diff --git a/jetty-http/src/main/java/org/eclipse/jetty/http/HttpURI.java b/jetty-http/src/main/java/org/eclipse/jetty/http/HttpURI.java index 0a2e758caf39..3dc76024d46f 100644 --- a/jetty-http/src/main/java/org/eclipse/jetty/http/HttpURI.java +++ b/jetty-http/src/main/java/org/eclipse/jetty/http/HttpURI.java @@ -108,7 +108,7 @@ enum Violation */ SEPARATOR("Ambiguous path separator"), /** - * Ambiguous path parameters within a URI segment e.g. {@code /foo/..;/bar} + * Ambiguous path parameters within a URI segment e.g. {@code /foo/..;/bar} or {@code /foo/%2e%2e;param/bar} */ PARAM("Ambiguous path parameters"), /** @@ -782,15 +782,14 @@ private void checkSegment(String uri, int segment, int end, boolean param) // Look for segment in the ambiguous segment index. Boolean ambiguous = __ambiguousSegments.get(uri, segment, end - segment); - if (ambiguous == Boolean.TRUE) + if (ambiguous != null) { - // The segment is always ambiguous. - _violations.add(Violation.SEGMENT); - } - else if (param && ambiguous == Boolean.FALSE) - { - // The segment is ambiguous only when followed by a parameter. - _violations.add(Violation.PARAM); + // Is the segment intrinsically ambiguous + if (ambiguous == Boolean.TRUE) + _violations.add(Violation.SEGMENT); + // Is the segment ambiguous with a parameter? + if (param) + _violations.add(Violation.PARAM); } } diff --git a/jetty-http/src/test/java/org/eclipse/jetty/http/HttpURITest.java b/jetty-http/src/test/java/org/eclipse/jetty/http/HttpURITest.java index 28be9c41f0ba..ee8e54d0ec2b 100644 --- a/jetty-http/src/test/java/org/eclipse/jetty/http/HttpURITest.java +++ b/jetty-http/src/test/java/org/eclipse/jetty/http/HttpURITest.java @@ -358,9 +358,9 @@ public static Stream decodePathTests() {"/path/%2e/info", "/path/info", EnumSet.of(Violation.SEGMENT)}, {"path/%2e/info/", "path/info/", EnumSet.of(Violation.SEGMENT)}, {"/path/%2e%2e/info", "/info", EnumSet.of(Violation.SEGMENT)}, - {"/path/%2e%2e;/info", "/info", EnumSet.of(Violation.SEGMENT)}, - {"/path/%2e%2e;param/info", "/info", EnumSet.of(Violation.SEGMENT)}, - {"/path/%2e%2e;param;other/info;other", "/info", EnumSet.of(Violation.SEGMENT)}, + {"/path/%2e%2e;/info", "/info", EnumSet.of(Violation.SEGMENT, Violation.PARAM)}, + {"/path/%2e%2e;param/info", "/info", EnumSet.of(Violation.SEGMENT, Violation.PARAM)}, + {"/path/%2e%2e;param;other/info;other", "/info", EnumSet.of(Violation.SEGMENT, Violation.PARAM)}, {"%2e/info", "info", EnumSet.of(Violation.SEGMENT)}, {"%u002e/info", "info", EnumSet.of(Violation.SEGMENT, Violation.UTF16)}, @@ -473,9 +473,9 @@ public static Stream testPathQueryTests() {"/path/%2e/info", "/path/info", EnumSet.of(Violation.SEGMENT)}, {"path/%2e/info/", "path/info/", EnumSet.of(Violation.SEGMENT)}, {"/path/%2e%2e/info", "/info", EnumSet.of(Violation.SEGMENT)}, - {"/path/%2e%2e;/info", "/info", EnumSet.of(Violation.SEGMENT)}, - {"/path/%2e%2e;param/info", "/info", EnumSet.of(Violation.SEGMENT)}, - {"/path/%2e%2e;param;other/info;other", "/info", EnumSet.of(Violation.SEGMENT)}, + {"/path/%2e%2e;/info", "/info", EnumSet.of(Violation.SEGMENT, Violation.PARAM)}, + {"/path/%2e%2e;param/info", "/info", EnumSet.of(Violation.SEGMENT, Violation.PARAM)}, + {"/path/%2e%2e;param;other/info;other", "/info", EnumSet.of(Violation.SEGMENT, Violation.PARAM)}, {"%2e/info", "info", EnumSet.of(Violation.SEGMENT)}, {"%2e", "", EnumSet.of(Violation.SEGMENT)},