Bug 58228 - ApplicationContext.GET_RESOURCE_REQUIRE_SLASH vs StandardRoot.getResource(String)
Summary: ApplicationContext.GET_RESOURCE_REQUIRE_SLASH vs StandardRoot.getResource(Str...
Alias: None
Product: Tomcat 8
Classification: Unclassified
Component: Catalina (show other bugs)
Version: 8.0.28
Hardware: All All
: P2 regression (vote)
Target Milestone: ----
Assignee: Tomcat Developers Mailing List
: 58455 (view as bug list)
Depends on:
Reported: 2015-08-09 23:29 UTC by Thomas Maslen
Modified: 2015-11-03 11:01 UTC (History)
3 users (show)

Add opportunity for getRealPath(String) to change behavior in according to value of ApplicationContext.GET_RESOURCE_REQUIRE_SLASH (1.62 KB, patch)
2015-10-30 10:35 UTC, Viacheslav
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Maslen 2015-08-09 23:29:38 UTC
If ApplicationContext.GET_RESOURCE_REQUIRE_SLASH == true then all is good:  ApplicationContext.getResourceAsStream(String) checks whether the path has a leading slash and, if not, returns null.

If ApplicationContext.GET_RESOURCE_REQUIRE_SLASH == false then ApplicationContext.getResourceAsStream(String) ends up delegating to StandardRoot.getResource(String) and thence to StandardRoot.validate(String), which (regardless of the GET_RESOURCE_REQUIRE_SLASH value) throws IllegalArgumentException if the path doesn't have a leading slash.
Comment 1 Thomas Maslen 2015-08-09 23:49:12 UTC
With the caveat that I may not have thought this through...

If StandardRoot.validate(String) isn't going to change (i.e. it will continue to throw IllegalArgumentException for paths that don't have a leading slash), then perhaps one way to make GET_RESOURCE_REQUIRE_SLASH == false behave as documented would be to doctor the offending path (i.e. prepend "/") before passing it on.
Perhaps something roughly like:


        if (!path.startsWith("/") && GET_RESOURCE_REQUIRE_SLASH)
            return null;


        if (!path.startsWith("/")) {
                return null;
                path = "/" + path;

The ApplicationContext.getResource(String) method might also need similar-ish treatment.
Comment 2 Mark Thomas 2015-08-12 09:36:23 UTC
Thanks for the report. This has been fixed in trunk and 8.0.x (for 8.0.25 onwards). I did use a variation of the patch you proposed. The actua patch was a little more generic and handled getResource() and getResourceAsStream()
Comment 3 Violeta Georgieva 2015-09-24 11:00:50 UTC
*** Bug 58455 has been marked as a duplicate of this bug. ***
Comment 4 Viacheslav 2015-10-30 10:35:47 UTC
Created attachment 33233 [details]
Add opportunity for getRealPath(String) to change behavior in according to value of ApplicationContext.GET_RESOURCE_REQUIRE_SLASH

You won't be able to get the expected result (not null) If we call method ServletContext.getRealPath("WEB-INF").
(The class org.apache.catalina.core.ApplicationContext was used in my case )
The bad thing is that I cannot change this behavior without tomcat patching.

The issue was fixed for ApplicationContext.getResource(String), 
but it's still actual for ApplicationContext.getRealPath(String).
Comment 5 Mark Thomas 2015-11-03 11:01:36 UTC
Fixed for get realPath in trunk and 8.0.x (for 8.0.29 onwards).