Package com.sun.identity.federation.common

Class ForwardPathValidator

java.lang.Object

com.sun.identity.federation.common.ForwardPathValidator

public final class ForwardPathValidator
extends Object

Sanity checks for request-derived values before they are handed to a RequestDispatcher. A forward is served from inside the web application: it can reach /WEB-INF and /META-INF, and it does not run the filters declared in web.xml, so a path an end user controls must never be allowed to climb out of the location the code intends to dispatch to.

The container processes a dispatcher path in a fixed order before it maps it (Tomcat ApplicationContext.getRequestDispatcher, with dispatchersUseEncodedPaths on by default): the query string is cut, ;params are stripped from the raw string (each ; up to the next raw /), the rest is percent-decoded once, and // and /./ are collapsed. The checks here follow that order: traversal is refused in the raw form and again in the decoded form, and the reserved-directory check reads the stripped, decoded, collapsed path. An escape that decodes to a URL delimiter (%25, %3F, %23, %3B) or to something that is not UTF-8 is refused outright: no in-app path of the product carries one.

Method Summary

Modifier and Type	Method	Description
static boolean	isSafeForwardPath(String path)	Whether path may be forwarded to as-is: absolute, without .. segments in its raw or decoded form (path parameters stripped, as the container does), without backslashes, control characters, malformed or delimiter escapes, and not under a reserved directory once collapsed.
static boolean	isSafeMetaAlias(String metaAlias)	Whether metaAlias can be appended to a fixed handler path without changing which resource is dispatched to.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

isSafeForwardPath

public static boolean isSafeForwardPath(String path)

Whether path may be forwarded to as-is: absolute, without .. segments in its raw or decoded form (path parameters stripped, as the container does), without backslashes, control characters, malformed or delimiter escapes, and not under a reserved directory once collapsed.

Parameters:

path - a context-relative path, optionally with a query string

Returns:

true if the path is safe to pass to a request dispatcher

isSafeMetaAlias

public static boolean isSafeMetaAlias(String metaAlias)

Whether metaAlias can be appended to a fixed handler path without changing which resource is dispatched to.

Parameters:

metaAlias - the provider meta alias taken from the request

Returns:

true if the alias contains no traversal