marcsaeg 01/06/14 08:26:09
Modified: src/examples/WEB-INF/classes/examples ShowSource.java
Log:
Porting ShowSource.java from 3.2.x. This contains the code that prevents
the ShowSource servlet from displaying contents of files in WEB-INF and META-INF
directories.
PR: 372
Submitted by: Tony Robertson ([EMAIL PROTECTED])
Revision Changes Path
1.5 +3 -1
jakarta-tomcat/src/examples/WEB-INF/classes/examples/ShowSource.java
Index: ShowSource.java
===================================================================
RCS file:
/home/cvs/jakarta-tomcat/src/examples/WEB-INF/classes/examples/ShowSource.java,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- ShowSource.java 2000/03/07 19:53:39 1.4
+++ ShowSource.java 2001/06/14 15:26:07 1.5
@@ -20,7 +20,9 @@
}
public int doEndTag() throws JspException {
- if (jspFile.indexOf( ".." ) >= 0)
+ if ((jspFile.indexOf( ".." ) >= 0) ||
+ (jspFile.toUpperCase().indexOf("/WEB-INF/") >= 0) ||
+ (jspFile.toUpperCase().indexOf("/META-INF/") >= 0))
throw new JspTagException("Invalid JSP file " + jspFile);
InputStream in
