You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Mike Wilson <mi...@hotmail.com> on 2017/03/17 20:21:20 UTC
classloader for components in META-INF/context.xml?
I also ran into [1].
Some Tomcat configuration with custom components (Valves, Managers etc) may
be done from a webapp's META-INF/context.xml. But currently if those classes
are your own custom implementations they will not be found if residing
inside the webapp's war (but are f ex found if placed in <tomcat>/lib).
Would it make sense for Tomcat to use the webapp classloader for components
that are specified in META-INF/context.xml?
Best regards
Mike Wilson
[1]
http://stackoverflow.com/questions/10924715/creating-a-custom-tomcat-session
-manager-without-putting-the-jar-in-the-catalina
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: classloader for components in META-INF/context.xml?
Posted by Konstantin Kolinko <kn...@gmail.com>.
2017-03-17 23:21 GMT+03:00 Mike Wilson <mi...@hotmail.com>:
>
> I also ran into [1].
>
> Some Tomcat configuration with custom components (Valves, Managers etc) may
> be done from a webapp's META-INF/context.xml. But currently if those classes
> are your own custom implementations they will not be found if residing
> inside the webapp's war (but are f ex found if placed in <tomcat>/lib).
>
> Would it make sense for Tomcat to use the webapp classloader for components
> that are specified in META-INF/context.xml?
>
> Best regards
> Mike Wilson
>
> [1]
> http://stackoverflow.com/questions/10924715/creating-a-custom-tomcat-session
> -manager-without-putting-the-jar-in-the-catalina
>
Besides the security issues that Mark mentions,
Note that Web application's classloader is only available when the web
application is running.
It means that
1) All those custom classes (Listeners, Valves etc.) cannot be created
at the time when context.xml is parsed, and must be replaced with some
stub objects.
2) They cannot process "destroy" event (when the application is
undeployed), as the classloader is stopped earlier - on "stop" event.
http://tomcat.apache.org/tomcat-8.5-doc/api/org/apache/catalina/Lifecycle.html
3) As Webapp classloader has priority over Tomcat classloader, you
cannot really create any component before Webapp classloader is
started - as the same class can be redefined in the web application.
http://tomcat.apache.org/tomcat-8.5-doc/class-loader-howto.html
4) Some objects are needed before Webapp classloader is started.
If context.xml redefines / reconfigures classloader implementation
(Loader element) - when is it created, and how?
What classloader is used to load and create it and why?
http://tomcat.apache.org/tomcat-8.5-doc/config/loader.html
A Listener can reconfigure web application before it is started. Some
of those will be broken.
E.g. a listener can perform the same actions as "PreResources" or
"PostResources" elements to inject additional JARs into webapp
classpath. It is better to do that before starting a web application
class loader.
http://tomcat.apache.org/tomcat-8.5-doc/config/resources.html
5) Configuration of a web application can be performed externally, via JMX API.
What objects will be exposed via JMX and starting with what moment / state?
http://tomcat.apache.org/tomcat-8.5-doc/monitoring.html
Best regards,
Konstantin Kolinko
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: classloader for components in META-INF/context.xml?
Posted by Mark Thomas <ma...@apache.org>.
On 18/03/17 20:04, Olaf Kock wrote:
> Am 18.03.2017 um 10:54 schrieb Mark Thomas:
>> On 17/03/2017 20:21, Mike Wilson wrote:
>>> I also ran into [1].
>>>
>>> Some Tomcat configuration with custom components (Valves, Managers etc) may
>>> be done from a webapp's META-INF/context.xml. But currently if those classes
>>> are your own custom implementations they will not be found if residing
>>> inside the webapp's war (but are f ex found if placed in <tomcat>/lib).
>>>
>>> Would it make sense for Tomcat to use the webapp classloader for components
>>> that are specified in META-INF/context.xml?
>> Potentially. It needs some thought when running under a SecurityManager.
> Mark,
> you probably know better than me - is there any kind of security
> assumption involved when referencing connection pools etc? The nice
> thing about JNDI resources (etc) is that the application has no
> knowledge of database credentials (unless tricking with reflection) -
> but if it can inject its own classes this way, I'd not be sure any more.
Hmm. I'd need to do some investigation to see what is possible.
Generally, I'd assume a web application has read access to the JNDI
config. If I am right, I'm not sure how practical it would be to stop that.
> Sure, this would be a server side attack, of a rogue web application.
> Not sure if this thought is valid or not - I just wanted to raise the
> issue so that it can be defeated or taken into account. Maybe this is
> what you meant with "when running under a SecurityManager".
This scenario is pretty rare. The most regularly cited use case is
shared hosting with multiple untrusted users sharing a single Tomcat
instance.
Given how trivial it is for one app to DoS the entire server (code a JSP
with a tight loop, request that JSP once per server code, server locks
up) this isn't a deployment strategy that gets used much. One app, one
Tomcat instance is a lot easier to manage in all sorts of ways.
We do try and protect against rouge apps running under a security
manager. Generally, bypassing the security manager gets treated as a low
severity (because it affects so few people) vulnerability. For example,
we recently blocked apps accessing global resources unless they were
explicitly linked to that resource (CVE-2016-6797).
Because custom Valves, Managers, etc. have access to Tomcat's internals
and do get called in the container's security context we'd need to be
careful. They all require configuration via context.xml and that gets
special treatment when running under a security manager. It requires the
system admin to explicitly copy the app provided context.xml to
$CATALINA_BASE/<engine>/<host> to enable it. The idea is that the admin
reviews the contents and only does this if it is safe. Working out what
is safe is rather tricky though. That would get even harder in the case
of a custom Manager etc.
In short it is a lot easier to treat the entire Tomcat instance as
untrusted rather than the container as trusted but not the app (or one
of the apps running on it).
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: classloader for components in META-INF/context.xml?
Posted by Olaf Kock <to...@olafkock.de>.
Am 18.03.2017 um 10:54 schrieb Mark Thomas:
> On 17/03/2017 20:21, Mike Wilson wrote:
>> I also ran into [1].
>>
>> Some Tomcat configuration with custom components (Valves, Managers etc) may
>> be done from a webapp's META-INF/context.xml. But currently if those classes
>> are your own custom implementations they will not be found if residing
>> inside the webapp's war (but are f ex found if placed in <tomcat>/lib).
>>
>> Would it make sense for Tomcat to use the webapp classloader for components
>> that are specified in META-INF/context.xml?
> Potentially. It needs some thought when running under a SecurityManager.
Mark,
you probably know better than me - is there any kind of security
assumption involved when referencing connection pools etc? The nice
thing about JNDI resources (etc) is that the application has no
knowledge of database credentials (unless tricking with reflection) -
but if it can inject its own classes this way, I'd not be sure any more.
Sure, this would be a server side attack, of a rogue web application.
Not sure if this thought is valid or not - I just wanted to raise the
issue so that it can be defeated or taken into account. Maybe this is
what you meant with "when running under a SecurityManager".
Olaf
> Mark
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: classloader for components in META-INF/context.xml?
Posted by Mark Thomas <ma...@apache.org>.
On 17/03/2017 20:21, Mike Wilson wrote:
>
> I also ran into [1].
>
> Some Tomcat configuration with custom components (Valves, Managers etc) may
> be done from a webapp's META-INF/context.xml. But currently if those classes
> are your own custom implementations they will not be found if residing
> inside the webapp's war (but are f ex found if placed in <tomcat>/lib).
>
> Would it make sense for Tomcat to use the webapp classloader for components
> that are specified in META-INF/context.xml?
Potentially. It needs some thought when running under a SecurityManager.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org