Fridrich Strba
45b1f5a3f7
- Security hardening. Deprecate getResources() and always return null. (bsc#1198136) - Added patch: tomcat-9.0-hardening_getResources.patch OBS-URL: https://build.opensuse.org/request/show/967485 OBS-URL: https://build.opensuse.org/package/show/Java:packages/tomcat?expand=0&rev=236
52 lines
2.1 KiB
Diff
52 lines
2.1 KiB
Diff
From 8a904f6065080409a1e00606cd7bceec6ad8918c Mon Sep 17 00:00:00 2001
|
|
From: Mark Thomas <markt@apache.org>
|
|
Date: Wed, 30 Mar 2022 20:22:49 +0100
|
|
Subject: [PATCH] Security hardening. Deprecate getResources() and always
|
|
return null.
|
|
|
|
This method is never used by Tomcat. If something accidently exposes the
|
|
class loader then this method can be used to gain access to Tomcat
|
|
internals.
|
|
---
|
|
.../apache/catalina/loader/WebappClassLoaderBase.java | 7 ++++++-
|
|
webapps/docs/changelog.xml | 10 ++++++++++
|
|
2 files changed, 16 insertions(+), 1 deletion(-)
|
|
Index: apache-tomcat-9.0.43-src/java/org/apache/catalina/loader/WebappClassLoaderBase.java
|
|
===================================================================
|
|
--- apache-tomcat-9.0.43-src.orig/java/org/apache/catalina/loader/WebappClassLoaderBase.java
|
|
+++ apache-tomcat-9.0.43-src/java/org/apache/catalina/loader/WebappClassLoaderBase.java
|
|
@@ -425,10 +425,15 @@ public abstract class WebappClassLoaderB
|
|
// ------------------------------------------------------------- Properties
|
|
|
|
/**
|
|
+ * Unused. Always returns {@code null}.
|
|
+ *
|
|
* @return associated resources.
|
|
+ *
|
|
+ * @deprecated This will be removed in Tomcat 10.1.x onwards
|
|
*/
|
|
+ @Deprecated
|
|
public WebResourceRoot getResources() {
|
|
- return this.resources;
|
|
+ return null;
|
|
}
|
|
|
|
|
|
Index: apache-tomcat-9.0.43-src/webapps/docs/changelog.xml
|
|
===================================================================
|
|
--- apache-tomcat-9.0.43-src.orig/webapps/docs/changelog.xml
|
|
+++ apache-tomcat-9.0.43-src/webapps/docs/changelog.xml
|
|
@@ -106,6 +106,12 @@
|
|
<section name="Tomcat 9.0.43 (markt)">
|
|
<subsection name="Catalina">
|
|
<changelog>
|
|
+ <add>
|
|
+ Effectively disable the
|
|
+ <code>WebappClassLoaderBase.getResources()</code> method as it is not
|
|
+ used and if something accidently exposes the class loader this method
|
|
+ can be used to gain access to Tomcat internals. (markt)
|
|
+ </add>
|
|
<fix>
|
|
<bug>63508</bug>: NPE in JNDIRealm when no <code>userRoleAttribute</code>
|
|
is given. (fschumacher)
|