File tomcat-9.0-hardening_getResources.patch of Package tomcat

Overview Repositories Revisions Requests Users Attributes Meta

File tomcat-9.0-hardening_getResources.patch of Package tomcat (Revision 7f4e060ef4e94078b559c27df59d813e)

Currently displaying revision 7f4e060ef4e94078b559c27df59d813e , Show latest

From 8a904f6065080409a1e00606cd7bceec6ad8918c Mon Sep 17 00:00:00 2001
From: Mark Thomas <markt@apache.org>
Date: Wed, 30 Mar 2022 20:22:49 +0100
Subject: [PATCH] Security hardening. Deprecate getResources() and always
 return null.

This method is never used by Tomcat. If something accidently exposes the
class loader then this method can be used to gain access to Tomcat
internals.
---
 .../apache/catalina/loader/WebappClassLoaderBase.java  |  7 ++++++-
 webapps/docs/changelog.xml                             | 10 ++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)
Index: apache-tomcat-9.0.48-src/java/org/apache/catalina/loader/WebappClassLoaderBase.java
===================================================================
--- apache-tomcat-9.0.48-src.orig/java/org/apache/catalina/loader/WebappClassLoaderBase.java
+++ apache-tomcat-9.0.48-src/java/org/apache/catalina/loader/WebappClassLoaderBase.java
@@ -425,10 +425,15 @@ public abstract class WebappClassLoaderB
     // ------------------------------------------------------------- Properties
 
     /**
+     * Unused. Always returns {@code null}.
+     *
      * @return associated resources.
+     *
+     * @deprecated This will be removed in Tomcat 10.1.x onwards
      */
+    @Deprecated
     public WebResourceRoot getResources() {
-        return this.resources;
+        return null;
     }
 
 
Index: apache-tomcat-9.0.48-src/webapps/docs/changelog.xml
===================================================================
--- apache-tomcat-9.0.48-src.orig/webapps/docs/changelog.xml
+++ apache-tomcat-9.0.48-src/webapps/docs/changelog.xml
@@ -680,6 +680,12 @@
 <section name="Tomcat 9.0.43 (markt)" rtext="2021-02-02">
   <subsection name="Catalina">
     <changelog>
+      <add>
+         Effectively disable the
+         <code>WebappClassLoaderBase.getResources()</code> method as it is not
+         used and if something accidently exposes the class loader this method
+         can be used to gain access to Tomcat internals. (markt)
+      </add>
       <fix>
         <bug>65106</bug>: Fix the ConfigFileLoader handling of file URIs when
         running under a security manager on some JREs. (markt)

Places

File tomcat-9.0-hardening_getResources.patch of Package tomcat (Revision 7f4e060ef4e94078b559c27df59d813e)

Places