where to define ALLOW_UNESCAPED_CHARACTERS_IN_URL property to allow characters like {|}`^\><#" in URLs

[milandesai47]

Hi,

I am using Jboss 7.1 and my application (huge code base) uses special characters like {|}`^\><#"  in URLs. Jboss 6.4 path 17 Redhat resolution to vulnerability that blacklisted those characters in URL, later they gave an option to white list those characters by using -Dtomcat.util.http.parser.HttpParser.requestTargetAllow='{|}`^\><#"' in startup script (standalone.sh). My client upgraded to Jboss 7.1 which uses undertow instead of tomcat.

Undertow gives same option by boolean ALLOW_UNESCAPED_CHARACTERS_IN_URL under JBEAP-13710  

code base :: undertow/UndertowOptions.java at master · undertow-io/undertow · GitHub

For my app I tried this option by adding it as system-property and in startup script but non of them seem to work.

standalone.xml

after </extension>

<system-properties>

<property name="ALLOW_UNESCAPED_CHARACTERS_IN_URL" value="true"/>

</system-properties>

standalone.bat

set "JAVA_OPTS=%JAVA_OPTS% -Dorg.apache.catalina.connector.ALLOW_UNESCAPED_CHARACTERS_IN_URL=TRUE"

please advice.

Thanks in Advance

[mayerw01]

To send raw UTF-8 bytes is apparently not optional in WildFly anymore ([UNDERTOW-1185] Undertow does not allow UTF-8 characters in URLs - JBoss Issue Tracker and WildFly 10 - How to change default encoding? )

URI encoding shoulf be done by the web browser instead.

[milandesai47]

Jboss 7.1.0 cannot process this parameter as it was implemented as part of 7.1.1, in later version this can be achieve by adding following -D arg

-Dorg.wildfly.undertow.ALLOW_UNESCAPED_CHARACTERS_IN_URL=true