You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by cr...@locus.apache.org on 2000/05/15 04:50:36 UTC
cvs commit: jakarta-tomcat/proposals/catalina/src/share/org/apache/tomcat/loader FileClassLoader.java
craigmcc 00/05/14 19:50:35
Modified: proposals/catalina/src/share/org/apache/tomcat/core
StandardWrapper.java
proposals/catalina/src/share/org/apache/tomcat/loader
FileClassLoader.java
Log:
Implement protection against loading "org.apache.tomcat.*" classes in a
web application. This should make it possible to avoid having arbitrary
servlets casting the request and response objects they receive into the
corresponding internal object classes.
Certain servlets (such as the default file-serving servlet and the
invoker servlet) need to have such access to accomplish their required
functionality. Therefore, StandardWrapper has been modified to load
such servlets from the system class loader directly, rather than the
web application class loader.
Revision Changes Path
1.11 +33 -4 jakarta-tomcat/proposals/catalina/src/share/org/apache/tomcat/core/StandardWrapper.java
Index: StandardWrapper.java
===================================================================
RCS file: /home/cvs/jakarta-tomcat/proposals/catalina/src/share/org/apache/tomcat/core/StandardWrapper.java,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- StandardWrapper.java 2000/05/12 00:47:24 1.10
+++ StandardWrapper.java 2000/05/15 02:50:34 1.11
@@ -1,7 +1,7 @@
/*
- * $Header: /home/cvs/jakarta-tomcat/proposals/catalina/src/share/org/apache/tomcat/core/StandardWrapper.java,v 1.10 2000/05/12 00:47:24 craigmcc Exp $
- * $Revision: 1.10 $
- * $Date: 2000/05/12 00:47:24 $
+ * $Header: /home/cvs/jakarta-tomcat/proposals/catalina/src/share/org/apache/tomcat/core/StandardWrapper.java,v 1.11 2000/05/15 02:50:34 craigmcc Exp $
+ * $Revision: 1.11 $
+ * $Date: 2000/05/15 02:50:34 $
*
* ====================================================================
*
@@ -96,7 +96,7 @@
* make them efficient are counter-productive.
*
* @author Craig R. McClanahan
- * @version $Revision: 1.10 $ $Date: 2000/05/12 00:47:24 $
+ * @version $Revision: 1.11 $ $Date: 2000/05/15 02:50:34 $
*/
public final class StandardWrapper
@@ -538,6 +538,12 @@
* at least one initialized instance. This can be used, for example, to
* load servlets that are marked in the deployment descriptor to be loaded
* at server startup time.
+ * <p>
+ * <b>IMPLEMENTATION NOTE</b>: Servlets whose classnames begin with
+ * <code>org.apache.tomcat.</code> (so-called "container" servlets) are loaded
+ * by the same classloader that loaded this class, rather than the classloader
+ * for the current web application. This gives such classes access to Tomcat
+ * internals, which are prevented for classes loaded for web applications.
*
* @exception ServletException if thrown by the init() method of the
* loaded servlet
@@ -563,6 +569,11 @@
(sm.getString("standardWrapper.noLoader"));
}
ClassLoader classLoader = loader.getClassLoader();
+ if (isContainerServlet(servletClass)) {
+ classLoader = this.getClass().getClassLoader();
+ log(sm.getString
+ ("standardWrapper.containerServlet", servletClass));
+ }
// Load and initialize an instance of the specified servlet class
try {
@@ -719,6 +730,24 @@
// -------------------------------------------------------- Private Methods
+
+
+ /**
+ * Return <code>true</code> if the specified class name represents a
+ * container class that should be loaded by the system class loader.
+ *
+ * @param name Name of the class to be checked
+ */
+ private boolean isContainerServlet(String classname) {
+
+ if (classname.startsWith("org.apache.tomcat."))
+ return (true);
+ else if (classname.startsWith("org.apache.jasper."))
+ return (true); // FIXME - Only because of internal dependencies!
+ else
+ return (false);
+
+ }
// ------------------------------------------------------ Lifecycle Methods
1.5 +32 -10 jakarta-tomcat/proposals/catalina/src/share/org/apache/tomcat/loader/FileClassLoader.java
Index: FileClassLoader.java
===================================================================
RCS file: /home/cvs/jakarta-tomcat/proposals/catalina/src/share/org/apache/tomcat/loader/FileClassLoader.java,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- FileClassLoader.java 2000/05/14 02:29:00 1.4
+++ FileClassLoader.java 2000/05/15 02:50:35 1.5
@@ -1,13 +1,13 @@
/*
- * $Header: /home/cvs/jakarta-tomcat/proposals/catalina/src/share/org/apache/tomcat/loader/FileClassLoader.java,v 1.4 2000/05/14 02:29:00 craigmcc Exp $
- * $Revision: 1.4 $
- * $Date: 2000/05/14 02:29:00 $
+ * $Header: /home/cvs/jakarta-tomcat/proposals/catalina/src/share/org/apache/tomcat/loader/FileClassLoader.java,v 1.5 2000/05/15 02:50:35 craigmcc Exp $
+ * $Revision: 1.5 $
+ * $Date: 2000/05/15 02:50:35 $
*
* ====================================================================
*
* The Apache Software License, Version 1.1
*
- * Copyright (c) 1999 The Apache Software Foundation. All rights
+ * Copyright (c) 1999 The Apache Software Foundation. All rights
* reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -15,7 +15,7 @@
* are met:
*
* 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
+ * notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
@@ -23,15 +23,15 @@
* distribution.
*
* 3. The end-user documentation included with the redistribution, if
- * any, must include the following acknowlegement:
- * "This product includes software developed by the
+ * any, must include the following acknowlegement:
+ * "This product includes software developed by the
* Apache Software Foundation (http://www.apache.org/)."
* Alternately, this acknowlegement may appear in the software itself,
* if and wherever such third-party acknowlegements normally appear.
*
* 4. The names "The Jakarta Project", "Tomcat", and "Apache Software
* Foundation" must not be used to endorse or promote products derived
- * from this software without prior written permission. For written
+ * from this software without prior written permission. For written
* permission, please contact apache@apache.org.
*
* 5. Products derived from this software may not be called "Apache"
@@ -59,7 +59,7 @@
*
* [Additional notices, if required by prior licensing conditions]
*
- */
+ */
package org.apache.tomcat.loader;
@@ -94,7 +94,7 @@
* modified at runtime.
*
* @author Craig R. McClanahan
- * @version $Revision: 1.4 $ $Date: 2000/05/14 02:29:00 $
+ * @version $Revision: 1.5 $ $Date: 2000/05/15 02:50:35 $
*/
public final class FileClassLoader
@@ -519,7 +519,16 @@
// if (debug >= 2)
// log("loadClass(" + name + ", " + resolve + ")");
+ // Handle requests for restricted classes by throwing an exception
+ if (restricted(name)) {
+ // if (debug >= 2)
+ // log(" Rejecting restricted class " + name);
+ throw new ClassNotFoundException
+ (sm.getString("fileClassLoader.restricted", name));
+ }
+
// Handle server classes in a special way to preserve statics
+/*
if (server(name)) {
// if (debug >= 2)
// log(" Checking the server class path");
@@ -533,6 +542,7 @@
// log(" Cannot find this server class");
throw new ClassNotFoundException(name);
}
+*/
// Has this class already been loaded?
CacheEntry entry = (CacheEntry) cache.get(name);
@@ -930,6 +940,18 @@
System.out.println("FileClassLoader: " + message);
throwable.printStackTrace(System.out);
+
+ }
+
+
+ /**
+ * Is this a class that should not be allowed in a web application?
+ *
+ * @param name Name of the class to be checked
+ */
+ private boolean restricted(String name) {
+
+ return (name.startsWith("org.apache.tomcat."));
}