RequestMapping maps double-slashes to single slashes [SPR-11220]

[spring-projects-issues]

Jeff Conrad opened SPR-11220 and commented

I was attempting to resolve a URL coming in from googlebot which had double-slashes, "//".

It doesn't seem like @RequestMapping annotation is handling these explicitly as one would expect.

Attached is a test case @Controller, a running shell script, and the output. The output indicates that double-slash requests are also accepting single-slash inputs, force-removing the difference between double and single slash on the controller side.

---

Affects: 3.0.5

Attachments:

• slash.out (163 bytes)
• slash.sh (163 bytes)
• SlashTestController.java (1.83 kB)

Issue Links:

• Two trailing slashes and the default servlet cannot resolve to a controller [SPR-12372] #16979 Two trailing slashes and the default servlet cannot resolve to a controller

1 votes, 4 watchers

[spring-projects-issues]

Dmitry Bedrin commented

At least in current implementation (4.3.4) this bug is caused by a fix of #16979:

private String getSanitizedPath(final String path) {
     String sanitized = path;
     while (true) {
          int index = sanitized.indexOf("//");
          if (index < 0) {
               break;
          }
          else {
               sanitized = sanitized.substring(0, index) + sanitized.substring(index + 1);
          }
     }
     return sanitized;
}

[spring-projects-issues]

Brian Clozel commented

Hi Jeff Conrad,

I believe Servlet Containers, http servers, browsers tend to sanitize and normalize request paths for security and compatibility reasons.

As far as I understand, supporting this in Spring Framework would probably clash with Spring Security (which does sanitize the request path) and some Servlet containers. Also, I think that the RFC shows that this syntax is illegal.

I'm quite curious about the motivation behind this use case. Why would you want to have different responses for single/double slash variants?

Thanks for your report!

[spring-projects-issues]

Jeff Conrad commented

I personally don't want to overload my restful paths, but as mentioned above somehow, Google bot is calling those urls. The paths come in as if there are 2 subpaths to a url that is expecting 3 and failing. Apparently firewalls, networking software and tomcat are honoring the double slash, it is spring that was changing it. While I can workaround with filters it seems like something added which helps someone' particular situation but hinders something else and best left out of a common library.