Jetty

Unescaped URLs used by MSIE7 are not supported.

Details

  • Type: Bug Bug
  • Status: Resolved Resolved
  • Priority: Critical Critical
  • Resolution: Fixed
  • Affects Version/s: 6.1.12
  • Fix Version/s: 6.1.14
  • Component/s: HTTP
  • Labels:
    None
  • Environment:
    any
  • Number of attachments :
    1

Description

UrlEncoded.decodeString reads:

char c = encoded.charAt(offset+i);
if (c<0||c>0xff)
throw new IllegalArgumentException("Not encoded");

http://fisheye.codehaus.org/browse/jetty/jetty/trunk/core/jetty-util/src/main/java/org/mortbay/util/UrlEncoded.java?r=2468

MSIE7, however, doesn't seem to encode the localized characters in the URL, but it still econdes the special characters (e.g. space). This leads to the following problem:
if we use a localized symbols in the URL without a space, everything works,
but when we use a localized symbols and special symbols together (e.g. using a space to separate the words)
then UrlEncoded.decodeTo says the URL is "encoded" and so UrlEncoded.decodeString throws an exception.

java.lang.IllegalArgumentException: Not encoded
at org.mortbay.util.UrlEncoded.decodeString(UrlEncoded.java:617)
at org.mortbay.util.UrlEncoded.decodeTo(UrlEncoded.java:226)
at org.mortbay.jetty.EncodedHttpURI.decodeQueryTo(EncodedHttpURI.java:123)
at org.mortbay.jetty.Request.extractParameters(Request.java:1409)
at org.mortbay.jetty.Request.getParameter(Request.java:765)

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Greg Wilkins added a comment -

MSIE is rubbish!

Can you send me an actual example of a URL in this mixed mode.
Can you confirm the localized characters are being sent in UTF-8?

thanks

Show
Greg Wilkins added a comment - MSIE is rubbish! Can you send me an actual example of a URL in this mixed mode. Can you confirm the localized characters are being sent in UTF-8? thanks
Hide
Permalink
Greg Wilkins added a comment -

Can you please try this patch ASAP?

thanks

Show
Greg Wilkins added a comment - Can you please try this patch ASAP? thanks
Hide
Permalink
Artem Kozarezov added a comment -

> Can you send me an actual example of a URL in this mixed mode.

http://glim.ru/JETTY-787/
(The first link ("moscow ballet") works in other browsers, gives exception in MSIE7)

> Can you confirm the localized characters are being sent in UTF-8?

I wrote the following script to capture the query string:

#!/usr/bin/perl
print "Content-Type: text/html\n\n";
print "<HTML><BODY>$ENV

{'QUERY_STRING'}</BODY></HTML>";
open(fh, '>/tmp/JETTY-787') or die; print fh $ENV{'QUERY_STRING'}

; close fh;

When I follow the second link ("safe to file") from the http://glim.ru/JETTY-787/ page, which itself is in UTF-8, then I see UTF-8 encoding in the file.
However, when I change the URL by hand (for example, add a few more words), and so the MSIE no longer goes from a UTF-8 page but "from the URL", then encoding captured in the file is "windows-1251".
This is consistent with how MSIE6 behaved, the only difference is that localized characters are no longer %-escaped.

> Can you please try this patch ASAP?

Sorry, right now I'm away from the computer where I usually build the Jetty.

Show
Artem Kozarezov added a comment - > Can you send me an actual example of a URL in this mixed mode. http://glim.ru/JETTY-787/ (The first link ("moscow ballet") works in other browsers, gives exception in MSIE7) > Can you confirm the localized characters are being sent in UTF-8? I wrote the following script to capture the query string: #!/usr/bin/perl print "Content-Type: text/html\n\n"; print "<HTML><BODY>$ENV {'QUERY_STRING'}</BODY></HTML>"; open(fh, '>/tmp/ JETTY-787 ') or die; print fh $ENV{'QUERY_STRING'} ; close fh; When I follow the second link ("safe to file") from the http://glim.ru/JETTY-787/ page, which itself is in UTF-8, then I see UTF-8 encoding in the file. However, when I change the URL by hand (for example, add a few more words), and so the MSIE no longer goes from a UTF-8 page but "from the URL", then encoding captured in the file is "windows-1251". This is consistent with how MSIE6 behaved, the only difference is that localized characters are no longer %-escaped. > Can you please try this patch ASAP? Sorry, right now I'm away from the computer where I usually build the Jetty.
Hide
Permalink
Artem Kozarezov added a comment -

BTW, as I wrote in JETTY-113, there is no way for Jetty to properly decode localized characters without special heuristic (for example, knowing some part of the parameter beforehand in order to match the proper character encoding later, for example - using localized parameter names).
So, i DON'T use jetty.Request.getParameter to access localized parameters, I only use it to access english-only parameters.
To access localized parameters I use raw queryString.
All the more pity that Jetty fails the whole request because of the parameters which I don't even need.

Show
Artem Kozarezov added a comment - BTW, as I wrote in JETTY-113 , there is no way for Jetty to properly decode localized characters without special heuristic (for example, knowing some part of the parameter beforehand in order to match the proper character encoding later, for example - using localized parameter names). So, i DON'T use jetty.Request.getParameter to access localized parameters, I only use it to access english-only parameters. To access localized parameters I use raw queryString. All the more pity that Jetty fails the whole request because of the parameters which I don't even need.
Hide
Permalink
Greg Wilkins added a comment -

Artem,

I think a lot of the problem is due to browsers not setting the charset of the content they have used for POST content, plus URL should only be in UTF-8.

However, jetty should not decode the parameters unless you call getParameter or some other parameter method. If you don't call any such methods, then Jetty will not attempt to extract the content and should not fail.

Note that I have committed the patch.

thanks

Show
Greg Wilkins added a comment - Artem, I think a lot of the problem is due to browsers not setting the charset of the content they have used for POST content, plus URL should only be in UTF-8. However, jetty should not decode the parameters unless you call getParameter or some other parameter method. If you don't call any such methods, then Jetty will not attempt to extract the content and should not fail. Note that I have committed the patch. thanks
Hide
Permalink
Artem Kozarezov added a comment -

> Note that I have committed the patch.

Thanks! I will try it next time I will have the opportunity to check out Jetty.

Show
Artem Kozarezov added a comment - > Note that I have committed the patch. Thanks! I will try it next time I will have the opportunity to check out Jetty.
Hide
Permalink
Artem Kozarezov added a comment -

I've checked with the latest 6.1.14, it works! Thanks.

Show
Artem Kozarezov added a comment - I've checked with the latest 6.1.14, it works! Thanks.

People

  • Assignee:
    Greg Wilkins
    Reporter:
    Artem Kozarezov
Vote (0)
Watch (0)

Dates

  • Created:
    Updated:
    Resolved: