René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Path Normalization/Traversal - Context Matching","articleBody":"We have an app with 2 servlet path defined\r\n\r\n`/ws/v1`\r\n`/foo`\r\n\r\n`/ws/v1` was exposed on edge (ATS). However `/foo` accessed on Jetty using this \r\n\r\n`/ws/v1/..;/..;/foo` - so we had a path exposed on the edge which was not intended to be exposed\r\n\r\n- Is this matching done as per servlet spec?\r\n- Is there a configuration to avoid this in Jetty\r\n- I've heard that Undertow for e.g. does not allow the above. \r\n\r\n(Jetty version: 9.4.22 - same behavior seen in older versions as well)\r\n\r\n","author":{"url":"https://github.com/venukb","@type":"Person","name":"venukb"},"datePublished":"2019-11-06T15:06:51.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":22},"url":"https://github.com/4275/jetty.project/issues/4275"}