From 7bc0b978c0e0047f6569040cabae330f8919f0ee Mon Sep 17 00:00:00 2001 From: Thomas <> Date: Tue, 11 Apr 2023 17:51:24 +0200 Subject: chore(pdf-as-web): Handle error url not containing an explicit port from TUG: The servlet tries to sanitize the URL by parsing it and writing it back out. In case the input URL doesn't contain an explicit port, URL.getPort() returns -1 which leads to "https://example.com:-1/mypath" in the template which isn't the same origin as without a port and gets rejected by the browser. Instead only add a port to the resulting URL if the input contains one as well. --- .../java/at/gv/egiz/pdfas/web/servlets/ErrorPage.java | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) (limited to 'pdf-as-web') diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ErrorPage.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ErrorPage.java index 72128a9c..42236f5e 100644 --- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ErrorPage.java +++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ErrorPage.java @@ -42,8 +42,8 @@ import at.gv.egiz.pdfas.web.helper.HTMLFormater; import at.gv.egiz.pdfas.web.helper.PdfAsHelper; import at.gv.egiz.pdfas.web.helper.UrlParameterExtractor; import at.gv.egiz.pdfas.web.stats.StatisticEvent; -import at.gv.egiz.pdfas.web.stats.StatisticFrontend; import at.gv.egiz.pdfas.web.stats.StatisticEvent.Status; +import at.gv.egiz.pdfas.web.stats.StatisticFrontend; /** * Servlet implementation class ErrorPage @@ -116,11 +116,14 @@ public class ErrorPage extends HttpServlet { String template = PdfAsHelper.getErrorRedirectTemplateSL(); URL url = new URL(errorURL); - String errorURLProcessed = url.getProtocol() + "://" + // "http" + ":// - url.getHost() + // "myhost" - ":" + // ":" - url.getPort() + // "8080" - url.getPath(); + String errorURLProcessed = url.getProtocol() + "://" + url.getHost(); + if (url.getPort() != -1) { + errorURLProcessed += ":" + url.getPort(); + + } + + errorURLProcessed += url.getPath(); + template = template.replace("##ERROR_URL##", errorURLProcessed); -- cgit v1.2.3