Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-6890349

Fix #6870935 in jdk7/pit/b74 caused HttpClinet's check for "proxy capture" attack by-passed.

XMLWordPrintable

    • b77
    • generic
    • generic

      Fix #6870935 in jdk7/pit/b74 caused sqe test case in Security component failed. (see bug #4447135 also)

      http://sqeweb.sfbay.sun.com/net/sqenfs-2/export2/results/security/pit/7/b74/gtee/solaris10-sparc_c2/7-b74_pit_security_solaris10-sparc_c2/dtftest.SunOS.sparc/4447135/4447135.diff
      -------------------------------------------
      ======< Gold file= /var/tmp/Work/exec/solaris10-sparc_c2/dtftest.SunOS.sparc/4447135/4447135.eout
      ======> Output file=/var/tmp/Work/exec/solaris10-sparc_c2/dtftest.SunOS.sparc/4447135/4447135.pass
      5,10c5,6
      < got 147 bytes
      < Status: Failed -- Excepted Exception uncaught !
      < got 147 bytes
      < Status: Failed -- Excepted Exception uncaught !
      < {ver could not understand.
      < </BODY></HTML}
      ---
      > Status: Pass
      > Status: Pass

      Basically, the testcase is expecting a MalformedURLException (a sub-class of IOException) which used to be thrown from within HttpClient.getURLFile() all the way out. However, with the fix #6870935, the IOException will be catched in HttpURLConnection. The most of invokes to HttpClient.getURLFile() has been replaced with a new method HttpURLConnection.getRequestURI() which actually invoke HttpClient.getURLFile() and "eat" IOException.

      See http://lonepeak.sfbay/PIT/b74/Agones-MASTER/webrev/jdk/src/share/classes/sun/net/www/protocol/http/HttpURLConnection.java.udiff.html for more
      ...............
      @@ -2097,10 +2111,27 @@
                   connected = false;
                   throw e;
               }
           }
       
      + /* The request URI used in the request line for this request.
      + * Also, needed for digest authentication
      + */
      +
      + String requestURI = null;
      +
      + String getRequestURI() {
      + if (requestURI == null) {
      + try {
      + requestURI = http.getURLFile();
      + } catch (IOException e) {
      + requestURI = "";
      + }
      + }
      + return requestURI;
      + }
      +
           /* Tells us whether to follow a redirect. If so, it
            * closes the connection (break any keep-alive) and
            * resets the url, re-connects, and resets the request
            * property.
            */

      ..................................

      @@ -2158,17 +2189,18 @@
                   if (security != null) {
                       security.checkConnect(proxyHost, proxyPort);
                   }
       
                   setProxiedClient (url, proxyHost, proxyPort);
      - requests.set(0, method + " " + http.getURLFile()+" " +
      + requests.set(0, method + " " + getRequestURI()+" " +
                                    httpVersion, null);
                   connected = true;
               } else {
                   // maintain previous headers, just change the name
                   // of the file we're getting
                   url = locUrl;
      + requestURI = null; // force it to be recalculated
                   if (method.equals("POST") && !Boolean.getBoolean("http.strictPostRedirect") && (stat!=307)) {
                       /* The HTTP/1.1 spec says that a redirect from a POST
                        * *should not* be immediately turned into a GET, and
                        * that some HTTP/1.0 clients incorrectly did this.
                        * Correct behavior redirects a POST to another POST.

            michaelm Michael McMahon
            whusunw Wen-zhong Hu (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Created:
              Updated:
              Resolved:
              Imported:
              Indexed: