[SLING-9740] Invalid handling of requests containing URL path parameters

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Engine 2.7.2
• Fix Version/s: Engine 2.9.0
• Component/s: Engine
• Assignee: Carsten Ziegeler
• Reporter: Lars Krapf
• Created: 17/Sep/20 09:07
• Updated: 01/Apr/22 10:28
• Resolved: 15/Mar/22 17:01

Description

RequestData.initResource() has support for requests containing URL-path parameters (e.g. /path;foo=bar/path2;bar=baz/). It will split at the first semicolon, and concatenate this to the request.getPathInfo() (not containing such parameters). See RequestData.java. However, this handling is incomplete as it only covers the case where one such parameter is added at the end of the request, but path parameters can be added to any path segment, leading to unexpected results.

E.g. the following request:
http://localhost:4502/content;foo=bar/we-retail;bar=baz/us/en.html

will result in path being:
/content/we-retail/us/en.html;foo=bar/we-retail;bar=baz/us/en.html

This gets especially confusing when path normalization happens in conjunction with path parameters:
http://localhost/content/we-retail.html/..;/..;/bin/querybuilder.json.css?path=/home/users

will result in path being:
/bin/querybuilder.json.css;/..;/bin/querybuilder.json.css

after the concatenation.