larryi 02/01/12 08:07:44
Modified: proposals/patches/tomcat33a JspInterceptor.java
JavaGeneratorTool.java ContextManager.java
Log:
Patches for Tomcat 3.3a to avoid DOS vulnerability, display "not found"
for the vulnerable request, and update the version to 3.3a.
Revision Changes Path
1.2 +8 -0 jakarta-tomcat/proposals/patches/tomcat33a/JspInterceptor.java
Index: JspInterceptor.java
===================================================================
RCS file: /home/cvs/jakarta-tomcat/proposals/patches/tomcat33a/JspInterceptor.java,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- JspInterceptor.java 12 Jan 2002 16:02:17 -0000 1.1
+++ JspInterceptor.java 12 Jan 2002 16:07:43 -0000 1.2
@@ -581,6 +581,14 @@
ctx.getAbsolutePath(),
jspFile );
+ // If unsafe path or JSP file doesn't exist, return "not found"
+ // Avoids creating work directories for non-existent JSP files
+ String path=mangler.getJspFilePath();
+ if( path == null )
+ return 404;
+ File f = new File( path );
+ if( !f.exists() )
+ return 404;
// register the handler as dependend of the jspfile
if( dep==null ) {
dep=setDependency( ctx, mangler, handler );
1.2 +5 -1
jakarta-tomcat/proposals/patches/tomcat33a/JavaGeneratorTool.java
Index: JavaGeneratorTool.java
===================================================================
RCS file:
/home/cvs/jakarta-tomcat/proposals/patches/tomcat33a/JavaGeneratorTool.java,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- JavaGeneratorTool.java 12 Jan 2002 16:02:17 -0000 1.1
+++ JavaGeneratorTool.java 12 Jan 2002 16:07:43 -0000 1.2
@@ -153,7 +153,11 @@
int version=0;
try {
FileInputStream fis=new FileInputStream( mapFile );
- version=(int)fis.read();
+ // The following helps avoid blocking on Windows DOS devices
+ // if someone tries to access something like aux.jsp.
+ if( fis.available() > 0 ) {
+ version=(int)fis.read();
+ }
fis.close();
} catch( Exception ex ) {
System.out.println("readVersion() mapPath=" + mapFile + ex);
1.2 +1 -1 jakarta-tomcat/proposals/patches/tomcat33a/ContextManager.java
Index: ContextManager.java
===================================================================
RCS file: /home/cvs/jakarta-tomcat/proposals/patches/tomcat33a/ContextManager.java,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- ContextManager.java 12 Jan 2002 16:02:17 -0000 1.1
+++ ContextManager.java 12 Jan 2002 16:07:43 -0000 1.2
@@ -148,7 +148,7 @@
public class ContextManager {
/** Official name and version
*/
- public static final String TOMCAT_VERSION = "3.3 Final";
+ public static final String TOMCAT_VERSION = "3.3a Final";
public static final String TOMCAT_NAME = "Tomcat Web Server";
/** System property used to set the base directory ( tomcat home ).
--
To unsubscribe, e-mail: <mailto:[EMAIL PROTECTED]>
For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>
