Open
Description
We use Resin 4.0.48 application server and his implementation of Servlet API make Spring Hateoas ( 0.23.0) Links broken. Here an example
We've got bellow controller, which builds Link to himself.
@RestController
public class SemicolonBreakableController {
@RequestMapping(path = "/blabla/9999/sort/{sortKey}", method = RequestMethod.GET)
@ResponseBody
public Link blablaFragment(@PathVariable("sortKey") String sortKey) {
ControllerLinkBuilder linkBuilder = linkTo(
methodOn(SemicolonBreakableController.class).blablaFragment("default"));
return linkBuilder.withSelfRel();
}
}Now we've got following request with kinda HTML atack: http://localhost:8080/blabla/9999/sort/'style='font-size:100pxbackground:%23ccc'onmouseover=alert`xss`>XSS!<x
Actually we want that we get bellow JSON, because we set always sortKey to "default"
{"rel":"self","href":"http://localhost:8080/blabla/9999/sort/default"}
But we get something like this:
{"rel":"self","href":"http://localhost:8080/blabla/9999/sort/'style='font-size:100px;background:#ccc'onmouseover=alert`xss`>XSS!<x/blabla/9999/start/0/sort/default"}
So the part /blabla/9999/sort/ is somehow twice.
I think the problem is in the method UrlPathHelper.getPathWithinServletMapping, where you get
String pathWithinApp = getPathWithinApplication(request);
String servletPath = getServletPath(request);
during the debugging I saw the value of these variables were:
pathWithinApp = "/blabla/9999/sort/'style='font-size:100px"
servletPath = "/blabla/9999/sort/'style='font-size:100px;background:#ccc'onmouseover=alert`xss`>;XSS!<x"