How can I make Tomcat accept unescaped brackets in URLs?

Question

I've never used Tomcat before, but I've recently inherited a JSP project and now I need to get it running. I've managed to install Tomcat 8.0 locally in Eclipse and everything works fine. I've also installed Tomcat 8.0 on an Ubuntu VPS. The app is running fine, except for a small issue with how it handles URLs.

The client-side application produces URLs with unescaped square and curly brackets in parameters, like this:

GET /saveItems.json?items=[{%22json%22:%22here%22}]

As much as I would like to change the client-side app, I can't. I just need to get this backend running.

My local copy of the application handles this fine. On the server, however, I get this error:

java.lang.IllegalArgumentException: Invalid character found in the request target. The valid characters are defined in RFC 7230 and RFC 3986
    at org.apache.coyote.http11.AbstractNioInputBuffer.parseRequestLine(AbstractNioInputBuffer.java:286)
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1009)
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:672)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1504)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1460)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:748)

I've been looking for a setting that might affect this, without any luck. What am I missing here?

score 17 · Answer 1 · edited Feb 15 '19 at 15:58

17

I make this workable by editing $CATALINA_HOME\conf\server.xml

Old Value: <Connector ... protocol="HTTP/1.1"... />

New Value: <Connector ... protocol="HTTP/1.1"... relaxedQueryChars='[]|{}^\`"<>' />

edited Feb 15 '19 at 15:58

Steve Chambers

37,270
24
156
208

answered May 29 '18 at 14:41

Latif

181
1
3

1

You forgot to include the values – moondaisy May 29 '18 at 14:43
I replicate the above thing in server.xml file to allow #.But still tomcat not able to parse url relaxedQueryChars="^{}|[]_#" and im using tomcat 8.5.27 – Sundar G Mar 20 '21 at 07:14
1

Heads up that, depending on your use case, you may also want to use relaxedPathChars instead of relaxedQueryChars. See https://vividcode.io/support-brackets-in-url-query-string-with-tomcat/ – Atticus29 Jun 11 '21 at 18:52

score 8 · Answer 2 · answered May 17 '17 at 14:07

Tomcat 8.0.39/8.5.9/7.0.73 add additional checks for valid characters to the HTTP request line parsing. According to this requirement, version 8.0.42/8.5.12/7.0.76 make some changes to allow some invalid characters.
{, } and | are allowed if the character present in value of system property tomcat.util.http.parser.HttpParser.requestTargetAllow.

You can add system property tomcat.util.http.parser.HttpParser.requestTargetAllow={} to prevent this error. One of the soltion is editing $CATALINA_HOME\conf\catalina.properties.

in tomcat 9.0.11 + tomcat.util.http.parser.HttpParser.requestTargetAllow iused anymore. Use relaxedQueryChars only. — jareeq, Sep 20 '18 at 12:41

score 3 · Answer 3 · answered Jun 01 '19 at 14:09

I was experiencing a similar problem, but using Spring boot too, the following solution resolved my issue:

@Bean
public ConfigurableServletWebServerFactory webServerFactory() {
    TomcatServletWebServerFactory factory = new TomcatServletWebServerFactory();
    factory.addConnectorCustomizers(new TomcatConnectorCustomizer() {
        @Override
        public void customize(Connector connector) {
            connector.setProperty("relaxedQueryChars", "|{}[]");
        }
    });
return factory;
}

Credited to Matthias-lohr - https://stackoverflow.com/questions/46251131/invalid-character-found-in-the-request-target-in-spring-boot

score 2 · Answer 4 · edited Aug 03 '18 at 12:14

2

I get this error when I try to GET URL with some special character.

java.lang.IllegalArgumentException: Invalid character found in the request target.

By changing the connector parameter in server.xml, we are able to parse a special character in Tomcat version 9.

Connector port="80" protocol="HTTP/1.1" relaxedQueryChars="\ { } |"

edited Aug 03 '18 at 12:14

Robert Columbia

6,313
15
32
40

answered Aug 03 '18 at 12:01

pravin patil

21
2

How can I make Tomcat accept unescaped brackets in URLs?

4 Answers4