Bug 1491607 - [RFE] url requirement that prevents unencoded curly braces should be optional, since it breaks existing sites
Summary: [RFE] url requirement that prevents unencoded curly braces should be optional...
Keywords:
Status: CLOSED DUPLICATE of bug 1489846
Alias: None
Product: JBoss Enterprise Application Platform 6
Classification: JBoss
Component: Web
Version: 6.4.13,6.4.14,6.4.15,6.4.16
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
: ---
Assignee: jboss-set
QA Contact: Michael Cada
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-09-14 09:14 UTC by Min Woo Park
Modified: 2020-12-14 10:02 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-09-14 10:38:48 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)

Description Min Woo Park 2017-09-14 09:14:30 UTC 
Description of problem:

Same request with JWS-717 [1] for EAP 6.4.x.

As a result of CVE-2016-6816 unencoded characters are rejected as invalid. 
Unfortunately some clients are still behaving that way and were being rejected by EAP 6.4.13+(jbossweb).
An option has been added that will allow you to accept unencoded {, }, and | characters. 

[1] https://issues.jboss.org/browse/JWS-717

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:
Comment 1 Rémy Maucherat 2017-09-14 10:38:48 UTC 
Note that the websites need fixing sooner or later (I recommend sooner).

*** This bug has been marked as a duplicate of bug 1489846 ***
Note You need to log in before you can comment on or make changes to this bug.