Issue
Tomcat 9.0.54 rejects my URL because of the "<" and ">" symbols. It rejects it also when in percent encoded forms "%3C" and "%3E". I also tried adding relaxedQueryChars="<>" to the Connector in the server.xml but without avail.
The Tomcat instance is spun up by Cargo when running the Bloomreach CMS. The URL is as follows:
http://localhost:8080/site/api/documents?_expr=(hippostdpubwf:lastModificationDate%3Exs:dateTime('2021-04-09T20:56:18.496%2B02:00'))
Changing the %3E to a "=" (%3D) makes the URL accepted by Tomcat.
When spinning up a default Tomcat docker, this issue is not present.
Has anyone had a similar issue or could show me in a direction which might fix this issue?
Solution
Looks like you're hitting the org.hippoecm.hst.container.XSSUrlFilter that is present by default in the web.xml of the site webapp.
It's a simple, extendable filter to prevent basic scripting attacks. Regards, Jeroen
PS you might like the forums at community.bloomreach.com
Answered By - Jeroen Hoffman
Answer Checked By - Cary Denson (JavaFixing Admin)
