Mantis - Resin
Viewing Issue Advanced Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
157 minor always 05-11-05 00:00 11-30-05 14:44
Reporter: user142 Platform:  
Assigned To: OS:  
Priority: normal OS Version:  
Status: closed Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 3.0.14  
Summary: 0000157: <security-constraint> fails when url has query string
Description: RSN-155
With the following config settings:

<host host-name="www.hogwarts.com" secure-host-name="secure.hogwarts.com">
...
</host>
<web-app-default>
  <security-constraint>
    <web-resource-collection>
      <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <user-data-constraint transport-guarantee="CONFIDENTIAL"/>
  </security-constraint>
</web-app-default>

Intended to force all users into HTTPS mode, the automatic redirect fails if the URL has a query string on it. In this scenario, navigating to "http://www.hogwarts.com?test=foobar" [^] sends you to "https://secure.hogwarts.comtest=foobar". [^] This results in a 404 NOT FOUND since the question mark has been stripped.
Steps To Reproduce:
Additional Information: Win XP, Win2k
Relationships
Attached Files:

Notes
(0000186)
user142   
05-11-05 00:00   
--- TransportConstraint.java.orig Sat Mar 5 12:17:00 2005
+++ TransportConstraint.java Wed May 11 15:03:32 2005
@@ -90,7 +90,7 @@
       if (request.getPathInfo() != null)
     url += request.getPathInfo();
       if (request.getQueryString() != null)
- url += request.getQueryString();
+ url += "?" + request.getQueryString();
 
       response.sendRedirect(url);
       return false;
(0000187)
ferg   
05-11-05 00:00   
server/12h0