Repository navigation
[12.0.x] Reuses URIUtil.canonicalPath() for URI matching. - #15615
Merged
sbordet merged 1 commit intoAug 24, 2026
Merged
Conversation
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
lorban
approved these changes
Aug 19, 2026
github-project-automation
Bot
moved this from 👀 In review
to ✅ Done
in FROZEN Jetty 12.0.39
|
Hi @sbordet, this PR was merged without any labels. Please add at least one label (e.g., Bug, Enhancement, Documentation). |
pstreef
added a commit
to moderne-backpatch-alliance/backpatch-jetty.project
that referenced
this pull request
Oct 29, 2026
…ment boundary GHSA-j5fg-j6xp-mjwf. AbstractAuthentication.matchesURI compared the decoded request path with String.startsWith, so credentials registered for http://host/secure were also sent to /secure/../evil, to /secure2 and to any path that only shares the prefix. HttpRedirector takes a redirect to an absolute path such as /secure/../evil as it is (URI.resolve does not normalise an absolute path), so a redirect carried the Authorization header there. As upstream, both paths are now canonical before the comparison, and the registered path must end at a segment boundary of the requested one. A null scheme or host no longer throws. Adapted from upstream's 12.0.x fix (PR jetty#15615): - a7c18a8 (Simone Bordet): Reuses URIUtil.canonicalPath() for URI matching from https://github.com/eclipse/jetty.project. Jetty 12's URIUtil.canonicalPath(rawPath) does not exist in 9.4, so a private canonicalPath in AbstractAuthentication stands in for it: it strips path parameters, decodes the encoded ASCII characters of upstream's safe set (RFC 3986 unreserved plus ! $ & ' ( ) * + , : = @), keeps other encodings in upper case so %2F stays apart from '/', and removes dot segments with 9.4's URIUtil.canonicalPath (null above the root). Unlike upstream it does not decode non-ASCII UTF-8, so a non-ASCII character percent-encoded on one side and literal on the other no longer matches (stricter, never broader; Peter, 2026-10-29: "b sounds closer to upstream, do that"). Every case of upstream's test gives upstream's answer. Tests: upstream's HttpAuthenticationStoreTest#testFindAuthenticationWithURI (31 cases), its text block written as a CsvSource array for Java 8; ours, #testFindAuthenticationWithEncodedSafeCharacters: encoded and literal safe ASCII characters match, an encoded dot segment does not escape the registered path, and encoded vs literal non-ASCII does not match. Upstream-Commit: a7c18a8 Upstream-Commit: 10b4bb1 Co-authored-by: Simone Bordet <simone.bordet@gmail.com>
pstreef
added a commit
to finos-osera-forks/patch-jetty.project
that referenced
this pull request
Oct 29, 2026
…ment boundary GHSA-j5fg-j6xp-mjwf. AbstractAuthentication.matchesURI compared the decoded request path with String.startsWith, so credentials registered for http://host/secure were also sent to /secure/../evil, to /secure2 and to any path that only shares the prefix. HttpRedirector takes a redirect to an absolute path such as /secure/../evil as it is (URI.resolve does not normalise an absolute path), so a redirect carried the Authorization header there. As upstream, both paths are now canonical before the comparison, and the registered path must end at a segment boundary of the requested one. A null scheme or host no longer throws. Adapted from upstream's 12.0.x fix (PR jetty#15615): - a7c18a8 (Simone Bordet): Reuses URIUtil.canonicalPath() for URI matching from https://github.com/eclipse/jetty.project. Jetty 12's URIUtil.canonicalPath(rawPath) does not exist in 9.4, so a private canonicalPath in AbstractAuthentication stands in for it: it strips path parameters, decodes the encoded ASCII characters of upstream's safe set (RFC 3986 unreserved plus ! $ & ' ( ) * + , : = @), keeps other encodings in upper case so %2F stays apart from '/', and removes dot segments with 9.4's URIUtil.canonicalPath (null above the root). Unlike upstream it does not decode non-ASCII UTF-8, so a non-ASCII character percent-encoded on one side and literal on the other no longer matches (stricter, never broader; Peter, 2026-10-29: "b sounds closer to upstream, do that"). Every case of upstream's test gives upstream's answer. Tests: upstream's HttpAuthenticationStoreTest#testFindAuthenticationWithURI (31 cases), its text block written as a CsvSource array for Java 8; ours, #testFindAuthenticationWithEncodedSafeCharacters: encoded and literal safe ASCII characters match, an encoded dot segment does not escape the registered path, and encoded vs literal non-ASCII does not match. Upstream-Commit: a7c18a8 Upstream-Commit: 10b4bb1 Co-authored-by: Simone Bordet <simone.bordet@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
12.0.x backport of #15612