[tomcat] branch 10.0.x updated: Do not include sensitive headers in responses to HTTP TRACE requests

[ma...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch 10.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/10.0.x by this push:
     new 76cc9fe48f Do not include sensitive headers in responses to HTTP TRACE requests
76cc9fe48f is described below

commit 76cc9fe48f3f3ef0da7a71345fac5ec786a00204
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Mon Aug 1 17:36:18 2022 +0100

    Do not include sensitive headers in responses to HTTP TRACE requests
    
    This is a requirement of RFC 7231, 4.3.8
---
 java/jakarta/servlet/http/HttpServlet.java     | 22 ++++++++++++++++++----
 test/jakarta/servlet/http/TestHttpServlet.java |  8 ++++++++
 webapps/docs/changelog.xml                     |  4 ++++
 3 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/java/jakarta/servlet/http/HttpServlet.java b/java/jakarta/servlet/http/HttpServlet.java
index 016ce4944d..a2d8d51cca 100644
--- a/java/jakarta/servlet/http/HttpServlet.java
+++ b/java/jakarta/servlet/http/HttpServlet.java
@@ -25,7 +25,10 @@ import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.text.MessageFormat;
 import java.util.Enumeration;
+import java.util.HashSet;
+import java.util.Locale;
 import java.util.ResourceBundle;
+import java.util.Set;
 
 import jakarta.servlet.AsyncEvent;
 import jakarta.servlet.AsyncListener;
@@ -94,6 +97,8 @@ public abstract class HttpServlet extends GenericServlet {
     private static final String LSTRING_FILE = "jakarta.servlet.http.LocalStrings";
     private static final ResourceBundle lStrings = ResourceBundle.getBundle(LSTRING_FILE);
 
+    private static final Set<String> SENSITIVE_HTTP_HEADERS = new HashSet<>();
+
     private final transient Object cachedAllowHeaderValueLock = new Object();
     /**
      * Cached value of the HTTP {@code Allow} header for this servlet.
@@ -101,6 +106,12 @@ public abstract class HttpServlet extends GenericServlet {
     private volatile String cachedAllowHeaderValue = null;
 
 
+    static {
+        SENSITIVE_HTTP_HEADERS.add("cookie");
+        SENSITIVE_HTTP_HEADERS.add("www-authenticate");
+    }
+
+
     /**
      * Does nothing, because this is an abstract class.
      */
@@ -612,10 +623,13 @@ public abstract class HttpServlet extends GenericServlet {
 
         while (reqHeaderNames.hasMoreElements()) {
             String headerName = reqHeaderNames.nextElement();
-            Enumeration<String> headerValues = req.getHeaders(headerName);
-            while (headerValues.hasMoreElements()) {
-                String headerValue = headerValues.nextElement();
-                buffer.append(CRLF).append(headerName).append(": ").append(headerValue);
+            // RFC 7231, 4.3.8 - skip 'sensitive' headers
+            if (!SENSITIVE_HTTP_HEADERS.contains(headerName.toLowerCase(Locale.ENGLISH))) {
+                Enumeration<String> headerValues = req.getHeaders(headerName);
+                while (headerValues.hasMoreElements()) {
+                    String headerValue = headerValues.nextElement();
+                    buffer.append(CRLF).append(headerName).append(": ").append(headerValue);
+                }
             }
         }
 
diff --git a/test/jakarta/servlet/http/TestHttpServlet.java b/test/jakarta/servlet/http/TestHttpServlet.java
index 3697960245..44174e009a 100644
--- a/test/jakarta/servlet/http/TestHttpServlet.java
+++ b/test/jakarta/servlet/http/TestHttpServlet.java
@@ -20,6 +20,7 @@ import java.io.IOException;
 import java.io.PrintWriter;
 import java.util.HashMap;
 import java.util.List;
+import java.util.Locale;
 import java.util.Map;
 
 import jakarta.servlet.AsyncContext;
@@ -315,6 +316,8 @@ public class TestHttpServlet extends TomcatBaseTest {
                 "Host: localhost:" + getPort() + SimpleHttpClient.CRLF +
                 "X-aaa: a1, a2" + SimpleHttpClient.CRLF +
                 "X-aaa: a3" + SimpleHttpClient.CRLF +
+                "Cookie: c1-v1" + SimpleHttpClient.CRLF +
+                "WWW-Authenticate: not-a-real-credential" + SimpleHttpClient.CRLF +
                 SimpleHttpClient.CRLF});
         client.setUseContentLength(true);
 
@@ -328,9 +331,14 @@ public class TestHttpServlet extends TomcatBaseTest {
 
         Assert.assertTrue(client.getResponseLine(), client.isResponse200());
         // Far from perfect but good enough
+        body = body.toLowerCase(Locale.ENGLISH);
         Assert.assertTrue(body.contains("a1"));
         Assert.assertTrue(body.contains("a2"));
         Assert.assertTrue(body.contains("a3"));
+        // Sensitive headers (cookies, WWW-Authenticate) must not be reflected
+        // (since RFC 7231)
+        Assert.assertFalse(body.contains("cookie"));
+        Assert.assertFalse(body.contains("www-authenticate"));
 
         client.disconnect();
     }
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 8dac471661..2193f3d738 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -111,6 +111,10 @@
         Correct handling of HTTP TRACE requests where there are multiple
         instances of an HTTP header with the same name. (markt)
       </fix>
+      <fix>
+        Implement the requirements of RFC 7231 and do not include sensitive
+        headers in responses to HTTP TRACE requests. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org