Package com.sun.identity.federation.common

Class ForwardPathValidator

  • public final class ForwardPathValidator
extends Object
    Sanity checks for request-derived values before they are handed to a RequestDispatcher. A forward is served from inside the web application: it can reach /WEB-INF and /META-INF, and it does not run the filters declared in web.xml, so a path an end user controls must never be allowed to climb out of the location the code intends to dispatch to.

    The container processes a dispatcher path in a fixed order before it maps it (Tomcat ApplicationContext.getRequestDispatcher, with dispatchersUseEncodedPaths on by default): the query string is cut, ;params are stripped from the raw string (each ; up to the next raw /), the rest is percent-decoded once, and // and /./ are collapsed. The checks here follow that order: traversal is refused in the raw form and again in the decoded form, and the reserved-directory check reads the stripped, decoded, collapsed path. An escape that decodes to a URL delimiter (%25, %3F, %23, %3B) or to something that is not UTF-8 is refused outright: no in-app path of the product carries one.

    • Method Detail

      • isSafeForwardPath

        public static boolean isSafeForwardPath​(String path)
        Whether path may be forwarded to as-is: absolute, without .. segments in its raw or decoded form (path parameters stripped, as the container does), without backslashes, control characters, malformed or delimiter escapes, and not under a reserved directory once collapsed.
        Parameters:
        path - a context-relative path, optionally with a query string
        Returns:
        true if the path is safe to pass to a request dispatcher

      • forwardTarget

        public static String forwardTarget​(String path)
        The path to hand to a RequestDispatcher for path, or null when path must not be dispatched to. The result is the form the container maps - path parameters stripped and percent-escapes decoded once, + kept literal - with the query string as it was given.

        Beyond isSafeForwardPath(java.lang.String) the dispatcher form is refused when it carries a WEB-INF segment anywhere, not only at the root: no in-app path of the product does. The decoded form is derived and re-checked here in the shape static analysis recognises as a sanitised forward target, so the checks read as a repetition of what isSafeForwardPath established.

        Parameters:
        path - a context-relative path, optionally with a query string
        Returns:
        the path to dispatch to, or null if it is not a plain in-app path

      • isSafeMetaAlias

        public static boolean isSafeMetaAlias​(String metaAlias)
        Whether metaAlias can be appended to a fixed handler path without changing which resource is dispatched to.
        Parameters:
        metaAlias - the provider meta alias taken from the request
        Returns:
        true if the alias contains no traversal