Actions
bug #9218
closedChange /registrationDTO/identifier/... signatures to use query parameters instead
Status:
Closed
Priority:
Highest
Assignee:
Category:
cdmlib-remote
Target version:
Start date:
Due date:
% Done:
100%
Estimated time:
Severity:
normal
Found in Version:
Description
Using slashes, double slashes, back slashes in URLs has security implications (see CVE-2007-0450). More recent spring-security releases (e.g. >4.2.18.RELEASE) therefore reject urls like these here:
http://cdmserver.org/registrationDTO/identifier/http://testbank.org/100001 http://cdmserver.org/registrationDTO/identifier/http%3A%2F%2Ftestbank.org%2F100001
The apache configuration also needs a special security configuration to allow encoded slashes (see also #7563)
# # NOTE: AllowEncodedSlashes is off per default to prevent possible security vulnerabilities. # To allow the cdmserver resolving http identifiers via HTTP GET requests it is required to # allow encoded slashes. See https://dev.e-taxonomy.eu/redmine/issues/7563 # AllowEncodedSlashes On
We should completely abstain from using slashes or double slashed in the requests to the RegistrationDTOController
by introducing according query parameters instead
Related issues
Updated by Andreas Kohlbecker about 3 years ago
- Related to bug #7563: requests with %2F in URL are rejected by apache added
Updated by Andreas Kohlbecker about 3 years ago
- Related to task #9219: Revert: requests with %2F in URL are rejected by apache added
Updated by Andreas Kohlbecker about 3 years ago
- Related to bug #9220: adapt dataportal to /registrationDTO now using identifier as query parameter and secure against CVE-2007-0450 vulnerability added
Updated by Andreas Kohlbecker about 3 years ago
- Status changed from New to Resolved
- % Done changed from 0 to 50
Applied in changeset cdmlib|ab4c6c1209ce78cbcce640a6dcbce1e4b1241195.
Updated by Andreas Kohlbecker about 3 years ago
- Related to deleted (task #9219: Revert: requests with %2F in URL are rejected by apache )
Updated by Andreas Kohlbecker about 3 years ago
- Related to task #9275: Cleanup apache configuration from "AllowEncodedSlashes On" added
Updated by Andreas Kohlbecker about 3 years ago
- Status changed from Resolved to Closed
- % Done changed from 50 to 100
can be closed now that remaining tasks are copied to #9275
Actions