|
| Issue Type: |
Improvement Bug |
| Description: |
Application servers like Jetty and Tomcat started forbidding some special character in the URIs path for a while (leading us to find configuration for them) but the servlet 6 specifications actually made those protections (and more) official. It also made it much more complex to configure Jetty and Tomcat to allow those characters…
Here are more details on what exactly is forbidden in the specification: https://github.com/jakartaee/servlet/blob/6.0.0-RELEASE/spec/src/main/asciidoc/servlet-spec-body.adoc#352-uri-path-canonicalization.
So if we want to be good Servlet citizen we need to stop having this kind of URIs URI .
There are two ways:
* pass those characters through URL parameters instead of path
* forbid those characters on XWiki side too
There is no central place we can easily fix to fix everything, many totally different features in XWiki (and in Contrib extensions) have their own format of URL.
The goal of this issue is to aggregate all those specific features which need to be fixed to have an idea of where we stand in general on this subject:
See also XWIKI-19081
In order to not have to configure jetty with * legacy actions ( {{ jetty.httpConfig.uriCompliance=RFC3986 /bin/<action>/ }} we would need to fix all places in XWiki where URL path elements can contain the % symbol (which gets encoded as %25 ) entities URLs
Some examples:
* Various APIs manipulating Space {{ / Doc names - For this we could forbid the % characters in page names by default, same as we do for rest / and \ for Tomcat }} resources URLs
* Async * entities rest resources
** job REST API which take double encoded ids in input. Thus, any character in the job id that contains characters that are special URL characters ({{: / ? # [ ] @ ! $ & ' ( ) rest resources
* + , ; =}}) are url-encoded, leading to % being used, which then is encoded as %25 and triggers the Jetty URL compliance check. For example, if the async macro is used on a page that contains any * TODO: list missing types of these characters. resources
* Generic Job REST API when the id contains a %. While nothing prevent it, it currently tends to be rare in XWiki Standard except for jobs related to pages which resource reference contains a % (which could be fixed by a general embargo on % in pages references as described in a previous point) and async rendering jobs (which are currently generally manipulated through a dedicated API, but it would affect XWIKI-16666) but that could change with new kind of jobs. handlers
* <add other places here>
* TODO: list missing types of resources |
| Priority: |
Minor Major |
|
