Jetty 12.0.x canonical uri (#8343)

Somehow the URIUtil class had switched over the meaning of normal and canonical. This PR renames them to correct this: * canonical paths are always normal * Always canonicalize paths passed from the application * Switch the URIUtil names for canonical and normal
jetty · Jul 26, 2022 · d369adf · d369adf
1 parent 32ef161
commit d369adf
Show file tree

Hide file tree

Showing 15 changed files with 137 additions and 145 deletions.
diff --git a/jetty-core/jetty-http/src/main/java/org/eclipse/jetty/http/HttpURI.java b/jetty-core/jetty-http/src/main/java/org/eclipse/jetty/http/HttpURI.java
@@ -381,7 +381,7 @@ public String getDecodedPath()
         public String getCanonicalPath()
         {
             if (_canonicalPath == null && _path != null)
-                _canonicalPath = URIUtil.canonicalPath(URIUtil.normalizePath(_path));
+                _canonicalPath = URIUtil.canonicalPath(_path);
             return _canonicalPath;
         }
 
@@ -532,7 +532,7 @@ private enum State
          * <a href="https://tools.ietf.org/html/rfc3986#section-5.2.4">Remove Dot Segments</a>
          * algorithm.  This results in some ambiguity as dot segments can result from later
          * parameter removal or % encoding expansion, that are not removed from the URI
-         * by {@link URIUtil#canonicalPath(String)}.  Thus this class flags such ambiguous
+         * by {@link URIUtil#normalizePath(String)}.  Thus this class flags such ambiguous
          * path segments, so that they may be rejected by the server if so configured.
          */
         private static final Index<Boolean> __ambiguousSegments = new Index.Builder<Boolean>()
@@ -750,7 +750,7 @@ public String getDecodedPath()
         public String getCanonicalPath()
         {
             if (_canonicalPath == null && _path != null)
-                _canonicalPath = URIUtil.canonicalPath(URIUtil.normalizePath(_path));
+                _canonicalPath = URIUtil.canonicalPath(_path);
             return _canonicalPath;
         }
 
@@ -1412,8 +1412,7 @@ else if (_path != null)
             {
                 // The RFC requires this to be canonical before decoding, but this can leave dot segments and dot dot segments
                 // which are not canonicalized and could be used in an attempt to bypass security checks.
-                String decodedNonCanonical = URIUtil.normalizePath(_path);
-                _canonicalPath = URIUtil.canonicalPath(decodedNonCanonical);
+                _canonicalPath = URIUtil.canonicalPath(_path);
                 if (_canonicalPath == null)
                     throw new IllegalArgumentException("Bad URI");
             }

diff --git a/jetty-core/jetty-http/src/test/java/org/eclipse/jetty/http/HttpURITest.java b/jetty-core/jetty-http/src/test/java/org/eclipse/jetty/http/HttpURITest.java
@@ -487,8 +487,8 @@ public void testDecodedPath(String input, String canonicalPath, String decodedPa
         try
         {
             HttpURI uri = HttpURI.from(input);
-            assertThat(uri.getCanonicalPath(), is(canonicalPath));
             assertThat(uri.getDecodedPath(), is(decodedPath));
+
             EnumSet<Violation> ambiguous = EnumSet.copyOf(expected);
             ambiguous.retainAll(EnumSet.complementOf(EnumSet.of(Violation.UTF16_ENCODINGS)));
 

diff --git a/jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/Request.java b/jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/Request.java
@@ -393,14 +393,14 @@ static String toRedirectURI(Request request, String location)
             if (location.startsWith("/"))
             {
                 // absolute in context
-                location = URIUtil.canonicalURI(location);
+                location = URIUtil.normalizePathQuery(location);
             }
             else
             {
                 // relative to request
                 String path = uri.getPath();
                 String parent = (path.endsWith("/")) ? path : URIUtil.parentPath(path);
-                location = URIUtil.canonicalURI(URIUtil.addEncodedPaths(parent, location));
+                location = URIUtil.normalizePathQuery(URIUtil.addEncodedPaths(parent, location));
                 if (location != null && !location.startsWith("/"))
                     url.append('/');
             }