jetty.project icon indicating copy to clipboard operation
jetty.project copied to clipboard

Are Matrix Parameters supported?

Open cowwoc opened this issue 1 year ago • 4 comments

Jetty Version 12.0.6

Jetty Environment core

Java Version 21

Question Given that https://www.w3.org/DesignIssues/MatrixURIs.html isn't part of any standard and very few libraries support it, what is their status in Jetty? Is it technically possible to get/set matrix parameters from a non-terminal path segment using the core API?

cowwoc avatar Mar 12 '24 14:03 cowwoc

Interestingly enough, matrix parameters do seem to be referenced by the standard. The end of https://datatracker.ietf.org/doc/html/rfc3986#section-3.3 reads:

Aside from dot-segments in hierarchical paths, a path segment is considered opaque by the generic syntax. URI producing applications often use the reserved characters allowed in a segment to delimit scheme-specific or dereference-handler-specific subcomponents. For example, the semicolon (";") and equals ("=") reserved characters are often used to delimit parameters and parameter values applicable to that segment. The comma (",") reserved character is often used for similar purposes. For example, one URI producer might use a segment such as "name;v=1.1" to indicate a reference to version 1.1 of "name", whereas another might use a segment such as "name,1.1" to indicate the same. Parameter types may be defined by scheme-specific semantics, but in most cases the syntax of a parameter is specific to the implementation of the URI's dereferencing algorithm.

So I guess we should have some sort of support for getting/setting these parameters, right?

cowwoc avatar Mar 12 '24 15:03 cowwoc

Looks like you are talking about path parameters, and on-again / off-again niche concept that gets no love in the URL/URI/HTTP specs.

It causes all sorts of problems in the Servlet spec when it comes to merging paths (such as producing an error page, or request dispatching, or redirect location line, url normalization for constraints, etc)

In Servlet 6.0 when using path parameters in specific types of path segments will result in a 400 Bad Request. See: "Rejecting Suspicious Sequences" at https://github.com/jakartaee/servlet/blob/6.0.0-RELEASE/spec/src/main/asciidoc/servlet-spec-body.adoc#352-uri-path-canonicalization

joakime avatar Mar 12 '24 16:03 joakime

Yes, it sounds like path parameters are the same concept of matrix parameters.

In the text you linked to, they mention that:

  • The container has to know how to parse path parameters.
  • When normalizing URIs, one should normalize paths as if the path parameters were not there. So for example: /foo/..;version=1/bar/ is normalized the same as foo/../bar/. This makes a lot of sense.
  • However, that same text goes on to say that path parameters may be preserved by the container for later decoding and/or processing (eg jsessionid). My interpretation being that just because we temporarily ignore them for path-normalization doesn't mean that they actually get dropped. More concretely, I would expect the container to retain path parameters for any path segments that do not get dropped by the normalization process.

I would still like to be able to get/set path parameters in incoming and outgoing URIs, especially given that I am using the core API and not the servlet API. Is such a thing possible?

cowwoc avatar Mar 12 '24 16:03 cowwoc