URL path causes exception in resource middleware

[brown131]

The following URL path causes an exception/internal server error in the function in ring.middleware.resource/resource-request.

///%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/etc/passwd

Version: ring/ring-core 1.9.4

Exception: clojure.lang.ExceptionInfo: java.lang.NumberFormatException in Interceptor :io.pedestal.http.ring-middlewares/resource - For input string: "uf" at io.pedestal.interceptor.chain$throwableGT_ex_info.invokeStatic(chain.clj:35) at io.pedestal.interceptor.chain$throwableGT_ex_info.invoke(chain.clj:32) at io.pedestal.interceptor.chain$try_f.invokeStatic(chain.clj:57) at io.pedestal.interceptor.chain$try_f.invoke(chain.clj:44) at io.pedestal.interceptor.chain$process_all_with_binding.invokeStatic(chain.clj:171) at io.pedestal.interceptor.chain$process_all_with_binding.invoke(chain.clj:146) at io.pedestal.interceptor.chain$process_all$fn20431.invoke(chain.clj:188) at clojure.lang.AFn.applyToHelper(AFn.java:152) at clojure.lang.AFn.applyTo(AFn.java:144) at clojure.core$apply.invokeStatic(core.clj:667) at clojure.core$with_bindingsSTAR.invokeStatic(core.clj:1990) at clojure.core$with_bindingsSTAR.doInvoke(core.clj:1990) at clojure.lang.RestFn.invoke(RestFn.java:425) at io.pedestal.interceptor.chain$process_all.invokeStatic(chain.clj:186) at io.pedestal.interceptor.chain$process_all.invoke(chain.clj:182) at io.pedestal.interceptor.chain$enter_all.invokeStatic(chain.clj:235) at io.pedestal.interceptor.chain$enter_all.invoke(chain.clj:229) at io.pedestal.interceptor.chain$execute.invokeStatic(chain.clj:379) at io.pedestal.interceptor.chain$execute.invoke(chain.clj:352) at io.pedestal.interceptor.chain$execute.invokeStatic(chain.clj:389) at io.pedestal.interceptor.chain$execute.invoke(chain.clj:352) at io.pedestal.http.impl.servlet_interceptor$interceptor_service_fn$fn23017.invoke(servlet_interceptor.clj:351) at io.pedestal.http.servlet.FnServlet.service(servlet.clj:28) at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:799) at org.eclipse.jetty.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1631) at org.eclipse.jetty.servlets.DoSFilter.doFilterChain(DoSFilter.java:487) at org.eclipse.jetty.servlets.DoSFilter.doFilter(DoSFilter.java:336) at org.eclipse.jetty.servlets.DoSFilter.doFilter(DoSFilter.java:301) at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193) at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601) at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:548) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143) at org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:763) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235) at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1434) at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188) at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:501) at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186) at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1349) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) at org.eclipse.jetty.server.Server.handle(Server.java:516) at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:400) at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:645) at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:392) at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:277) at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311) at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105) at org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint.java:104) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:338) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:315) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:173) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:131) at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:409) at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:883) at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1034) at java.base/java.lang.Thread.run(Thread.java:834) Caused by: java.lang.NumberFormatException: For input string: "uf" at java.base/java.lang.NumberFormatException.forInputString(NumberFormatException.java:65) at java.base/java.lang.Integer.parseInt(Integer.java:652) at java.base/java.lang.Integer.valueOf(Integer.java:957) at ring.util.codec$parse_bytes$fn16192.invoke(codec.clj:44) at clojure.core$map$fn5935.invoke(core.clj:2772) at clojure.lang.LazySeq.sval(LazySeq.java:42) at clojure.lang.LazySeq.seq(LazySeq.java:51) at clojure.lang.RT.seq(RT.java:535) at clojure.lang.Numbers.byte_array(Numbers.java:1424) at ring.util.codec$parse_bytes.invokeStatic(codec.clj:45) at ring.util.codec$parse_bytes.invoke(codec.clj:41) at ring.util.codec$percent_decode$fn16197.invoke(codec.clj:56) at clojure.string$replace_by.invokeStatic(string.clj:69) at clojure.string$replace.invokeStatic(string.clj:106) at clojure.string$replace.invoke(string.clj:75) at ring.util.codec$percent_decode.invokeStatic(codec.clj:53) at ring.util.codec$percent_decode.invoke(codec.clj:47) at ring.util.codec$url_decode.invokeStatic(codec.clj:77) at ring.util.codec$url_decode.invoke(codec.clj:71) at ring.util.codec$url_decode.invokeStatic(codec.clj:75) at ring.util.codec$url_decode.invoke(codec.clj:71) at ring.middleware.resource$resource_request.invokeStatic(resource.clj:17) at ring.middleware.resource$resource_request.invoke(resource.clj:9) at ring.middleware.resource$resource_request.invokeStatic(resource.clj:14) at ring.middleware.resource$resource_request.invoke(resource.clj:9) at io.pedestal.http.ring_middlewares$resource$fn__22357.invoke(ring_middlewares.clj:146) at io.pedestal.interceptor.helpers$handler$fn20673.invoke(helpers.clj:261) at clojure.lang.AFn.applyToHelper(AFn.java:154) at clojure.lang.AFn.applyTo(AFn.java:144) at clojure.core$apply.invokeStatic(core.clj:669) at clojure.core$apply.invoke(core.clj:662) at io.pedestal.interceptor.helpers$before$fn__20598.invoke(helpers.clj:109) at io.pedestal.interceptor.chain$try_f.invokeStatic(chain.clj:54) ... 55 common frames omitted

[weavejester]

What should it do instead? The HTTP server is passing it an invalid URL path, as far as I can see?

[cj-hurst]

Would it be possible to handle this as a 400 bad request instead of a 500? That seems preferable to me since it is the client that is asking for something invalid. It would be nice to have an easy way to control what should happen in this situation. I love how ring turns the request into data. I'm not sure if there is a reasonable way to turn a bad request into data though.

[weavejester]

Apologies for not replying to this sooner. I've started going through issues that slipped through the cracks.

In this case I think the responsibility is with the adapter. If the client sends the HTTP server a request with an URI that doesn't conform to spec, the HTTP server should be the one rejecting the request.