Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bad behaviour in setting attributes #910

Closed
MV88 opened this issue Aug 3, 2016 · 3 comments
Closed

Bad behaviour in setting attributes #910

MV88 opened this issue Aug 3, 2016 · 3 comments
Labels
investigation

Comments

@MV88
Copy link
Contributor

MV88 commented Aug 3, 2016 •
edited by etj
Loading

There is a different behaviour when an attribute’s value is being updated on GeoStore:
This is the curl command im using:

curl -v -u admin:admin -XPUT 'http://localhost:8085/geostore/rest/resources/resource/13/attributes/thumbnail/http%3A%2F%2Fdemo.geo-solutions.it%2Fshare%2FMapStore2-previews%2Fhisto-flowrence.png'

results:

  • Tomcat : HTTP/1.1 400 Bad Request
  • Jetty : HTTP/1.1 200 Ok

This is the base value that needs to be encoded twice on Tomcat and only once with Jetty:
http://demo.geo-solutions.it/share/MapStore2-previews/histo-flowrence.png

I also have some problems with this request using postman ( Cross-Origin Resource Sharing (CORS) Filter: Unsupported HTTP method, 405 Method not allowed)
@etj
Copy link
Member

etj commented Aug 3, 2016

This is the behaviour using mvn jetty:run (running a single uriencoding on the URL that we have to store as an attribute value):

$ curl -i -u admin:admin  -XPUT 'http://localhost:9191/geostore/rest/resources/resource/1/attributes/test/http%3A%2F%2Fdemo.geo-solutions.it%2Fshare%2FMapStore2-previews%2Fhisto-flowrence.png'

HTTP/1.1 200 OK

This is the resulting resource content:

$ curl -u  admin:admin 'http://localhost:9191/geostore/rest/resources/resource/1'  | xmlstarlet fo'

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Resource>
  <Attributes>
    <attribute type="STRING">
      <name>test</name>
      <value>http://demo.geo-solutions.it/share/MapStore2-previews/histo-flowrence.png</value>
    </attribute>
  </Attributes>
  <category>
    <id>3</id>
    <name>TestCategory1</name>
  </category>
  <creation>2016-08-02T18:10:42.160+02:00</creation>
  <id>1</id>
  <name>r1</name>
</Resource>

Also, the value of the attribute alone, is returned properly decoded:

curl  -u  admin:admin 'http://localhost:9191/geostore/rest/resources/resource/1/attributes/test' 

http://demo.geo-solutions.it/share/MapStore2-previews/histo-flowrence.png

@etj
Copy link
Member

etj commented Aug 3, 2016

This is the behaviour using a tomcat instance behind an apache httpd server, using a single uriencoded URL:

$ curl -i -u user:pw -XPUT 'http://mapstore.geo-solutions.it/geostore/rest/resources/resource/808/attributes/test/http%3A%2F%2Fdemo.geo-solutions.it%2Fshare%2FMapStore2-previews%2Fhisto-flowrence.png'

HTTP/1.1 404 Not Found
Date: Wed, 03 Aug 2016 08:31:03 GMT
Server: Apache/2.2.15 (CentOS)
Content-Length: 415
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /geostore/rest/resources/resource/808/attributes/test/http://demo.geo-solutions.it/share/MapStore2-previews/histo-flowrence.png was not found on this server.</p>
<hr>
<address>Apache/2.2.15 (CentOS) Server at mapstore.geo-solutions.it Port 80</address>
</body></html>

Notice that PUTting an attribute value without slashes (albeit uriencoded) is working;
for instance PUTting to the URL:

http://mapstore.geo-solutions.it/geostore/rest/resources/resource/808/attributes/test/test_content_without_slashes'

Probably some logic in the container is decoding the urlEncoded part, and will provide to the REST framework a URL where the slashes that should be part of the attribute value are parsed as part of the REST path; in this case the REST framework will not recognise the REST path and wil return a 404.

By encoding the attribute value twice, the encoded slashes will be "protected":

$ curl -i -u user:pw -XPUT 'http://mapstore.geo-solutions.it/geostore/rest/resources/resource/808/attributes/test/http%253A%252F%252Ftest%252Ftest'

HTTP/1.1 200 OK
Date: Wed, 03 Aug 2016 09:08:22 GMT
Server: Apache-Coyote/1.1
Content-Type: text/plain; charset=UTF-8
Content-Length: 3
Via: 1.1 mapstore.geo-solutions.it (Apache/2.2.15)
Connection: close

but we'll need to decode the retrieved value:

$ curl -u user:pw 'http://mapstore.geo-solutions.it/geostore/rest/resources/resource/808/attributes/test'

http%3A%2F%2Ftest%2Ftest

@MV88 MV88 mentioned this issue Aug 3, 2016
Closed
@MV88 MV88 mentioned this issue Nov 24, 2016
Open
@MV88
Copy link
Contributor Author

MV88 commented Nov 24, 2016

Closed and opened an issue in Geostore.

@MV88 MV88 closed this as completed Nov 24, 2016
@snyk-bot snyk-bot mentioned this issue Apr 27, 2021
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
investigation
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@etj @MV88