RE: [SECURITY] Apache Tomcat 4.x JSP source disclosurevulnerability

2002-09-25 Thread Bob Herrmann
With power comes responsibility. <% System.exit(1) %> -bob P.S. Yea, I know the SecurityManager can catch this, if enabled. On Wed, 2002-09-25 at 21:22, Bojan Smojver wrote: > Quoting Costin Manolache <[EMAIL PROTECTED]>: > > > And Velocity does have a mailing list where all this can be discu

Re: [SECURITY] Apache Tomcat 4.x JSP source disclosurevulnerability

2002-09-25 Thread Jon Scott Stevens
on 2002/9/25 6:27 AM, "Costin Manolache" <[EMAIL PROTECTED]> wrote: > Well, this is not a very good policy IMO. Self-contained applications are > a good thing ( IMO ). Then store your templates in the WEB-INF directory. That is what we do with Scarab, which is 100% self contained. > And of cour

Re: [SECURITY] Apache Tomcat 4.x JSP source disclosurevulnerability

2002-09-24 Thread Jon Scott Stevens
on 2002/9/24 5:15 PM, "Steve Downey" <[EMAIL PROTECTED]> wrote: > http://localhost:8080/velexample/servlet/org.apache.catalina.servlets.DefaultS > ervlet/sample.vm Unlike JSP, we don't store (or encourage people to store) .vm files in the webroot. They can be anywhere on the fileystem and with c

Re: [SECURITY] Apache Tomcat 4.x JSP source disclosurevulnerability

2002-09-24 Thread Jon Scott Stevens
on 2002/9/24 4:59 AM, "Remy Maucherat" <[EMAIL PROTECTED]> wrote: > A security vulnerability has been confirmed to exist in all Apache > Tomcat 4.x releases (including Tomcat 4.0.4 and Tomcat 4.1.10), which > allows to use a specially crafted URL to return the unprocessed source > of a JSP page,