Skip to content

[BUG] Failed to handle absolute form of HTTP "path" #737

@Banyc

Description

@Banyc

What i did / Steps to reproduce

  1. set up a socks5 or http proxy in your local host
  2. set up bluemap as usual
  3. curl -v -x <your proxy address> <bluemap address>

Expected result

bluemap returns an html file to curl.

Actual result

bluemap returns http 404 to curl.

Context

BlueMap Version:
latest

this is the code that parses the HTTP request path

private HttpResponse generateResponse(HttpRequest request) throws IOException {
String path = request.getPath();
// normalize path
if (path.startsWith("/")) path = path.substring(1);
if (path.endsWith("/")) path = path.substring(0, path.length() - 1);
Path filePath;
try {
filePath = webRoot.resolve(path);
} catch (InvalidPathException e){
return new HttpResponse(HttpStatusCode.NOT_FOUND);
}

however, it does not account for the absolute form specified in the HTTP RFC https://datatracker.ietf.org/doc/html/rfc9112#name-absolute-form

namely, when a request GET http://www.example.org/pub/WWW/TheProject.html HTTP/1.1 goes to bluemap, bluemap will instantly treat http://www.example.org/pub/WWW/TheProject.html as a file path, instead of extracting /pub/WWW/TheProject.html

for reference, if you dont have a proxy at hand, here are the requests captured by me with/without using a proxy

# using proxy
GET http://www.example.com:12345/ HTTP/1.1
Host: www.example.com:12345
User-Agent: curl/8.15.0
Accept: */*
Proxy-Connection: Keep-Alive

###

# noproxy
GET / HTTP/1.1
Host: www.example.com:12345
User-Agent: curl/8.15.0
Accept: */*

a thought on how to identify the absolute form by either:

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    Projects

    Status

    Done

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions