File apache-tomcat-CVE-2008-5515.patch of Package tomcat6
Index: apache-tomcat-6.0.18-src/java/org/apache/naming/resources/FileDirContext.java
===================================================================
--- apache-tomcat-6.0.18-src/java/org/apache/naming/resources/FileDirContext.java.orig 2008-07-22 02:01:28.000000000 +0200
+++ apache-tomcat-6.0.18-src/java/org/apache/naming/resources/FileDirContext.java 2009-06-10 13:41:00.352345626 +0200
@@ -37,6 +37,7 @@
import javax.naming.directory.ModificationItem;
import javax.naming.directory.SearchControls;
+import org.apache.catalina.util.RequestUtil;
import org.apache.naming.NamingContextBindingsEnumeration;
import org.apache.naming.NamingContextEnumeration;
import org.apache.naming.NamingEntry;
@@ -765,50 +766,10 @@
*/
protected String normalize(String path) {
- String normalized = path;
+ return RequestUtil.normalize(path, File.separatorChar == '\\');
- // Normalize the slashes and add leading slash if necessary
- if (File.separatorChar == '\\' && normalized.indexOf('\\') >= 0)
- normalized = normalized.replace('\\', '/');
- if (!normalized.startsWith("/"))
- normalized = "/" + normalized;
-
- // Resolve occurrences of "//" in the normalized path
- while (true) {
- int index = normalized.indexOf("//");
- if (index < 0)
- break;
- normalized = normalized.substring(0, index) +
- normalized.substring(index + 1);
- }
-
- // Resolve occurrences of "/./" in the normalized path
- while (true) {
- int index = normalized.indexOf("/./");
- if (index < 0)
- break;
- normalized = normalized.substring(0, index) +
- normalized.substring(index + 2);
- }
-
- // Resolve occurrences of "/../" in the normalized path
- while (true) {
- int index = normalized.indexOf("/../");
- if (index < 0)
- break;
- if (index == 0)
- return (null); // Trying to go outside our context
- int index2 = normalized.lastIndexOf('/', index - 1);
- normalized = normalized.substring(0, index2) +
- normalized.substring(index + 3);
}
- // Return the normalized path that we have completed
- return (normalized);
-
- }
-
-
/**
* Return a File object representing the specified normalized
* context-relative path if it exists and is readable. Otherwise,
Index: apache-tomcat-6.0.18-src/java/org/apache/catalina/core/ApplicationHttpRequest.java
===================================================================
--- apache-tomcat-6.0.18-src/java/org/apache/catalina/core/ApplicationHttpRequest.java.orig 2008-07-22 02:01:29.000000000 +0200
+++ apache-tomcat-6.0.18-src/java/org/apache/catalina/core/ApplicationHttpRequest.java 2009-06-10 13:41:00.352345626 +0200
@@ -318,10 +318,9 @@
int pos = requestPath.lastIndexOf('/');
String relative = null;
if (pos >= 0) {
- relative = RequestUtil.normalize
- (requestPath.substring(0, pos + 1) + path);
+ relative = requestPath.substring(0, pos + 1) + path;
} else {
- relative = RequestUtil.normalize(requestPath + path);
+ relative = requestPath + path;
}
return (context.getServletContext().getRequestDispatcher(relative));
Index: apache-tomcat-6.0.18-src/java/org/apache/catalina/core/ApplicationContext.java
===================================================================
--- apache-tomcat-6.0.18-src/java/org/apache/catalina/core/ApplicationContext.java.orig 2008-07-22 02:01:28.000000000 +0200
+++ apache-tomcat-6.0.18-src/java/org/apache/catalina/core/ApplicationContext.java 2009-06-10 13:42:19.940343545 +0200
@@ -44,6 +44,7 @@
import org.apache.catalina.Wrapper;
import org.apache.catalina.deploy.ApplicationParameter;
import org.apache.catalina.util.Enumerator;
+import org.apache.catalina.util.RequestUtil;
import org.apache.catalina.util.ResourceSet;
import org.apache.catalina.util.ServerInfo;
import org.apache.catalina.util.StringManager;
@@ -378,7 +379,7 @@
path = path.substring(0, pos);
}
- path = normalize(path);
+ path = RequestUtil.normalize(path);
if (path == null)
return (null);
@@ -463,7 +464,7 @@
throw new MalformedURLException(sm.getString("applicationContext.requestDispatcher.iae", path));
- path = normalize(path);
+ path = RequestUtil.normalize(path);
if (path == null)
return (null);
@@ -512,7 +513,7 @@
*/
public InputStream getResourceAsStream(String path) {
- path = normalize(path);
+ path = RequestUtil.normalize(path);
if (path == null)
return (null);
@@ -551,7 +552,7 @@
(sm.getString("applicationContext.resourcePaths.iae", path));
}
- path = normalize(path);
+ path = RequestUtil.normalize(path);
if (path == null)
return (null);
@@ -858,45 +859,6 @@
/**
- * Return a context-relative path, beginning with a "/", that represents
- * the canonical version of the specified path after ".." and "." elements
- * are resolved out. If the specified path attempts to go outside the
- * boundaries of the current context (i.e. too many ".." path elements
- * are present), return <code>null</code> instead.
- *
- * @param path Path to be normalized
- */
- private String normalize(String path) {
-
- if (path == null) {
- return null;
- }
-
- String normalized = path;
-
- // Normalize the slashes
- if (normalized.indexOf('\\') >= 0)
- normalized = normalized.replace('\\', '/');
-
- // Resolve occurrences of "/../" in the normalized path
- while (true) {
- int index = normalized.indexOf("/../");
- if (index < 0)
- break;
- if (index == 0)
- return (null); // Trying to go outside our context
- int index2 = normalized.lastIndexOf('/', index - 1);
- normalized = normalized.substring(0, index2) +
- normalized.substring(index + 3);
- }
-
- // Return the normalized path that we have completed
- return (normalized);
-
- }
-
-
- /**
* Merge the context initialization parameters specified in the application
* deployment descriptor with the application parameters described in the
* server configuration, respecting the <code>override</code> property of
Index: apache-tomcat-6.0.18-src/java/org/apache/catalina/servlets/WebdavServlet.java
===================================================================
--- apache-tomcat-6.0.18-src/java/org/apache/catalina/servlets/WebdavServlet.java.orig 2008-07-22 02:01:28.000000000 +0200
+++ apache-tomcat-6.0.18-src/java/org/apache/catalina/servlets/WebdavServlet.java 2009-06-10 13:41:00.392844309 +0200
@@ -1413,71 +1413,6 @@
}
- /**
- * Return a context-relative path, beginning with a "/", that represents
- * the canonical version of the specified path after ".." and "." elements
- * are resolved out. If the specified path attempts to go outside the
- * boundaries of the current context (i.e. too many ".." path elements
- * are present), return <code>null</code> instead.
- *
- * @param path Path to be normalized
- */
- protected String normalize(String path) {
-
- if (path == null)
- return null;
-
- // Create a place for the normalized path
- String normalized = path;
-
- if (normalized == null)
- return (null);
-
- if (normalized.equals("/."))
- return "/";
-
- // Normalize the slashes and add leading slash if necessary
- if (normalized.indexOf('\\') >= 0)
- normalized = normalized.replace('\\', '/');
- if (!normalized.startsWith("/"))
- normalized = "/" + normalized;
-
- // Resolve occurrences of "//" in the normalized path
- while (true) {
- int index = normalized.indexOf("//");
- if (index < 0)
- break;
- normalized = normalized.substring(0, index) +
- normalized.substring(index + 1);
- }
-
- // Resolve occurrences of "/./" in the normalized path
- while (true) {
- int index = normalized.indexOf("/./");
- if (index < 0)
- break;
- normalized = normalized.substring(0, index) +
- normalized.substring(index + 2);
- }
-
- // Resolve occurrences of "/../" in the normalized path
- while (true) {
- int index = normalized.indexOf("/../");
- if (index < 0)
- break;
- if (index == 0)
- return (null); // Trying to go outside our context
- int index2 = normalized.lastIndexOf('/', index - 1);
- normalized = normalized.substring(0, index2) +
- normalized.substring(index + 3);
- }
-
- // Return the normalized path that we have completed
- return (normalized);
-
- }
-
-
// -------------------------------------------------------- Private Methods
/**
@@ -1632,7 +1567,7 @@
}
// Normalise destination path (remove '.' and '..')
- destinationPath = normalize(destinationPath);
+ destinationPath = RequestUtil.normalize(destinationPath);
String contextPath = req.getContextPath();
if ((contextPath != null) &&
@@ -2384,7 +2319,8 @@
if (!toAppend.startsWith("/"))
toAppend = "/" + toAppend;
- generatedXML.writeText(rewriteUrl(normalize(absoluteUri + toAppend)));
+ generatedXML.writeText(rewriteUrl(RequestUtil.normalize(
+ absoluteUri + toAppend)));
generatedXML.writeElement(null, "href", XMLWriter.CLOSING);
Index: apache-tomcat-6.0.18-src/java/org/apache/catalina/connector/Request.java
===================================================================
--- apache-tomcat-6.0.18-src/java/org/apache/catalina/connector/Request.java.orig 2008-07-22 02:01:29.000000000 +0200
+++ apache-tomcat-6.0.18-src/java/org/apache/catalina/connector/Request.java 2009-06-10 13:41:00.425083160 +0200
@@ -1278,10 +1278,9 @@
int pos = requestPath.lastIndexOf('/');
String relative = null;
if (pos >= 0) {
- relative = RequestUtil.normalize
- (requestPath.substring(0, pos + 1) + path);
+ relative = requestPath.substring(0, pos + 1) + path;
} else {
- relative = RequestUtil.normalize(requestPath + path);
+ relative = requestPath + path;
}
return (context.getServletContext().getRequestDispatcher(relative));
Index: apache-tomcat-6.0.18-src/java/org/apache/catalina/ssi/SSIServletRequestUtil.java
===================================================================
--- apache-tomcat-6.0.18-src/java/org/apache/catalina/ssi/SSIServletRequestUtil.java.orig 2008-07-22 02:01:56.000000000 +0200
+++ apache-tomcat-6.0.18-src/java/org/apache/catalina/ssi/SSIServletRequestUtil.java 2009-06-10 13:41:00.425083160 +0200
@@ -47,7 +47,7 @@
if ((result == null) || (result.equals(""))) {
result = "/";
}
- return normalize(result);
+ return RequestUtil.normalize(result);
}
@@ -63,15 +63,9 @@
*
* @param path
* Path to be normalized
+ * @deprecated
*/
public static String normalize(String path) {
- if (path == null) return null;
- String normalized = path;
- //Why doesn't RequestUtil do this??
- // Normalize the slashes and add leading slash if necessary
- if (normalized.indexOf('\\') >= 0)
- normalized = normalized.replace('\\', '/');
- normalized = RequestUtil.normalize(path);
- return normalized;
+ return RequestUtil.normalize(path);
}
}
Index: apache-tomcat-6.0.18-src/java/org/apache/catalina/ssi/SSIServletExternalResolver.java
===================================================================
--- apache-tomcat-6.0.18-src/java/org/apache/catalina/ssi/SSIServletExternalResolver.java.orig 2008-07-22 02:01:56.000000000 +0200
+++ apache-tomcat-6.0.18-src/java/org/apache/catalina/ssi/SSIServletExternalResolver.java 2009-06-10 13:41:00.484471222 +0200
@@ -31,6 +31,7 @@
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.catalina.connector.Request;
+import org.apache.catalina.util.RequestUtil;
import org.apache.coyote.Constants;
/**
@@ -372,7 +373,7 @@
+ pathWithoutContext);
}
String fullPath = prefix + path;
- String retVal = SSIServletRequestUtil.normalize(fullPath);
+ String retVal = RequestUtil.normalize(fullPath);
if (retVal == null) {
throw new IOException("Normalization yielded null on path: "
+ fullPath);
@@ -405,7 +406,7 @@
return new ServletContextAndPath(context,
getAbsolutePath(virtualPath));
} else {
- String normalized = SSIServletRequestUtil.normalize(virtualPath);
+ String normalized = RequestUtil.normalize(virtualPath);
if (isVirtualWebappRelative) {
return new ServletContextAndPath(context, normalized);
} else {
Index: apache-tomcat-6.0.18-src/java/org/apache/catalina/util/RequestUtil.java
===================================================================
--- apache-tomcat-6.0.18-src/java/org/apache/catalina/util/RequestUtil.java.orig 2008-07-22 02:01:29.000000000 +0200
+++ apache-tomcat-6.0.18-src/java/org/apache/catalina/util/RequestUtil.java 2009-06-10 13:41:00.584537362 +0200
@@ -93,6 +93,19 @@
* @param path Relative path to be normalized
*/
public static String normalize(String path) {
+ return normalize(path, true);
+ }
+
+ /**
+ * Normalize a relative URI path that may have relative values ("/./",
+ * "/../", and so on ) it it. <strong>WARNING</strong> - This method is
+ * useful only for normalizing application-generated paths. It does not
+ * try to perform security checks for malicious input.
+ *
+ * @param path Relative path to be normalized
+ * @param replaceBackSlash Should '\\' be replaced with '/'
+ */
+ public static String normalize(String path, boolean replaceBackSlash) {
if (path == null)
return null;
@@ -100,6 +113,9 @@
// Create a place for the normalized path
String normalized = path;
+ if (replaceBackSlash && normalized.indexOf('\\') >= 0)
+ normalized = normalized.replace('\\', '/');
+
if (normalized.equals("/."))
return "/";
