You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Justin Chen <ch...@msn.com> on 2025/04/08 07:16:38 UTC
HOWTO: the right way to configure security constraints to protect CGI scripts in web.xml
Dear users and supporters,
Currently I have two CGI scripts:
1. "/cgi-bin/update" //an administrative command, required role="admin"
2. "/cgi-bin/updateOrder" //update order, required role="biz"
In order to protect above endpoints via web.xml security-constraints mechanism, how shall I do?
Regards,
Chenjp
Re: HOWTO: the right way to configure security constraints to protect CGI scripts in web.xml
Posted by Rémy Maucherat <re...@apache.org>.
On Wed, Apr 9, 2025 at 2:49 AM Justin Chen <ch...@msn.com> wrote:
>
> Hi Mark and Chris,
>
> As suggested, updated configurations as follows:
> <web-app>
> <display-name>security-tomcat-2025</display-name>
> <servlet>
> <servlet-name>cgi</servlet-name>
> <servlet-class>org.apache.catalina.servlets.CGIServlet</servlet-class>
> <init-param>
> <param-name>cgiPathPrefix</param-name>
> <param-value>/WEB-INF/cgi</param-value>
> </init-param>
> <init-param>
> <param-name>executable</param-name>
> <param-value>C:\Perl\strawberry\perl\bin\perl.exe</param-value>
> </init-param>
> <load-on-startup>5</load-on-startup>
> </servlet>
> <servlet-mapping>
> <servlet-name>cgi</servlet-name>
> <url-pattern>/cgi-bin/*</url-pattern>
> </servlet-mapping>
>
> <security-constraint>
> <web-resource-collection>
> <web-resource-name>admin-stuff</web-resource-name>
> <url-pattern>/cgi-bin/update</url-pattern>
> </web-resource-collection>
> <auth-constraint>
> <role-name>admin</role-name>
> </auth-constraint>
> </security-constraint>
>
> <security-constraint>
> <web-resource-collection>
> <web-resource-name>biz-stuff</web-resource-name>
> <url-pattern>/cgi-bin/updateOrder</url-pattern>
> </web-resource-collection>
> <auth-constraint>
> <role-name>biz</role-name>
> </auth-constraint>
> </security-constraint>
> </web-app>
>
> Is it an appropriate security constraints and secure enough for CGI?
I disagree with that, the Servlet should always be secured with
/cgi-bin/* (if the Servlet is mapped to /cgi-bin/* as well). The
Servlet is doing its own thing with the path info and mapping, so any
other security mapping would be open to second guesses. It is the same
with any servlet that is using its path info liberally.
Rémy
> Chenjp
> ________________________________
> From: Mark Thomas <ma...@apache.org>
> Sent: Wednesday, April 9, 2025 5:40
> To: Tomcat Users List <us...@tomcat.apache.org>
> Subject: Re: HOWTO: the right way to configure security constraints to protect CGI scripts in web.xml
>
> 8 Apr 2025 21:45:50 Christopher Schultz <ch...@christopherschultz.net>:
>
> > Justin,
> >
> > On 4/8/25 3:16 AM, Justin Chen wrote:
> >> Dear users and supporters,
> >> Currently I have two CGI scripts:
> >> 1. "/cgi-bin/update" //an administrative command, required
> >> role="admin"
> >> 2. "/cgi-bin/updateOrder" //update order, required role="biz"
> >> In order to protect above endpoints via web.xml security-constraints
> >> mechanism, how shall I do?
> >
> > It should be as simple as this in your web.xml:
>
> Whether the below is correct depends on how the CGI Servlet is mapped.
> And the OP hasn't provided that information.
>
> Mark
>
>
> >
> > <web-app>
> > ....
> >
> > <security-constraint>
> > <web-resource-collection>
> > <web-resource-name>admin-stuff</web-resource-name>
> > <url-pattern>/cgi-bin/update</url-pattern>
> > </web-resource-collection>
> > <auth-constraint>
> > <role-name>admin</role-name>
> > </auth-constraint>
> > </security-constraint>
> >
> > <security-constraint>
> > <web-resource-collection>
> > <web-resource-name>biz-stuff</web-resource-name>
> > <url-pattern>/cgi-bin/updateOrder</url-pattern>
> > </web-resource-collection>
> > <auth-constraint>
> > <role-name>biz</role-name>
> > </auth-constraint>
> > </security-constraint>
> > </web-app>
> >
> > -chris
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> > For additional commands, e-mail: users-help@tomcat.apache.org
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: HOWTO: the right way to configure security constraints to protect CGI scripts in web.xml
Posted by Justin Chen <ch...@msn.com>.
Hi Mark and Chris,
As suggested, updated configurations as follows:
<web-app>
<display-name>security-tomcat-2025</display-name>
<servlet>
<servlet-name>cgi</servlet-name>
<servlet-class>org.apache.catalina.servlets.CGIServlet</servlet-class>
<init-param>
<param-name>cgiPathPrefix</param-name>
<param-value>/WEB-INF/cgi</param-value>
</init-param>
<init-param>
<param-name>executable</param-name>
<param-value>C:\Perl\strawberry\perl\bin\perl.exe</param-value>
</init-param>
<load-on-startup>5</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>cgi</servlet-name>
<url-pattern>/cgi-bin/*</url-pattern>
</servlet-mapping>
<security-constraint>
<web-resource-collection>
<web-resource-name>admin-stuff</web-resource-name>
<url-pattern>/cgi-bin/update</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>admin</role-name>
</auth-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>biz-stuff</web-resource-name>
<url-pattern>/cgi-bin/updateOrder</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>biz</role-name>
</auth-constraint>
</security-constraint>
</web-app>
Is it an appropriate security constraints and secure enough for CGI?
Chenjp
________________________________
From: Mark Thomas <ma...@apache.org>
Sent: Wednesday, April 9, 2025 5:40
To: Tomcat Users List <us...@tomcat.apache.org>
Subject: Re: HOWTO: the right way to configure security constraints to protect CGI scripts in web.xml
8 Apr 2025 21:45:50 Christopher Schultz <ch...@christopherschultz.net>:
> Justin,
>
> On 4/8/25 3:16 AM, Justin Chen wrote:
>> Dear users and supporters,
>> Currently I have two CGI scripts:
>> 1. "/cgi-bin/update" //an administrative command, required
>> role="admin"
>> 2. "/cgi-bin/updateOrder" //update order, required role="biz"
>> In order to protect above endpoints via web.xml security-constraints
>> mechanism, how shall I do?
>
> It should be as simple as this in your web.xml:
Whether the below is correct depends on how the CGI Servlet is mapped.
And the OP hasn't provided that information.
Mark
>
> <web-app>
> ....
>
> <security-constraint>
> <web-resource-collection>
> <web-resource-name>admin-stuff</web-resource-name>
> <url-pattern>/cgi-bin/update</url-pattern>
> </web-resource-collection>
> <auth-constraint>
> <role-name>admin</role-name>
> </auth-constraint>
> </security-constraint>
>
> <security-constraint>
> <web-resource-collection>
> <web-resource-name>biz-stuff</web-resource-name>
> <url-pattern>/cgi-bin/updateOrder</url-pattern>
> </web-resource-collection>
> <auth-constraint>
> <role-name>biz</role-name>
> </auth-constraint>
> </security-constraint>
> </web-app>
>
> -chris
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: HOWTO: the right way to configure security constraints to protect CGI scripts in web.xml
Posted by Justin Chen <ch...@msn.com>.
Hi,
Per jsp-url per servlet is never on the menu.
The difference between CGI Servlet and JSP Servlet is the script file search mechanism. e.g. two requests, "/xxx/update" and "/xxx/update/abc" are mapping into two different JSP script files if ruled by JSP Servlet. Unfortunately, the different requests are mapping to the same CGI script file if ruled by CGI Servlet and /xxx/update lookup succeeded.
For those cgi part, suggest enhance url-pattern ("/cgi-bin/update" + "/cgi-bin/update/*") for each specific security-constraint, e.g.:
```xml
<security-constraint>
<web-resource-collection>
<web-resource-name>admin-stuff</web-resource-name>
<url-pattern>/cgi-bin/update</url-pattern>
<url-pattern>/cgi-bin/update/*</url-pattern> <!-- CGI: refer to same cgi script with above "/cgi-bin/update" -->
</web-resource-collection>
<auth-constraint>
<role-name>admin</role-name>
</auth-constraint>
</security-constraint>
```
Full web.xml for reference:
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-app_6_0.xsd"
id="WebApp_ID" version="6.0">
<display-name>sec-lab</display-name>
<servlet>
<servlet-name>cgi</servlet-name>
<servlet-class>org.apache.catalina.servlets.CGIServlet</servlet-class>
<init-param>
<param-name>cgiPathPrefix</param-name>
<param-value>/WEB-INF/cgi</param-value>
</init-param>
<init-param>
<param-name>executable</param-name>
<param-value>C:\Perl\strawberry\perl\bin\perl.exe</param-value>
</init-param>
<load-on-startup>5</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>cgi</servlet-name>
<url-pattern>/cgi-bin/*</url-pattern>
</servlet-mapping>
<security-constraint>
<web-resource-collection>
<web-resource-name>CGI-protected-area</web-resource-name>
<url-pattern>/cgi-bin/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>staff</role-name>
</auth-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>admin-stuff</web-resource-name>
<url-pattern>/cgi-bin/update</url-pattern>
<url-pattern>/cgi-bin/update/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>admin</role-name>
</auth-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>biz-stuff</web-resource-name>
<url-pattern>/cgi-bin/updateOrder</url-pattern>
<url-pattern>/cgi-bin/updateOrder/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>biz</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>SecurityLab</realm-name>
</login-config>
<security-role>
<description>The role is required to access cgi scripts</description>
<role-name>staff</role-name>
</security-role>
<security-role>
<description>The role is required to access administrative cgi scripts</description>
<role-name>admin</role-name>
</security-role>
<security-role>
<description>The role is required to access biz purpose cgi scripts</description>
<role-name>biz</role-name>
</security-role>
</web-app>
Chenjp
________________________________
From: Christopher Schultz <ch...@christopherschultz.net>
Sent: Thursday, April 10, 2025 2:22
To: users@tomcat.apache.org <us...@tomcat.apache.org>
Subject: Re: HOWTO: the right way to configure security constraints to protect CGI scripts in web.xml
Mark,
On 4/8/25 5:40 PM, Mark Thomas wrote:
> 8 Apr 2025 21:45:50 Christopher Schultz <ch...@christopherschultz.net>:
>
>> Justin,
>>
>> On 4/8/25 3:16 AM, Justin Chen wrote:
>>> Dear users and supporters,
>>> Currently I have two CGI scripts:
>>> 1. "/cgi-bin/update" //an administrative command, required role="admin"
>>> 2. "/cgi-bin/updateOrder" //update order, required role="biz"
>>> In order to protect above endpoints via web.xml security-constraints
>>> mechanism, how shall I do?
>>
>> It should be as simple as this in your web.xml:
>
> Whether the below is correct depends on how the CGI Servlet is mapped.
> And the OP hasn't provided that information.
+1
I first wrote, then deleted three paragraphs on that exact topic before
sending my reply. I didn't want to go into too much detail because it
really depends upon the use case.
The best thing to do is declare exactly one CGI script per url-pattern,
then match all security constraints matching each of those url-patterns.
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: HOWTO: the right way to configure security constraints to protect CGI scripts in web.xml
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Mark,
On 4/8/25 5:40 PM, Mark Thomas wrote:
> 8 Apr 2025 21:45:50 Christopher Schultz <ch...@christopherschultz.net>:
>
>> Justin,
>>
>> On 4/8/25 3:16 AM, Justin Chen wrote:
>>> Dear users and supporters,
>>> Currently I have two CGI scripts:
>>> 1. "/cgi-bin/update" //an administrative command, required role="admin"
>>> 2. "/cgi-bin/updateOrder" //update order, required role="biz"
>>> In order to protect above endpoints via web.xml security-constraints
>>> mechanism, how shall I do?
>>
>> It should be as simple as this in your web.xml:
>
> Whether the below is correct depends on how the CGI Servlet is mapped.
> And the OP hasn't provided that information.
+1
I first wrote, then deleted three paragraphs on that exact topic before
sending my reply. I didn't want to go into too much detail because it
really depends upon the use case.
The best thing to do is declare exactly one CGI script per url-pattern,
then match all security constraints matching each of those url-patterns.
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: HOWTO: the right way to configure security constraints to protect CGI scripts in web.xml
Posted by Mark Thomas <ma...@apache.org>.
8 Apr 2025 21:45:50 Christopher Schultz <ch...@christopherschultz.net>:
> Justin,
>
> On 4/8/25 3:16 AM, Justin Chen wrote:
>> Dear users and supporters,
>> Currently I have two CGI scripts:
>> 1. "/cgi-bin/update" //an administrative command, required
>> role="admin"
>> 2. "/cgi-bin/updateOrder" //update order, required role="biz"
>> In order to protect above endpoints via web.xml security-constraints
>> mechanism, how shall I do?
>
> It should be as simple as this in your web.xml:
Whether the below is correct depends on how the CGI Servlet is mapped.
And the OP hasn't provided that information.
Mark
>
> <web-app>
> ....
>
> <security-constraint>
> <web-resource-collection>
> <web-resource-name>admin-stuff</web-resource-name>
> <url-pattern>/cgi-bin/update</url-pattern>
> </web-resource-collection>
> <auth-constraint>
> <role-name>admin</role-name>
> </auth-constraint>
> </security-constraint>
>
> <security-constraint>
> <web-resource-collection>
> <web-resource-name>biz-stuff</web-resource-name>
> <url-pattern>/cgi-bin/updateOrder</url-pattern>
> </web-resource-collection>
> <auth-constraint>
> <role-name>biz</role-name>
> </auth-constraint>
> </security-constraint>
> </web-app>
>
> -chris
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: HOWTO: the right way to configure security constraints to protect CGI scripts in web.xml
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Justin,
On 4/8/25 3:16 AM, Justin Chen wrote:
> Dear users and supporters,
>
> Currently I have two CGI scripts:
> 1. "/cgi-bin/update" //an administrative command, required role="admin"
> 2. "/cgi-bin/updateOrder" //update order, required role="biz"
>
> In order to protect above endpoints via web.xml security-constraints mechanism, how shall I do?
It should be as simple as this in your web.xml:
<web-app>
....
<security-constraint>
<web-resource-collection>
<web-resource-name>admin-stuff</web-resource-name>
<url-pattern>/cgi-bin/update</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>admin</role-name>
</auth-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>biz-stuff</web-resource-name>
<url-pattern>/cgi-bin/updateOrder</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>biz</role-name>
</auth-constraint>
</security-constraint>
</web-app>
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org