You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ds...@apache.org on 2026/04/22 11:39:54 UTC
(tomcat) branch main updated (0ceaf8b5d1 -> 20a4e0b16c)
This is an automated email from the ASF dual-hosted git repository.
dsoumis pushed a change to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
from 0ceaf8b5d1 Add a warning for missing OpenSSL and Tomcat Native during tests (#970)
new cb03ce72fb Rename FileStoreTest to TestFileStore to match the convention
new e2380adcca Add a test in TestFileStore relevant to CVE-2022-23181
new 20a4e0b16c Sort keys in TestFileStore causing issues in macOS testing
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../{FileStoreTest.java => TestFileStore.java} | 40 +++++++++++++++++++---
1 file changed, 35 insertions(+), 5 deletions(-)
rename test/org/apache/catalina/session/{FileStoreTest.java => TestFileStore.java} (66%)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
(tomcat) 02/03: Add a test in TestFileStore relevant to CVE-2022-23181
Posted by ds...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
dsoumis pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit e2380adccac9065452376012b7cf48e9ff9fa922
Author: Dimitris Soumis <ji...@gmail.com>
AuthorDate: Wed Apr 22 13:42:22 2026 +0300
Add a test in TestFileStore relevant to CVE-2022-23181
---
.../org/apache/catalina/session/TestFileStore.java | 33 ++++++++++++++++++++--
1 file changed, 30 insertions(+), 3 deletions(-)
diff --git a/test/org/apache/catalina/session/TestFileStore.java b/test/org/apache/catalina/session/TestFileStore.java
index 711b5b7e78..6054723c56 100644
--- a/test/org/apache/catalina/session/TestFileStore.java
+++ b/test/org/apache/catalina/session/TestFileStore.java
@@ -26,6 +26,7 @@ import org.junit.BeforeClass;
import org.junit.Test;
import org.apache.catalina.Manager;
+import org.apache.catalina.Session;
import org.apache.catalina.startup.ExpandWar;
import org.apache.tomcat.unittest.TesterContext;
import org.apache.tomcat.unittest.TesterServletContext;
@@ -35,9 +36,9 @@ public class TestFileStore {
private static final String SESS_TEMPPATH = "SESS_TEMP";
private static final File dir = new File(SESS_TEMPPATH);
private static FileStore fileStore;
- private static File file1 = new File(SESS_TEMPPATH + "/tmp1.session");
- private static File file2 = new File(SESS_TEMPPATH + "/tmp2.session");
- private static Manager manager = new StandardManager();
+ private static final File file1 = new File(SESS_TEMPPATH + "/tmp1.session");
+ private static final File file2 = new File(SESS_TEMPPATH + "/tmp2.session");
+ private static final Manager manager = new StandardManager();
@BeforeClass
@@ -97,4 +98,30 @@ public class TestFileStore {
fileStore.remove("tmp1");
Assert.assertEquals(1, fileStore.getSize());
}
+
+ @Test
+ public void pathTraversalSessionId() throws Exception {
+ File storageDir = dir.getAbsoluteFile();
+ File outsideFile = new File(storageDir.getParentFile(), "conf" + File.separator + "test.session");
+ File outsideDir = outsideFile.getParentFile();
+ boolean createdOutsideDir = false;
+ if (!outsideDir.exists()) {
+ Assert.assertTrue(outsideDir.mkdirs());
+ createdOutsideDir = true;
+ }
+ Assert.assertTrue(outsideFile.createNewFile());
+
+ try {
+ Session session = fileStore.load("./../conf/test");
+ Assert.assertNull(session);
+
+ fileStore.remove("./../conf/test");
+ Assert.assertTrue(outsideFile.exists());
+ } finally {
+ Assert.assertTrue(outsideFile.delete());
+ if (createdOutsideDir) {
+ Assert.assertTrue(outsideDir.delete());
+ }
+ }
+ }
}
\ No newline at end of file
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
(tomcat) 03/03: Sort keys in TestFileStore causing issues in macOS testing
Posted by ds...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
dsoumis pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 20a4e0b16cd2dea90e9346676678df2109d7b91a
Author: Dimitris Soumis <ji...@gmail.com>
AuthorDate: Wed Apr 22 14:10:10 2026 +0300
Sort keys in TestFileStore causing issues in macOS testing
---
test/org/apache/catalina/session/TestFileStore.java | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/test/org/apache/catalina/session/TestFileStore.java b/test/org/apache/catalina/session/TestFileStore.java
index 6054723c56..e2109a9dda 100644
--- a/test/org/apache/catalina/session/TestFileStore.java
+++ b/test/org/apache/catalina/session/TestFileStore.java
@@ -18,6 +18,7 @@ package org.apache.catalina.session;
import java.io.File;
import java.io.IOException;
+import java.util.Arrays;
import org.junit.AfterClass;
import org.junit.Assert;
@@ -87,7 +88,9 @@ public class TestFileStore {
@Test
public void keys() throws Exception {
- Assert.assertArrayEquals(new String[]{"tmp1", "tmp2"}, fileStore.keys());
+ String[] keys = fileStore.keys();
+ Arrays.sort(keys);
+ Assert.assertArrayEquals(new String[]{"tmp1", "tmp2"}, keys);
fileStore.clear();
Assert.assertArrayEquals(new String[]{}, fileStore.keys());
}
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
(tomcat) 01/03: Rename FileStoreTest to TestFileStore to match the convention
Posted by ds...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
dsoumis pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit cb03ce72fbaf96cef8cc720d6f8bc732d33f41bf
Author: Dimitris Soumis <ji...@gmail.com>
AuthorDate: Wed Apr 22 13:13:37 2026 +0300
Rename FileStoreTest to TestFileStore to match the convention
---
.../apache/catalina/session/{FileStoreTest.java => TestFileStore.java} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/test/org/apache/catalina/session/FileStoreTest.java b/test/org/apache/catalina/session/TestFileStore.java
similarity index 99%
rename from test/org/apache/catalina/session/FileStoreTest.java
rename to test/org/apache/catalina/session/TestFileStore.java
index f0f5f66929..711b5b7e78 100644
--- a/test/org/apache/catalina/session/FileStoreTest.java
+++ b/test/org/apache/catalina/session/TestFileStore.java
@@ -30,7 +30,7 @@ import org.apache.catalina.startup.ExpandWar;
import org.apache.tomcat.unittest.TesterContext;
import org.apache.tomcat.unittest.TesterServletContext;
-public class FileStoreTest {
+public class TestFileStore {
private static final String SESS_TEMPPATH = "SESS_TEMP";
private static final File dir = new File(SESS_TEMPPATH);
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org