You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Scott Dunbar <sc...@xigole.com> on 2009/09/24 22:09:54 UTC
Any way to filter URL's with a dot in the directory name?
I'm trying to write a filter (or use a security-constraint) to eliminate
Tomcat serving up files from a directory that starts with a dot - .svn
in this case. It appears, based on reading the servlet spec, that /* is
not sufficient for this. Indeed, using Tomcat 6.0.18 I've seen that a
request for /.svn/entries is passed through without hitting my filter.
Is there something I'm missing that would allow me to trap this? It
looks like the spec is rather lean in this area and assumes that a dot
in a file name means that it is an extension, not part of the real name.
My only other thought is to write my own Valve to do this. It would be
conceptually similar to the Remote Address/Host Filters.
Thanks for any ideas.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Any way to filter URL's with a dot in the directory name?
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Scott Dunbar [mailto:scott@xigole.com]
> Subject: Re: Any way to filter URL's with a dot in the directory name?
>
> This should prevent the automatic application deployment for my
> top level .svn directory and subsequently let my filter work for
> the .svn directories in ROOT.
I'd strongly recommend that you don't put anything under the <Host> appBase directory that you don't want treated as a separate webapp. Doing otherwise is just asking for trouble in the future, regardless of what config tags you set today.
As an alternative, consider not putting anything under the <Host> appBase, and use an explicit <Context> element in conf/Catalina/[host]/ROOT.xml that points to the location of the webapp you want.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Any way to filter URL's with a dot in the directory name?
Posted by Scott Dunbar <sc...@xigole.com>.
Thanks Charles for encouraging me dig a bit more into this.
Yes, my webapp is the root of a VirtualHost. I've figured out what is
going on now.
The VirtualHost is very simple:
<Host name="host.domain.tld" appBase="/home/scott/sites/host.domain.tld"
unpackWARs="true">
<Valve className="org.apache.catalina.valves.AccessLogValve"
directory="logs"
prefix="host.domain.tld_access_log."
suffix=".txt"
pattern="common"/>
</Host>
In the directory /home/scott/sites/host.domain.tld there are *two*
directories, ".svn" and "ROOT".
When I went to http://host.domain.tld/.svn/entries I was actually
getting the subversion entries file from the top level .svn directory,
not "ROOT/.svn". This is why my filter did not see the URL. If I
rename the .svn directory at the top level directory and then go to the
exact same URL my filter is now called as expected.
The docs (at
http://tomcat.apache.org/tomcat-6.0-doc/config/host.html#Automatic%20Application%20Deployment)
tell me (now that I've read them a bit more) that Tomcat is doing
exactly what I'm telling it to - it is automatically deploying the top
level .svn application because it is a directory under the appBase. I
currently have no Context's explicitly defined and it looks like I
should use a combination of setting |deployOnStartup| to false in the
Host element and then have explicit Context elements defined. This
should prevent the automatic application deployment for my top level
.svn directory and subsequently let my filter work for the .svn
directories in ROOT.
Again, thanks for the help.
Caldarale, Charles R wrote:
>> From: Scott Dunbar [mailto:scott@xigole.com]
>> Subject: Re: Any way to filter URL's with a dot in the directory name?
>>
>> No, I specified /* as my url-pattern:
>> and my filter is not called when the URL is
>> http://www.hostname.tld/.svn/entries
>>
>
> Is your webapp deployed as ROOT? If not, what is the default webapp? It would be useful to see your entire WEB-INF/web.xml and your META-INF/context.xml, and the deployment location of your webapp.
>
>
>> The servlet spec is weird here and the url-pattern in a
>> web-resource-collection. The "." has special meaning that
>> seems to indicate a file extension, not a directory.
>>
>
> Only in a <url-pattern> (not the URI itself), and only in conjunction with a leading asterisk.
>
> - Chuck
>
>
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
--
Scott Dunbar
Xigole Systems, Inc.
Enterprise consulting, development, and hosting
303·667·6343
RE: Any way to filter URL's with a dot in the directory name?
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Scott Dunbar [mailto:scott@xigole.com]
> Subject: Re: Any way to filter URL's with a dot in the directory name?
>
> No, I specified /* as my url-pattern:
> and my filter is not called when the URL is
> http://www.hostname.tld/.svn/entries
Is your webapp deployed as ROOT? If not, what is the default webapp? It would be useful to see your entire WEB-INF/web.xml and your META-INF/context.xml, and the deployment location of your webapp.
> The servlet spec is weird here and the url-pattern in a
> web-resource-collection. The "." has special meaning that
> seems to indicate a file extension, not a directory.
Only in a <url-pattern> (not the URI itself), and only in conjunction with a leading asterisk.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Any way to filter URL's with a dot in the directory name?
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Scott,
On 9/24/2009 4:19 PM, Scott Dunbar wrote:
> No, I specified /* as my url-pattern:
>
> <filter-mapping>
> <filter-name>FileFilter</filter-name>
> <url-pattern>/*</url-pattern>
> </filter-mapping>
>
> and my filter is not called when the URL is
> http://www.hostname.tld/.svn/entries
>
> The servlet spec is weird here and the url-pattern in a
> web-resource-collection. The "." has special meaning that seems to
> indicate a file extension, not a directory.
The "." only has special meaning when the URL pattern looks like this:
*.[anything]
All other uses of a period should be literal.
If you set up a mapping for "/.svn" then the matching should be exact.
Since I guess you want to protect "/*/.svn" then your approach of
mapping to "/*" and then just checking for the directory name is
probably the right one.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkq82ksACgkQ9CaO5/Lv0PAiGwCcC1wf++l16QB23G/a6QLqHvlj
yUkAnRATnhqF0cFxzO+DWso8L1uOjFpf
=4dkJ
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Any way to filter URL's with a dot in the directory name?
Posted by Scott Dunbar <sc...@xigole.com>.
No, I specified /* as my url-pattern:
<filter-mapping>
<filter-name>FileFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
and my filter is not called when the URL is
http://www.hostname.tld/.svn/entries
The servlet spec is weird here and the url-pattern in a
web-resource-collection. The "." has special meaning that seems to
indicate a file extension, not a directory.
Caldarale, Charles R wrote:
>> From: Scott Dunbar [mailto:scott@xigole.com]
>> Subject: Any way to filter URL's with a dot in the directory name?
>>
>> It appears, based on reading the servlet spec, that /*
>> is not sufficient for this.
>>
>
> Why not? /* maps to everything.
>
>
>> Indeed, using Tomcat 6.0.18 I've seen that a request for
>> /.svn/entries is passed through without hitting my filter.
>>
>
> What <url-pattern> did you specify for the filter?
>
> Tough to diagnose without specific information.
>
> - Chuck
>
>
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
--
Scott Dunbar
Xigole Systems, Inc.
Enterprise consulting, development, and hosting
303·667·6343
RE: Any way to filter URL's with a dot in the directory name?
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Scott Dunbar [mailto:scott@xigole.com]
> Subject: Any way to filter URL's with a dot in the directory name?
>
> It appears, based on reading the servlet spec, that /*
> is not sufficient for this.
Why not? /* maps to everything.
> Indeed, using Tomcat 6.0.18 I've seen that a request for
> /.svn/entries is passed through without hitting my filter.
What <url-pattern> did you specify for the filter?
Tough to diagnose without specific information.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org