[WICKET-1624] ServletWebRequest.getRelativePathPrefixToContextRoot() double decodes servlet path

• Type: Sub-task
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 1.3.3, 1.4-M1
• Fix Version/s: 1.4-RC1
• Component/s: wicket
• Environment: Tomcat 6.0.16 on Mac OS X.
• Assignee: Johan Compagner
• Reporter: Doug Donohoe
• Created: 13/May/08 00:03
• Updated: 01/Feb/09 19:09
• Resolved: 03/Aug/08 14:52

Description

The following line in ServletWebRequest.getRelativePathPrefixToContextRoot()

String servletPath = RequestUtils.decode(getServletPath());

causes problems with relative path for CSS and images. I believe it is because the servlet path is already URL decoded. Running it again causes things that shouldn't be decoded to be decoded. For example,

%2B gets URL decoded to a plus . But, running it again causes any + to be decoded to a space. This causes the endsWith() check to fail when it shouldn't. Because that fails, more "../" get prepended than is correct.

I'll attach a quickstart which demonstrates the problem.

I think the fix is to remove the RequestUtils.decode() call above, but someone closer to the code might feel this breaks something.

Issue Links

• is duplicated by: WICKET-1663 Wicket tries to decode servlet path that already has been decoded by servlet container