Re: [servlet-dev] Clarification per #18 - draft for review

[Mark Thomas <markt@xxxxxxxxxx>]

Updated.

Changing the title changed the link. It is now:

https://github.com/eclipse-ee4j/servlet-api/wiki/URI-Path-Canonicalization

Mark


On 01/10/2021 16:30, Mark Thomas wrote:
> On 01/10/2021 15:55, Joakim Erdfelt wrote:
> > The text makes it seem more of a URI _Path_ Canonicalization.
>
> It is. I'll update the text.
>
> > First thing that jumps out at me is the do not decode `%2F` and `%2C` 
> > lines.
> > Did you mean `%2C` (comma ",")?
>
> Sorry. Typo. I meant %5C - '\'. I'll fix that. I need to add '\' as well.
>
> > Perhaps you meant `%25` (percent symbol "%")
> >
> > Also what about a unicode sequence that ends in those two?
> > What about someone that wants to access a resource (on the filesytem 
> > or in a META-INF/resources) that has 
> > `/path;of/some;thing/like;this/main.css`?  The only way to access that 
> > is using encoded %3B, right?
> > Now what if it's stored on disk (or META-INF/resources) like 
> > `/path%3Bof/some%3Bthing/like%3Bthis/main.css`? That would mean 
> > accessing it with `%253B` encoded percent then "3B", right? (have to 
> > be careful of double-decode here, as usual)
> > Why only `%2F` (forward slash "/") and not also `%5C` (backslash "\")? 
> > Seems like that has multiple meanings too. (windows pathsep, escaping, 
> > etc)
> > The META-INF/resources layer in JAR files makes things ambiguous here 
> > too. (you can create a JAR file with backslash character in the 
> > filename on Linux, but cannot access it on Windows, and vice-versa 
> > with the forward slash character).
>
> I think the short version is that won't be allowed by default. 
> Containers might provide an option to enable it.
>
> Thanks for the review.
>
> Mark
>
> > On Fri, Oct 1, 2021 at 5:59 AM Mark Thomas <markt@xxxxxxxxxx 
> > <mailto:markt@xxxxxxxxxx>> wrote:
> >
> >     Hi all,
> >
> >     The draft of the proposed clarification for URI canonicalization 
> > is on
> >     the wiki:
> >     
> > https://github.com/eclipse-ee4j/servlet-api/wiki/URI-Canonicalization 
> > <https://github.com/eclipse-ee4j/servlet-api/wiki/URI-Canonicalization>
> >
> >     Feedback welcome.
> >
> >     Mark
> >     _______________________________________________
> >     servlet-dev mailing list
> >     servlet-dev@xxxxxxxxxxx <mailto:servlet-dev@xxxxxxxxxxx>
> >     To unsubscribe from this list, visit
> >     https://www.eclipse.org/mailman/listinfo/servlet-dev
> >     <https://www.eclipse.org/mailman/listinfo/servlet-dev>
> >
> >
> > _______________________________________________
> > servlet-dev mailing list
> > servlet-dev@xxxxxxxxxxx
> > To unsubscribe from this list, visit 
> > https://www.eclipse.org/mailman/listinfo/servlet-dev
>
> _______________________________________________
> servlet-dev mailing list
> servlet-dev@xxxxxxxxxxx
> To unsubscribe from this list, visit 
> https://www.eclipse.org/mailman/listinfo/servlet-dev