17

I try send request like http://site.com/abc%2Fabc and it doesn't work (send status 400). How I understand tomcat doesn't accept encoded path separators for security reasons, but I don't know how to enable this coding. (I have found only option AllowEncodedSlashes for apache http server). Can you help me?

UPDATE

I fixed this trouble using tiny hack - before render replace all '/' characters on '|' and after reverse this characters on '/'

1
  • 1
    I had the same problem but I could not find this question on SO because I did not realize the problem was related to encoded slash. I saw a 400 status error with Tomcat 7 with an empty body response / without response, so that was what I looked for in google. I hope adding this comment with keywords may help people with the same problem find this question :)
    – magnum87
    Jul 18, 2016 at 14:01

4 Answers 4

25

There is a Tomcat option to allow encoded path separators.

Set the CATALINA_OPTS env var to

-Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true

This will allow encoded slashes.

5
  • 4
    Just a note, this feature is disabled by default because it is a security risk: see tomcatexpert.com/blog/2011/11/02/… and en.wikipedia.org/wiki/Directory_traversal_attack
    – mlathe
    Mar 5, 2014 at 17:19
  • 3
    Note that to fix forward slashes you need org.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH. Such a shame tomcat decide to break HTTP , rather than fix the underlying security problem (%2F and %5C are perfectly valid in URLs)
    – dan carter
    Apr 24, 2015 at 4:18
  • 1
    note also that Tomcat will convert encoded backslash in a path into a forward slash
    – dan carter
    Apr 28, 2015 at 2:15
  • Hi, please where can I modify these parameters? THANKS
    – Aziz
    Nov 23, 2016 at 19:24
  • @JohnnySparow In general the method for setting environment variables will depend on your platform, but the answer by user2335780 should work across platforms in this specific case. Nov 24, 2016 at 16:50
7

We can also add this entry "org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true" in catalina.properties to allow encoded slash in url.


And to allow backslash you have to set different properties. Refer this url for different configuration.

1

To make this workable for my by editing $CATALINA_HOME\conf\server.xml

Old Value: <Connector ... protocol="HTTP/1.1"... />

New Value: <Connector ... protocol="HTTP/1.1"... relaxedQueryChars='\ { } |' />

I am using Tomcat 7.0.88

1
  • You sir deserve more upvotes. This is the only thing that worked for me. Thank you very much. Feb 5, 2021 at 14:50
0

Have you tried putting URIEncoding="UTF-8" in your <Connector in the server.xml?

1
  • 2
    Yes. I put URIEncoding="UTF-8" in server.xml. It's not work only with %2F.. for example %3A - ":" work.
    – pushistic
    Mar 15, 2012 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.