6e5c662b6a
- CVE-2021-24122 OBS-URL: https://build.opensuse.org/request/show/879719 OBS-URL: https://build.opensuse.org/package/show/Java:packages/tomcat?expand=0&rev=218
78 lines
3.9 KiB
Diff
78 lines
3.9 KiB
Diff
Index: apache-tomcat-9.0.36-src/java/org/apache/catalina/webresources/AbstractFileResourceSet.java
|
|
===================================================================
|
|
--- apache-tomcat-9.0.36-src.orig/java/org/apache/catalina/webresources/AbstractFileResourceSet.java
|
|
+++ apache-tomcat-9.0.36-src/java/org/apache/catalina/webresources/AbstractFileResourceSet.java
|
|
@@ -22,11 +22,15 @@ import java.net.MalformedURLException;
|
|
import java.net.URL;
|
|
|
|
import org.apache.catalina.LifecycleException;
|
|
+import org.apache.juli.logging.Log;
|
|
+import org.apache.juli.logging.LogFactory;
|
|
import org.apache.tomcat.util.compat.JrePlatform;
|
|
import org.apache.tomcat.util.http.RequestUtil;
|
|
|
|
public abstract class AbstractFileResourceSet extends AbstractResourceSet {
|
|
|
|
+ private static final Log log = LogFactory.getLog(AbstractFileResourceSet.class);
|
|
+
|
|
protected static final String[] EMPTY_STRING_ARRAY = new String[0];
|
|
|
|
private File fileBase;
|
|
@@ -128,6 +132,19 @@ public abstract class AbstractFileResour
|
|
canPath = normalize(canPath);
|
|
}
|
|
if (!canPath.equals(absPath)) {
|
|
+ if (!canPath.equalsIgnoreCase(absPath)) {
|
|
+ // Typically means symlinks are in use but being ignored. Given
|
|
+ // the symlink was likely created for a reason, log a warning
|
|
+ // that it was ignored.
|
|
+ String msg = sm.getString("abstractFileResourceSet.canonicalfileCheckFailed",
|
|
+ getRoot().getContext().getName(), absPath, canPath);
|
|
+ // Log issues with configuration files at a higher level
|
|
+ if(absPath.startsWith("/META-INF/") || absPath.startsWith("/WEB-INF/")) {
|
|
+ log.error(msg);
|
|
+ } else {
|
|
+ log.warn(msg);
|
|
+ }
|
|
+ }
|
|
return null;
|
|
}
|
|
|
|
@@ -144,7 +161,7 @@ public abstract class AbstractFileResour
|
|
// expression irrespective of input length.
|
|
for (int i = 0; i < len; i++) {
|
|
char c = name.charAt(i);
|
|
- if (c == '\"' || c == '<' || c == '>') {
|
|
+ if (c == '\"' || c == '<' || c == '>' || c == ':') {
|
|
// These characters are disallowed in Windows file names and
|
|
// there are known problems for file names with these characters
|
|
// when using File#getCanonicalPath().
|
|
Index: apache-tomcat-9.0.36-src/java/org/apache/catalina/webresources/LocalStrings.properties
|
|
===================================================================
|
|
--- apache-tomcat-9.0.36-src.orig/java/org/apache/catalina/webresources/LocalStrings.properties
|
|
+++ apache-tomcat-9.0.36-src/java/org/apache/catalina/webresources/LocalStrings.properties
|
|
@@ -15,6 +15,8 @@
|
|
|
|
abstractArchiveResourceSet.setReadOnlyFalse=Archive based WebResourceSets such as those based on JARs are hard-coded to be read-only and may not be configured to be read-write
|
|
|
|
+abstractFileResourceSet.canonicalfileCheckFailed=Resource for web application [{0}] at path [{1}] was not loaded as the canonical path [{2}] did not match. Use of symlinks is one possible cause.
|
|
+
|
|
abstractResource.getContentFail=Unable to return [{0}] as a byte array
|
|
abstractResource.getContentTooLarge=Unable to return [{0}] as a byte array since the resource is [{1}] bytes in size which is larger than the maximum size of a byte array
|
|
|
|
Index: apache-tomcat-9.0.36-src/webapps/docs/changelog.xml
|
|
===================================================================
|
|
--- apache-tomcat-9.0.36-src.orig/webapps/docs/changelog.xml
|
|
+++ apache-tomcat-9.0.36-src/webapps/docs/changelog.xml
|
|
@@ -81,6 +81,10 @@
|
|
<bug>64493</bug>: Revert possible change of returned protocol
|
|
attribute value on the <code>Connector</code>. (remm)
|
|
</fix>
|
|
+ <add>
|
|
+ <bug>64871</bug>: Log a warning if Tomcat blocks access to a file
|
|
+ because it uses symlinks. (markt)
|
|
+ </add>
|
|
</changelog>
|
|
</subsection>
|
|
<subsection name="Coyote">
|