[SHIRO-509] WebUtils.decodeAndCleanUriString incorrectly handles matrix parameters

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.2.2
• Component/s: Web
• Environment: Webapp deployment in Jetty
• Assignee: Unassigned
• Reporter: Mark Hale
• Created: 10/Jul/14 14:14
• Updated: 06/Oct/15 19:58

Description

If I config a web filter (say anon) for a path /**/public and make a request to /mystuff;filter=toys/prices/public the filter is not triggered because WebUtils.decodeAndCleanUriString() removes everything after the ';' (so it only tries to match on /mystuff). The fix is to change
int semicolonIndex = uri.indexOf(';');
to
int lastSlash = uri.lastIndexOf('/');
int semicolonIndex = uri.lastIndexOf(';');
if(semicolonIndex > lastSlash) then drop trailing matrix params. So that matrix params in parent path segments are left intact.