You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2014/01/28 05:39:18 UTC
[Bug 56070] New: the resource url is wrong!
https://issues.apache.org/bugzilla/show_bug.cgi?id=56070
Bug ID: 56070
Summary: the resource url is wrong!
Product: Tomcat 8
Version: trunk
Hardware: PC
Status: NEW
Severity: normal
Priority: P2
Component: Catalina
Assignee: dev@tomcat.apache.org
Reporter: 4700012@qq.com
previously,my servlet:
(WebappClassLoader)getClass().getClassLoader().getResource("/../tmplog/logs")
return url:
/myweb/../tmplog/logs
and my security validation code:
-------------
if (url.indexOf("/../")>-1)
return false;
-------------will false!!!!
but now:
it's will be:
/tmplog/logs
if (url.indexOf("/../")>-1)
return false;
---------------will true!!!!!
so,the resourse url is "/myweb/../tmplog/logs", not "/tmplog/logs".
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 56070] the resource url is wrong!
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56070
devali <47...@qq.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|P2 |P1
OS| |All
Severity|normal |regression
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 56070] the resource url is wrong!
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56070
devali <47...@qq.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|INVALID |---
--- Comment #4 from devali <47...@qq.com> ---
How the:
if (!allowLinking||crossContext)
{
normalizing...
}
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 56070] the resource url is wrong!
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56070
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |INVALID
--- Comment #1 from Mark Thomas <ma...@apache.org> ---
There is nothing in the Servlet specification or the Javadoc for
ClassLoader.getResource() that states that if the input is not normalized that
this must be retained in the provided URL.
Your security validation code should be testing the input to
ClassLoader.getResource() rather than the output. Even then, depending on the
rest of the code, that may be very easy to bypass.
Note that Tomcat will not allow an application to access a resource that it
outside of the web application context root. "/" returns the path to
"/WEB-INF/classes", "../.." returns the path to the context root and "../../.."
returns null. This is more to detect bugs than a security measure as an
application could easily just access the file system directly. You need to run
under a security manager to prevent that sort of thing.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 56070] the resource url is wrong!
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56070
devali <47...@qq.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|INVALID |---
--- Comment #2 from devali <47...@qq.com> ---
my site real path is :
/home/tomcat/webapps/ROOT/
and this case resource url:
/home/tomcat/webapps/ROOT/WEB-INF/classes/myweb/../tmplog/logs
it isn't out site my web.
And ,StandardRoot had the "allowLinking",not need normalize url.
if "normalized url" the "allowLinking" not work.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 56070] the resource url is wrong!
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56070
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution|--- |INVALID
--- Comment #3 from Mark Thomas <ma...@apache.org> ---
That previous comment does not make any sense. My comment #1 above stands. If
you require further assistance please use the Apache Tomcat users mailing list.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 56070] the resource url is wrong!
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56070
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution|--- |INVALID
--- Comment #7 from Mark Thomas <ma...@apache.org> ---
You need to stop spamming this issue with meaningless code snippets with no
context and direct your query to the Apache Tomcat users mailing list. I
strongly suggest you read this first:
http://www.catb.org/~esr/faqs/smart-questions.html
If you continue to spam this issue, your account will be disabled.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 56070] the resource url is wrong!
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56070
--- Comment #5 from devali <47...@qq.com> ---
if (!allowLinking||!crossContext)
{
normalizing...
}
or
private Boolean disallowOutSite;
public void setDisallowOutSite(Boolean disallowOutSite){
this.disallowOutSite=disallowOutSite;
}
if (disallowOutSite)
{
normalizing...
}
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 56070] the resource url is wrong!
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56070
--- Comment #6 from devali <47...@qq.com> ---
infact,the "crossContext" needed "../../.."
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org