Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1491607

Summary:	[RFE] url requirement that prevents unencoded curly braces should be optional, since it breaks existing sites
Product:	[JBoss] JBoss Enterprise Application Platform 6	Reporter:	Min Woo Park <mpark>
Component:	Web	Assignee:	jboss-set
Status:	CLOSED DUPLICATE	QA Contact:	Michael Cada <mcada>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.4.13, 6.4.14, 6.4.15, 6.4.16	CC:	rmaucher
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-09-14 10:38:48 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Min Woo Park 2017-09-14 09:14:30 UTC

Description of problem:

Same request with JWS-717 [1] for EAP 6.4.x.

As a result of CVE-2016-6816 unencoded characters are rejected as invalid. 
Unfortunately some clients are still behaving that way and were being rejected by EAP 6.4.13+(jbossweb).
An option has been added that will allow you to accept unencoded {, }, and | characters. 

[1] https://issues.jboss.org/browse/JWS-717

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Rémy Maucherat 2017-09-14 10:38:48 UTC

Note that the websites need fixing sooner or later (I recommend sooner).

*** This bug has been marked as a duplicate of bug 1489846 ***