration/jersey-2654/src/test/java/org/glassfish/jersey/tests/integration/jersey2654/Jersey2654ITCase.java‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
/*
2+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
3+
*
4+
* Copyright (c) 2014 Oracle and/or its affiliates. All rights reserved.
5+
*
6+
* The contents of this file are subject to the terms of either the GNU
7+
* General Public License Version 2 only ("GPL") or the Common Development
8+
* and Distribution License("CDDL") (collectively, the "License"). You
9+
* may not use this file except in compliance with the License. You can
10+
* obtain a copy of the License at
11+
* http://glassfish.java.net/public/CDDL+GPL_1_1.html
12+
* or packager/legal/LICENSE.txt. See the License for the specific
13+
* language governing permissions and limitations under the License.
14+
*
15+
* When distributing the software, include this License Header Notice in each
16+
* file and include the License file at packager/legal/LICENSE.txt.
17+
*
18+
* GPL Classpath Exception:
19+
* Oracle designates this particular file as subject to the "Classpath"
20+
* exception as provided by Oracle in the GPL Version 2 section of the License
21+
* file that accompanied this code.
22+
*
23+
* Modifications:
24+
* If applicable, add the following below the License Header, with the fields
25+
* enclosed by brackets [] replaced by your own identifying information:
26+
* "Portions Copyright [year] [name of copyright owner]"
27+
*
28+
* Contributor(s):
29+
* If you wish your version of this file to be governed by only the CDDL or
30+
* only the GPL Version 2, indicate your decision by adding "[Contributor]
31+
* elects to include this software in this distribution under the [CDDL or GPL
32+
* Version 2] license." If you don't indicate a single choice of license, a
33+
* recipient has the option to distribute your version of this file under
34+
* either the CDDL, the GPL Version 2 or to extend the choice of license to
35+
* its licensees as provided above. However, if you add GPL Version 2 code
36+
* and therefore, elected the GPL Version 2 license, then the option applies
37+
* only if the new code is made subject to such option by the copyright
38+
* holder.
39+
*/
40+
package org.glassfish.jersey.tests.integration.jersey2654;
41+
42+
import java.io.BufferedReader;
43+
import java.io.BufferedWriter;
44+
import java.io.IOException;
45+
import java.io.InputStreamReader;
46+
import java.io.OutputStreamWriter;
47+
import java.io.PrintWriter;
48+
import java.net.Socket;
49+
50+
import javax.ws.rs.core.Application;
51+
52+
import org.glassfish.jersey.test.JerseyTest;
53+
54+
import org.glassfish.jersey.test.external.ExternalTestContainerFactory;
55+
import org.glassfish.jersey.test.spi.TestContainerException;
56+
import org.glassfish.jersey.test.spi.TestContainerFactory;
57+
import org.junit.Test;
58+
59+
import static org.junit.Assert.assertEquals;
60+
61+
/**
62+
* Reproducer for JERSEY-2654
63+
*
64+
* Tests, that unencoded curly brackets (typically used in URI queries containing JSON) do not cause the request to
65+
* fail when running in a servlet environment and configured as a filter.
66+
*
67+
* @author Adam Lindenthal (adam.lindenthal at oracle.com)
68+
*/
69+
public class Jersey2654ITCase extends JerseyTest {
70+
71+
@Override
72+
protected Application configure() {
73+
return new TestApplication();
74+
}
75+
76+
@Override
77+
protected TestContainerFactory getTestContainerFactory() throws TestContainerException {
78+
return new ExternalTestContainerFactory();
79+
}
80+
81+
@Test
82+
public void testJsonInUriWithSockets() throws IOException {
83+
// Low level approach with sockets is used, because common Java HTTP clients are using java.net.URI,
84+
// which fails when unencoded curly bracket is part of the URI
85+
final Socket socket = new Socket(getBaseUri().getHost(), getBaseUri().getPort());
86+
final PrintWriter pw = new PrintWriter(new BufferedWriter(new OutputStreamWriter(socket.getOutputStream())));
87+
88+
// quotes are encoded by browsers, curly brackets are not, so the quotes will be sent pre-encoded
89+
// HTTP 1.0 is used for simplicity
90+
pw.println("GET /filter?json={%22foo%22:%22bar%22} HTTP/1.0");
91+
pw.println(); // http request should end with a blank line
92+
pw.flush();
93+
94+
final BufferedReader br = new BufferedReader(new InputStreamReader(socket.getInputStream()));
95+
96+
String lastLine = null;
97+
String line;
98+
while ((line = br.readLine()) != null) {
99+
// read the response and remember the last line
100+
lastLine = line;
101+
}
102+
assertEquals("{\"foo\":\"bar\"}", lastLine);
103+
br.close();
104+
}
105+
}

0 commit comments

Comments
 (0)