-
Notifications
You must be signed in to change notification settings - Fork 188
Description
What i did / Steps to reproduce
- set up a
socks5or http proxy in your local host - set up bluemap as usual
curl -v -x <your proxy address> <bluemap address>
Expected result
bluemap returns an html file to curl.
Actual result
bluemap returns http 404 to curl.
Context
BlueMap Version:
latest
this is the code that parses the HTTP request path
BlueMap/common/src/main/java/de/bluecolored/bluemap/common/web/FileRequestHandler.java
Lines 66 to 79 in 05f0987
| private HttpResponse generateResponse(HttpRequest request) throws IOException { | |
| String path = request.getPath(); | |
| // normalize path | |
| if (path.startsWith("/")) path = path.substring(1); | |
| if (path.endsWith("/")) path = path.substring(0, path.length() - 1); | |
| Path filePath; | |
| try { | |
| filePath = webRoot.resolve(path); | |
| } catch (InvalidPathException e){ | |
| return new HttpResponse(HttpStatusCode.NOT_FOUND); | |
| } | |
however, it does not account for the absolute form specified in the HTTP RFC https://datatracker.ietf.org/doc/html/rfc9112#name-absolute-form
namely, when a request GET http://www.example.org/pub/WWW/TheProject.html HTTP/1.1 goes to bluemap, bluemap will instantly treat http://www.example.org/pub/WWW/TheProject.html as a file path, instead of extracting /pub/WWW/TheProject.html
for reference, if you dont have a proxy at hand, here are the requests captured by me with/without using a proxy
# using proxy
GET http://www.example.com:12345/ HTTP/1.1
Host: www.example.com:12345
User-Agent: curl/8.15.0
Accept: */*
Proxy-Connection: Keep-Alive
###
# noproxy
GET / HTTP/1.1
Host: www.example.com:12345
User-Agent: curl/8.15.0
Accept: */*
a thought on how to identify the absolute form by either:
- use a uri library
- check the
":"substring right after the schema (e.g.,"http")
ref: https://datatracker.ietf.org/doc/html/rfc3986#appendix-A
Metadata
Metadata
Assignees
Labels
Type
Projects
Status