You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by go...@hyperreal.org on 1999/10/28 03:04:24 UTC
cvs commit: jakarta-tomcat/src/share/org/apache/tomcat/shell Constants.java Startup.java
gonzo 99/10/27 18:04:24
Modified: src/share/org/apache/jasper Tag: TOMCAT_J2EE_10F_102199
Constants.java
src/share/org/apache/jasper/runtime Tag:
TOMCAT_J2EE_10F_102199 JspServlet.java
src/share/org/apache/tomcat/core Tag: TOMCAT_J2EE_10F_102199
Constants.java Container.java Context.java
RequestImpl.java ServletLoader.java
src/share/org/apache/tomcat/shell Tag:
TOMCAT_J2EE_10F_102199 Constants.java Startup.java
Added: src/share/org/apache/tomcat/protocol/jar Tag:
TOMCAT_J2EE_10F_102199 Handler.java
Log:
WEB-INF/lib/*jar class loading clash with WAR protocol handler - j2ee
code introduced to allow jsp to not be dependent upon tomcate
core api's (using init attributes and associated conditionals)
Context.setClassPath(String) can be called a number of times and
will append the argument to a File.pathSeparator delimited string
note: should rename this to addClassPath()
RequestImpl.setQueryString(String) with a null argument will
likewise null the associated parameters hashtable
note: hans, if you could give this a once over i'd
be obliged
Revision Changes Path
No revision
No revision
1.6.2.1 +11 -3 jakarta-tomcat/src/share/org/apache/jasper/Constants.java
Index: Constants.java
===================================================================
RCS file: /home/cvs/jakarta-tomcat/src/share/org/apache/jasper/Constants.java,v
retrieving revision 1.6
retrieving revision 1.6.2.1
diff -u -r1.6 -r1.6.2.1
--- Constants.java 1999/10/21 02:47:50 1.6
+++ Constants.java 1999/10/28 01:04:15 1.6.2.1
@@ -1,7 +1,7 @@
/*
- * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/jasper/Constants.java,v 1.6 1999/10/21 02:47:50 mandar Exp $
- * $Revision: 1.6 $
- * $Date: 1999/10/21 02:47:50 $
+ * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/jasper/Constants.java,v 1.6.2.1 1999/10/28 01:04:15 gonzo Exp $
+ * $Revision: 1.6.2.1 $
+ * $Date: 1999/10/28 01:04:15 $
*
* ====================================================================
*
@@ -112,6 +112,14 @@
* want to have this JSP engine running on them.
*/
public static final String SERVLET_CLASSPATH = "org.apache.tomcat.jsp_classpath";
+
+ /**
+ * ServletContext attribute for classpath. This is tomcat specific.
+ * Other servlet engines can choose to have this attribute if they
+ * want to have this JSP engine running on them.
+ */
+ public static final String SERVLET_CLASS_LOADER = "org.apache.tomcat.classloader";
+
/**
* Codes that indicate how verbose you want the JSP engine to be.
No revision
No revision
1.5.2.3 +4 -4 jakarta-tomcat/src/share/org/apache/jasper/runtime/JspServlet.java
Index: JspServlet.java
===================================================================
RCS file: /home/cvs/jakarta-tomcat/src/share/org/apache/jasper/runtime/JspServlet.java,v
retrieving revision 1.5.2.2
retrieving revision 1.5.2.3
diff -u -r1.5.2.2 -r1.5.2.3
--- JspServlet.java 1999/10/27 10:30:23 1.5.2.2
+++ JspServlet.java 1999/10/28 01:04:17 1.5.2.3
@@ -1,7 +1,7 @@
/*
- * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/jasper/runtime/JspServlet.java,v 1.5.2.2 1999/10/27 10:30:23 akv Exp $
- * $Revision: 1.5.2.2 $
- * $Date: 1999/10/27 10:30:23 $
+ * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/jasper/runtime/JspServlet.java,v 1.5.2.3 1999/10/28 01:04:17 gonzo Exp $
+ * $Revision: 1.5.2.3 $
+ * $Date: 1999/10/28 01:04:17 $
*
* ====================================================================
*
@@ -200,7 +200,7 @@
else {
options = new Options(config, context);
- parentClassLoader = engine.getClassLoader(context);
+ parentClassLoader = (ClassLoader) context.getAttribute(Constants.SERVLET_CLASS_LOADER);
if (parentClassLoader == null)
parentClassLoader = this.getClass().getClassLoader();
No revision
No revision
1.2.2.1 +4 -3 jakarta-tomcat/src/share/org/apache/tomcat/core/Constants.java
Index: Constants.java
===================================================================
RCS file: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/core/Constants.java,v
retrieving revision 1.2
retrieving revision 1.2.2.1
diff -u -r1.2 -r1.2.2.1
--- Constants.java 1999/10/15 00:34:29 1.2
+++ Constants.java 1999/10/28 01:04:18 1.2.2.1
@@ -1,7 +1,7 @@
/*
- * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/core/Constants.java,v 1.2 1999/10/15 00:34:29 akv Exp $
- * $Revision: 1.2 $
- * $Date: 1999/10/15 00:34:29 $
+ * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/core/Constants.java,v 1.2.2.1 1999/10/28 01:04:18 gonzo Exp $
+ * $Revision: 1.2.2.1 $
+ * $Date: 1999/10/28 01:04:18 $
*
* ====================================================================
*
@@ -221,5 +221,6 @@
public static final String HTTPS = "https";
public static final String FILE = "file";
public static final String WAR = "war";
+ public static final String JAR = "jar";
}
}
1.1.2.1 +3 -12 jakarta-tomcat/src/share/org/apache/tomcat/core/Container.java
Index: Container.java
===================================================================
RCS file: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/core/Container.java,v
retrieving revision 1.1
retrieving revision 1.1.2.1
diff -u -r1.1 -r1.1.2.1
--- Container.java 1999/10/09 00:30:01 1.1
+++ Container.java 1999/10/28 01:04:18 1.1.2.1
@@ -1,7 +1,7 @@
/*
- * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/core/Container.java,v 1.1 1999/10/09 00:30:01 duncan Exp $
- * $Revision: 1.1 $
- * $Date: 1999/10/09 00:30:01 $
+ * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/core/Container.java,v 1.1.2.1 1999/10/28 01:04:18 gonzo Exp $
+ * $Revision: 1.1.2.1 $
+ * $Date: 1999/10/28 01:04:18 $
*
* ====================================================================
*
@@ -78,7 +78,6 @@
public class Container {
private Context context;
- private ClassLoader classLoader;
private ServletLoader servletLoader;
private Hashtable servlets = new Hashtable();
private Hashtable prefixMappedServlets = new Hashtable();
@@ -95,14 +94,6 @@
Context getContext() {
return context;
- }
-
- ClassLoader getClassLoader() {
- return this.classLoader;
- }
-
- void setClassLoader(ClassLoader classLoader) {
- this.classLoader = classLoader;
}
ServletLoader getLoader() {
1.5.2.2 +15 -17 jakarta-tomcat/src/share/org/apache/tomcat/core/Context.java
Index: Context.java
===================================================================
RCS file: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/core/Context.java,v
retrieving revision 1.5.2.1
retrieving revision 1.5.2.2
diff -u -r1.5.2.1 -r1.5.2.2
--- Context.java 1999/10/25 22:06:35 1.5.2.1
+++ Context.java 1999/10/28 01:04:19 1.5.2.2
@@ -1,7 +1,7 @@
/*
- * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/core/Context.java,v 1.5.2.1 1999/10/25 22:06:35 gonzo Exp $
- * $Revision: 1.5.2.1 $
- * $Date: 1999/10/25 22:06:35 $
+ * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/core/Context.java,v 1.5.2.2 1999/10/28 01:04:19 gonzo Exp $
+ * $Revision: 1.5.2.2 $
+ * $Date: 1999/10/28 01:04:19 $
*
* ====================================================================
*
@@ -241,19 +241,11 @@
}
public ClassLoader getClassLoader() {
- ClassLoader cl = this.container.getClassLoader();
-
- if (cl == null) {
- cl = (ClassLoader)this.container.getLoader();
- }
-
- return (ClassLoader)cl;
+ return this.classLoader;
}
public void setClassLoader(ClassLoader classLoader) {
- if (! this.initialized) {
- this.container.setClassLoader(classLoader);
- }
+ this.classLoader = classLoader;
}
public String getClassPath() {
@@ -270,8 +262,12 @@
return cp;
}
- public void setClassPath(String classpath) {
- this.classPath = classpath;
+ public void setClassPath(String classPath) {
+ if (this.classPath.trim().length() > 0) {
+ this.classPath += File.pathSeparator;
+ }
+
+ this.classPath += classPath;
}
/**
@@ -522,8 +518,10 @@
public Object getAttribute(String name) {
if (name.equals("org.apache.tomcat.jsp_classpath"))
- return getClassPath();
- else {
+ return getClassPath();
+ else if(name.equals("org.apache.tomcat.classloader")) {
+ return this.container.getLoader();
+ }else {
Object o = attributes.get(name);
return attributes.get(name);
}
1.1.2.3 +13 -5 jakarta-tomcat/src/share/org/apache/tomcat/core/Attic/RequestImpl.java
Index: RequestImpl.java
===================================================================
RCS file: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/core/Attic/RequestImpl.java,v
retrieving revision 1.1.2.2
retrieving revision 1.1.2.3
diff -u -r1.1.2.2 -r1.1.2.3
--- RequestImpl.java 1999/10/24 00:25:16 1.1.2.2
+++ RequestImpl.java 1999/10/28 01:04:19 1.1.2.3
@@ -1,7 +1,7 @@
/*
- * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/core/Attic/RequestImpl.java,v 1.1.2.2 1999/10/24 00:25:16 bergsten Exp $
- * $Revision: 1.1.2.2 $
- * $Date: 1999/10/24 00:25:16 $
+ * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/core/Attic/RequestImpl.java,v 1.1.2.3 1999/10/28 01:04:19 gonzo Exp $
+ * $Revision: 1.1.2.3 $
+ * $Date: 1999/10/28 01:04:19 $
*
* ====================================================================
*
@@ -347,9 +347,17 @@
public void setQueryString(String queryString) {
this.queryString = queryString;
- if (queryString != null) {
- setParameters(HttpUtils.parseQueryString(queryString));
+
+ Hashtable parameters = null;
+
+ // catch any parse exceptions
+
+ try {
+ parameters = HttpUtils.parseQueryString(queryString);
+ } catch (Exception e) {
}
+
+ setParameters(parameters);
}
public void setParameters(Hashtable parameters) {
1.2.2.1 +10 -9 jakarta-tomcat/src/share/org/apache/tomcat/core/ServletLoader.java
Index: ServletLoader.java
===================================================================
RCS file: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/core/ServletLoader.java,v
retrieving revision 1.2
retrieving revision 1.2.2.1
diff -u -r1.2 -r1.2.2.1
--- ServletLoader.java 1999/10/15 03:20:26 1.2
+++ ServletLoader.java 1999/10/28 01:04:20 1.2.2.1
@@ -1,7 +1,7 @@
/*
- * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/core/ServletLoader.java,v 1.2 1999/10/15 03:20:26 harishp Exp $
- * $Revision: 1.2 $
- * $Date: 1999/10/15 03:20:26 $
+ * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/core/ServletLoader.java,v 1.2.2.1 1999/10/28 01:04:20 gonzo Exp $
+ * $Revision: 1.2.2.1 $
+ * $Date: 1999/10/28 01:04:20 $
*
* ====================================================================
*
@@ -222,7 +222,7 @@
Class clazz = null;
try {
- ClassLoader parent = container.getClassLoader();
+ ClassLoader parent = container.getContext().getClassLoader();
if (parent != null) {
clazz = parent.loadClass(name);
@@ -369,11 +369,12 @@
try {
URL tURL = new URL(Constants.Request.FILE,
null, s);
- URL jURL = new URL(Constants.Request.WAR +
- ":" + tURL);
+ URL jURL = new URL(Constants.Request.JAR +
+ ":" + tURL + "!/" + entryName);
- u = resolveURL(jURL, null, entryName);
+ u = jURL;
} catch (MalformedURLException mue) {
+ mue.printStackTrace();
u = null;
}
@@ -457,8 +458,8 @@
s += ((! s.endsWith("/")) ? "/" : "") + name.trim();
}
- if (base.getProtocol().equalsIgnoreCase(Constants.Request.WAR)) {
- u = new URL(base.toString() +
+ if (base.getProtocol().equalsIgnoreCase(Constants.Request.JAR)) {
+ u = new URL(base.toString() +
((s.length() > 0) ? "!" : "") + s);
} else {
u = new URL(base.toString() +
No revision
No revision
1.1.2.1 +92 -0 jakarta-tomcat/src/share/org/apache/tomcat/protocol/jar/Attic/Handler.java
No revision
No revision
1.1.1.1.2.1 +10 -3 jakarta-tomcat/src/share/org/apache/tomcat/shell/Constants.java
Index: Constants.java
===================================================================
RCS file: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/shell/Constants.java,v
retrieving revision 1.1.1.1
retrieving revision 1.1.1.1.2.1
diff -u -r1.1.1.1 -r1.1.1.1.2.1
--- Constants.java 1999/10/09 00:20:54 1.1.1.1
+++ Constants.java 1999/10/28 01:04:23 1.1.1.1.2.1
@@ -1,7 +1,7 @@
/*
- * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/shell/Constants.java,v 1.1.1.1 1999/10/09 00:20:54 duncan Exp $
- * $Revision: 1.1.1.1 $
- * $Date: 1999/10/09 00:20:54 $
+ * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/shell/Constants.java,v 1.1.1.1.2.1 1999/10/28 01:04:23 gonzo Exp $
+ * $Revision: 1.1.1.1.2.1 $
+ * $Date: 1999/10/28 01:04:23 $
*
* ====================================================================
*
@@ -170,6 +170,13 @@
public static class Protocol {
public static class WAR {
+ public static final String PACKAGE =
+ "org.apache.tomcat.protocol";
+ public static final String SYSTEM_PROPERTY =
+ "java.protocol.handler.pkgs";
+ }
+
+ public static class JAR {
public static final String PACKAGE =
"org.apache.tomcat.protocol";
public static final String SYSTEM_PROPERTY =
1.1.1.1.2.1 +15 -9 jakarta-tomcat/src/share/org/apache/tomcat/shell/Startup.java
Index: Startup.java
===================================================================
RCS file: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/shell/Startup.java,v
retrieving revision 1.1.1.1
retrieving revision 1.1.1.1.2.1
diff -u -r1.1.1.1 -r1.1.1.1.2.1
--- Startup.java 1999/10/09 00:20:54 1.1.1.1
+++ Startup.java 1999/10/28 01:04:23 1.1.1.1.2.1
@@ -1,7 +1,7 @@
/*
- * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/shell/Startup.java,v 1.1.1.1 1999/10/09 00:20:54 duncan Exp $
- * $Revision: 1.1.1.1 $
- * $Date: 1999/10/09 00:20:54 $
+ * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/shell/Startup.java,v 1.1.1.1.2.1 1999/10/28 01:04:23 gonzo Exp $
+ * $Revision: 1.1.1.1.2.1 $
+ * $Date: 1999/10/28 01:04:23 $
*
* ====================================================================
*
@@ -89,13 +89,19 @@
// add war protocol handler to system properties
static {
+ String jarPackage = Constants.Protocol.JAR.PACKAGE;
+ String jarProtocol = Constants.Protocol.JAR.SYSTEM_PROPERTY;
+ String jarHandlers = System.getProperties().getProperty(jarProtocol);
String warPackage = Constants.Protocol.WAR.PACKAGE;
- String protocolKey = Constants.Protocol.WAR.SYSTEM_PROPERTY;
- String protocolHandlers =
- System.getProperties().getProperty(protocolKey);
- System.getProperties().put(protocolKey,
- (protocolHandlers == null) ?
- warPackage : protocolHandlers + "|" + warPackage);
+ String warProtocol = Constants.Protocol.WAR.SYSTEM_PROPERTY;
+ String warHandlers = System.getProperties().getProperty(warProtocol);
+
+ System.getProperties().put(jarProtocol,
+ (jarHandlers == null) ?
+ jarPackage : jarHandlers + "|" + jarPackage);
+ System.getProperties().put(warProtocol,
+ (warHandlers == null) ?
+ warPackage : warHandlers + "|" + warPackage);
};
/**
Re: cvs commit: jakarta-tomcat/src/share/org/apache/tomcat/shell
Constants.java Startup.java
Posted by James Todd <ja...@eng.sun.com>.
thx. the basic premise is that a call to RequestImpl.setQueryString()
with a null arg should 1) catch HttpUtils.parseQueryString()
exceptions [you caught this piece] and 2) it should null out
the associated parameters hashtable. the later piece was missing
as i see it.
thx much,
- james
Hans Bergsten wrote:
>
> gonzo@hyperreal.org wrote:
> > [...]
> > note: hans, if you could give this a once over i'd
> > be obliged
>
> I'll try to take a closer look later this week, or during the weekend.
> Too much stuff stacked up right now ;-)
>
> Hans
> --
> Hans Bergsten hans@gefionsoftware.com
> Gefion Software http://www.gefionsoftware.com
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
Re: cvs commit: jakarta-tomcat/src/share/org/apache/tomcat/shell
Constants.java Startup.java
Posted by Hans Bergsten <ha...@gefionsoftware.com>.
gonzo@hyperreal.org wrote:
> [...]
> note: hans, if you could give this a once over i'd
> be obliged
I'll try to take a closer look later this week, or during the weekend.
Too much stuff stacked up right now ;-)
Hans
--
Hans Bergsten hans@gefionsoftware.com
Gefion Software http://www.gefionsoftware.com
Re: DefaultServlet path checks
Posted by Hans Bergsten <ha...@gefionsoftware.com>.
Harish Prabandham wrote:
>
> Hi,
>
> Your fix sounds good... Does it address the case of a file that
> is named:
>
> foo.Bar.goo and Foo.Bar.GOO & such similar variations....
>
> .html and .htm variations etc....
>
> If It does, please commit the changes to the "trunk" only..
I'm not sure I understand what problem you refer to with the above
examples. It does address the case where someone tries to fool the
server to use the DefaultServlet to reveal the source of a JSP page
(or other extension based processing) by using extra characters or
using mixed case in the extension part. I assume that's what you
refer to in the first example.
But what do you mean by ".html and .htm variations etc."? How is
that supposed to be addressed?
Hans
--
Hans Bergsten hans@gefionsoftware.com
Gefion Software http://www.gefionsoftware.com
Re: DefaultServlet path checks
Posted by Harish Prabandham <Ha...@eng.sun.com>.
Hi,
Your fix sounds good... Does it address the case of a file that
is named:
foo.Bar.goo and Foo.Bar.GOO & such similar variations....
.html and .htm variations etc....
If It does, please commit the changes to the "trunk" only..
Thanx
Harish
Hans Bergsten wrote:
> Harish Prabandham wrote:
> >
> > Hi Hans,
> >
> > A fix similar to this exists on the J2EE branch. Please do not commit
> > any changes to the branch.
> >
> > Costin has merged the J2EE branch with the trunk, so this change
> > should be available there.... Could you check this out before you
> > commit your changes.
>
> The fix I proposed is not on the J2EE branch. I actually used the J2EE
> branch version as the source for the fix. The current fix tries to
> figure out if we're on a Windows or Unix platform using the file path
> separator character, and then checks the path according to different
> rules depending on platform. Since it uses the canPath != absPath check
> it has problems with non-8.3 paths on a Windows platform.
>
> My proposal is a check that works the same on all platform by only
> checking the critical piece of the path with "abs != can"; the file
> extension part.
>
> Hans
> --
> Hans Bergsten hans@gefionsoftware.com
> Gefion Software http://www.gefionsoftware.com
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
Re: DefaultServlet path checks
Posted by Hans Bergsten <ha...@gefionsoftware.com>.
Harish Prabandham wrote:
>
> Hi Hans,
>
> A fix similar to this exists on the J2EE branch. Please do not commit
> any changes to the branch.
>
> Costin has merged the J2EE branch with the trunk, so this change
> should be available there.... Could you check this out before you
> commit your changes.
The fix I proposed is not on the J2EE branch. I actually used the J2EE
branch version as the source for the fix. The current fix tries to
figure out if we're on a Windows or Unix platform using the file path
separator character, and then checks the path according to different
rules depending on platform. Since it uses the canPath != absPath check
it has problems with non-8.3 paths on a Windows platform.
My proposal is a check that works the same on all platform by only
checking the critical piece of the path with "abs != can"; the file
extension part.
Hans
--
Hans Bergsten hans@gefionsoftware.com
Gefion Software http://www.gefionsoftware.com
Re: DefaultServlet path checks
Posted by Harish Prabandham <Ha...@eng.sun.com>.
Hi Hans,
A fix similar to this exists on the J2EE branch. Please do not commit
any changes to the branch.
Costin has merged the J2EE branch with the trunk, so this change
should be available there.... Could you check this out before you
commit your changes.
Thanx
Harish
Hans Bergsten wrote:
> I believe I've found a solution for checking the path in the DefaultServlet
> that works with both 8.3 and long file paths on Windows and symbolic links
> on Unix, and still catches all attempts to get to the source of JSP files
> or other extension mapped files. I have only tested this on Windows but I
> don't see why it shouldn't work on other platforms.
>
> The solution is to always check for ".." and then only compare the file
> extension part of the URI with with the file extension from the canonical
> path. As far as I can tell, that's the only part we need to worry about
> since that's where extra characters or mixed case can fool the container
> to dispatch to DefaultServlet instead of a servlet mapped to the file
> extension. Mixed case in the path itself doesn't really matter; on a case
> sensitive platform the file will not be found, on a case insensitive it
> will be found but that's okay as long as we catch tricks with the extension
> part.
>
> Please take a look at this version of the serveFile() method. If everyone
> is happy with it, I will commit it to both the J2EE branch and the main
> branch.
>
> private void serveFile(File file, HttpServletRequest request,
> HttpServletResponse response) throws IOException {
>
> String absPath = file.getAbsolutePath();
> String canPath = file.getCanonicalPath();
> if(absPath.indexOf("..") != -1) {
> // We have .. in the path...
> response.sendError(response.SC_NOT_FOUND,
> "File Not Found:<br>" + absPath);
> return;
> }
>
> // Compare the file extension part of the requested name
> // with the "real" extension, to catch attempts to read
> // shtml or jsp source by adding characters or using mixed
> // case extension on Windows platforms
> String reqExt = absPath;
> int dot = absPath.lastIndexOf('.');
> if (dot != -1 && dot < absPath.length() - 1) {
> reqExt = absPath.substring(dot + 1);
> }
> String canExt = canPath;
> dot = canPath.lastIndexOf('.');
> if (dot != -1 && dot < canPath.length() - 1) {
> canExt = canPath.substring(dot + 1);
> }
> if (!canExt.equals(reqExt)) {
> response.sendError(response.SC_NOT_FOUND,
> "File Not Found:<br>" + absPath);
> return;
> }
>
> String mimeType = mimeTypes.getContentTypeFor(file.getName());
>
> if (mimeType == null) {
> mimeType = "text/plain";
> }
>
> response.setContentType(mimeType);
> response.setContentLength((int)file.length());
> response.setDateHeader("Last-Modified", file.lastModified());
>
> FileInputStream in = new FileInputStream(file);
>
> try {
> serveStream(in, request, response);
> } catch (FileNotFoundException e) {
> // Figure out what we're serving
>
> String requestURI = (String)request.getAttribute(
> Constants.Attribute.RequestURI);
>
> if (requestURI == null) {
> requestURI = request.getRequestURI();
> }
>
> response.sendError(response.SC_NOT_FOUND,
> "File Not Found<br>" + requestURI);
> } catch (SocketException e) {
> return; // munch
> } finally {
> if (in != null) {
> in.close();
> }
> }
> }
>
> --
> Hans Bergsten hans@gefionsoftware.com
> Gefion Software http://www.gefionsoftware.com
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
DefaultServlet path checks
Posted by Hans Bergsten <ha...@gefionsoftware.com>.
I believe I've found a solution for checking the path in the DefaultServlet
that works with both 8.3 and long file paths on Windows and symbolic links
on Unix, and still catches all attempts to get to the source of JSP files
or other extension mapped files. I have only tested this on Windows but I
don't see why it shouldn't work on other platforms.
The solution is to always check for ".." and then only compare the file
extension part of the URI with with the file extension from the canonical
path. As far as I can tell, that's the only part we need to worry about
since that's where extra characters or mixed case can fool the container
to dispatch to DefaultServlet instead of a servlet mapped to the file
extension. Mixed case in the path itself doesn't really matter; on a case
sensitive platform the file will not be found, on a case insensitive it
will be found but that's okay as long as we catch tricks with the extension
part.
Please take a look at this version of the serveFile() method. If everyone
is happy with it, I will commit it to both the J2EE branch and the main
branch.
private void serveFile(File file, HttpServletRequest request,
HttpServletResponse response) throws IOException {
String absPath = file.getAbsolutePath();
String canPath = file.getCanonicalPath();
if(absPath.indexOf("..") != -1) {
// We have .. in the path...
response.sendError(response.SC_NOT_FOUND,
"File Not Found:<br>" + absPath);
return;
}
// Compare the file extension part of the requested name
// with the "real" extension, to catch attempts to read
// shtml or jsp source by adding characters or using mixed
// case extension on Windows platforms
String reqExt = absPath;
int dot = absPath.lastIndexOf('.');
if (dot != -1 && dot < absPath.length() - 1) {
reqExt = absPath.substring(dot + 1);
}
String canExt = canPath;
dot = canPath.lastIndexOf('.');
if (dot != -1 && dot < canPath.length() - 1) {
canExt = canPath.substring(dot + 1);
}
if (!canExt.equals(reqExt)) {
response.sendError(response.SC_NOT_FOUND,
"File Not Found:<br>" + absPath);
return;
}
String mimeType = mimeTypes.getContentTypeFor(file.getName());
if (mimeType == null) {
mimeType = "text/plain";
}
response.setContentType(mimeType);
response.setContentLength((int)file.length());
response.setDateHeader("Last-Modified", file.lastModified());
FileInputStream in = new FileInputStream(file);
try {
serveStream(in, request, response);
} catch (FileNotFoundException e) {
// Figure out what we're serving
String requestURI = (String)request.getAttribute(
Constants.Attribute.RequestURI);
if (requestURI == null) {
requestURI = request.getRequestURI();
}
response.sendError(response.SC_NOT_FOUND,
"File Not Found<br>" + requestURI);
} catch (SocketException e) {
return; // munch
} finally {
if (in != null) {
in.close();
}
}
}
--
Hans Bergsten hans@gefionsoftware.com
Gefion Software http://www.gefionsoftware.com
Re: cvs commit: jakarta-tomcat/src/share/org/apache/tomcat/shell
Constants.java Startup.java
Posted by Hans Bergsten <ha...@gefionsoftware.com>.
gonzo@hyperreal.org wrote:
> [...]
> RequestImpl.setQueryString(String) with a null argument will
> likewise null the associated parameters hashtable
>
> note: hans, if you could give this a once over i'd
> be obliged
Sorry for not looking at this until now, but I have looked at all code
involved in parameter handling for forwarded and included request,
as well as run a number of tests. As far as I can tell it works fine now.
Thanks,
Hans
--
Hans Bergsten hans@gefionsoftware.com
Gefion Software http://www.gefionsoftware.com