Bug 63214 - Using JkAutoAlias, Filenames with Spaces Cannot be found
Summary: Using JkAutoAlias, Filenames with Spaces Cannot be found
Alias: None
Product: Tomcat Connectors
Classification: Unclassified
Component: mod_jk (show other bugs)
Version: 1.2.46
Hardware: Other Linux
: P2 normal (vote)
Target Milestone: ---
Assignee: Tomcat Developers Mailing List
Depends on:
Reported: 2019-02-27 16:48 UTC by Ken
Modified: 2020-01-29 18:09 UTC (History)
0 users

Proposed fix (2.27 KB, patch)
2019-10-07 20:31 UTC, Mark Thomas
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Ken 2019-02-27 16:48:05 UTC
Using the JkAutoAlias functionality to automatically include Tomcat content so that static files can be served by httpd.

Any file (in the tomcat app directories) that contains one or more spaces results in a 404 being returned from the server.  It appears that the space is being encoded to %20 in mod_jk.c, resulting in the filename not being found on the server.  Specifically, there is logic in mod_jk.c, at about line 3936 (jk_translate function) that utilizes ap_os_escape_path.  The resulting escaped url is concatenated with the tomcat directory path and stored back into the request_rec->filename. That filename, with one or more %20, eventually fails a stat and results in the 404.

Files with spaces that don't go through the jk_translate function are not impacted and are served as expected.
Comment 1 Mark Thomas 2019-10-07 20:31:09 UTC
Created attachment 36815 [details]
Proposed fix

I have attached a proposed fix for this. Essentially, it removes the calls to ap_os_escape_path.

I thought this might be related to the normalisation fixes but I tested with 1.2.40 and this failed there too.

I'm struggling to see what purpose the ap_os_escape_path had. I think it is safe to remove the calls but I am not that familiar with this code. Input from those more familiar with mod_jk and/or httpd welcome.
Comment 2 Rainer Jung 2019-10-08 09:43:16 UTC
The use of ap_os_escape_path() goes back to the original implementation of the JkAutoAlias feature for httpd 1.3.x. svn logs do not give any idication why it was used.

Currently in the 2.0 code, IMHO the resulting string is always used in the context of file system operations (either apr_stat or r->filename). So I don't see a reason why it should be percent encoded. On the contrary, there should be many cases where this makes it fail.

I couldn't find other older bug reports, but it might be due to the fact, that context names rarely contain special characters which would have been ecoded by ap_os_escape_path(). A space is probably the most common case.

I am +1 for the suggested patch.
Comment 3 Mark Thomas 2019-10-08 10:55:28 UTC
Thanks for the review. I'll proceed on that basis.
Comment 4 Mark Thomas 2020-01-29 18:09:21 UTC
This has been fixed in master for 1.2.47 onwards.