Bug 60371

Summary: Manager application erroneously strips "\" from filenames when deploying WARs in IE
Product: Tomcat 8 Reporter: Coty Sutherland <csutherl>
Component: ManagerAssignee: Tomcat Developers Mailing List <dev>
Status: RESOLVED DUPLICATE    
Severity: normal    
Priority: P2    
Version: 8.0.38   
Target Milestone: ----   
Hardware: PC   
OS: All   

Description Coty Sutherland 2016-11-14 20:02:09 UTC
I've only tested this on tomcat8 with IE, but the logic looks the same (at least in the ApplicationPart class) so it may affect other versions. Steps to reproduce are:

* Startup tomcat with a user/role setup for manager-gui
* Log in and attempt to deploy a WAR from the Manager application

1) Click "Browse..." button and select a war file in field WAR file to deploy => File is selected via "input" element with type "file"

    C:\temp\test.war

2. Click deploy
3. Status of operation is OK
4. Displayed context of the application is shown:

    /C:temptest

5. Application fails to start

Additional information:

I've traced the problem down to org.apache.catalina.manager.HTMLManagerServlet:242; warPart.getSubmittedFileName() strips the '\' characters from the filename and therefore makes it incorrect before the context creation occurs. The logic for that method is encapsulated in the org.apache.catalina.core.ApplicationPart.getSubmittedFileName() method (line 152 where the call to HttpParser.unquote() returns the bad result). I would submit a patch for it, but I'm not exactly sure in what cases the \s should be stripped as the logic only works correctly at the moment with linux (I assume).
Comment 1 Violeta Georgieva 2016-11-14 20:17:24 UTC
This might be related to 59115 and the issue in IE?
Comment 2 Mark Thomas 2016-11-14 20:48:17 UTC
Yep, this is IE not following the specs. Again.

*** This bug has been marked as a duplicate of bug 59115 ***
Comment 3 Coty Sutherland 2016-11-14 20:51:58 UTC
Yeah...silly IE :) Thanks for the responses. I checked out the issue that was raised to Microsoft and apparently it was closed/wontfix.