899911 - REST endpoints return 404 for urls with slashes

Status: NEW

(Bugzilla :: WebService, defect)

Description

[:glob ✱]

while working on an extension which accepts product and component names and has a rest endpoint, it was discovered that if either of these names contain slashes, apache returns 404 instead of hitting our webserver handler.

this is most likely apache's AllowEncodedSlashes setting.
http://httpd.apache.org/docs/current/mod/core.html#allowencodedslashes

Comment 1

[David Lawrence [:dkl]]

Playing with this I was not able yet to find a proper solution.

http://bzweb/trunk/rest/product/World%2FControl

1. AllowEncodedSlashes is not allowed in .htaccess and so I had to add it to <VirtualHost> block in either httpd.conf or in the bugzilla.conf directive file. This got rid of the  404 errors.

2. AllowEncodedSlashes NoDecode caused the REST call to literally look for a product called 'World%2FContol' which doesn't exist.

3. AllowEncodedSlashses On will pass through the path as /rest/product/World/Control which causes the error "A REST API resource was not found for 'GET /product/World/Control'" dues
to the way the regexp is configured in the REST resources file.

For #3, we would need to change the regexp from qr{^/product/([^/]+)$} to qr{^/product/(.*)$}
which will work but is not IMO a perfect solution. We will also have this issue later with Component names, bug aliases, field names, etc. that may contain / characters. Plus a REST URI that takes multiple values we cannot really do for example: /rest/product/(.*)/(.*)$.

Other ideas?

dkl