From d9d20670fb59def6b4a4c361f4e3824d5e89d70f Mon Sep 17 00:00:00 2001 From: Jesse McConnell Date: Fri, 17 Jun 2016 18:56:41 -0500 Subject: [PATCH 1/3] Resolve Issue #649 by checking for null password on a binding ldap authentication --- .../org/eclipse/jetty/jaas/spi/LdapLoginModule.java | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/jetty-jaas/src/main/java/org/eclipse/jetty/jaas/spi/LdapLoginModule.java b/jetty-jaas/src/main/java/org/eclipse/jetty/jaas/spi/LdapLoginModule.java index f18f8fbf9d5..9fe1ff6b619 100644 --- a/jetty-jaas/src/main/java/org/eclipse/jetty/jaas/spi/LdapLoginModule.java +++ b/jetty-jaas/src/main/java/org/eclipse/jetty/jaas/spi/LdapLoginModule.java @@ -480,7 +480,17 @@ public class LdapLoginModule extends AbstractLoginModule LOG.info("Attempting authentication: " + userDn); Hashtable environment = getEnvironment(); + + if ( userDn == null || "".equals(userDn) ) + { + throw new NamingException("username may not be empty"); + } environment.put(Context.SECURITY_PRINCIPAL, userDn); + // RFC 4513 section 6.3.1, protect against ldap server implementations that allow successful binding on empty passwords + if ( password == null || "".equals(password)) + { + throw new NamingException("password may not be empty"); + } environment.put(Context.SECURITY_CREDENTIALS, password); DirContext dirContext = new InitialDirContext(environment); From 76a362d9ad1cdf9a8688e39c04aeeae06e2b81d9 Mon Sep 17 00:00:00 2001 From: Simone Bordet Date: Thu, 21 Jul 2016 16:39:43 +0200 Subject: [PATCH 2/3] Code cleanups. --- .../java/org/eclipse/jetty/servlets/CGI.java | 93 +++++++++---------- 1 file changed, 44 insertions(+), 49 deletions(-) diff --git a/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/CGI.java b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/CGI.java index e2fa409c9c3..05cb6428cbc 100644 --- a/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/CGI.java +++ b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/CGI.java @@ -44,11 +44,9 @@ import org.eclipse.jetty.util.UrlEncoded; import org.eclipse.jetty.util.log.Log; import org.eclipse.jetty.util.log.Logger; -//----------------------------------------------------------------------------- /** * CGI Servlet. *

- * * The following init parameters are used to configure this servlet: *

*
cgibinResourceBase
@@ -69,7 +67,6 @@ import org.eclipse.jetty.util.log.Logger; *
ignoreExitState
*
If true then do not act on a non-zero exec exit status")
*
- * */ public class CGI extends HttpServlet { @@ -87,7 +84,6 @@ public class CGI extends HttpServlet private boolean _ignoreExitState; private boolean _relative; - /* ------------------------------------------------------------ */ @Override public void init() throws ServletException { @@ -144,13 +140,13 @@ public class CGI extends HttpServlet } catch (IOException e) { - LOG.warn("CGI: CGI bin failed - " + dir,e); + LOG.warn("CGI: CGI bin failed - " + dir, e); return; } _path = getInitParameter("Path"); if (_path != null) - _env.set("PATH",_path); + _env.set("PATH", _path); _ignoreExitState = "true".equalsIgnoreCase(getInitParameter("ignoreExitState")); Enumeration e = getInitParameterNames(); @@ -158,21 +154,20 @@ public class CGI extends HttpServlet { String n = e.nextElement(); if (n != null && n.startsWith("ENV_")) - _env.set(n.substring(4),getInitParameter(n)); + _env.set(n.substring(4), getInitParameter(n)); } if (!_env.envMap.containsKey("SystemRoot")) { String os = System.getProperty("os.name"); - if (os != null && os.toLowerCase(Locale.ENGLISH).indexOf("windows") != -1) + if (os != null && os.toLowerCase(Locale.ENGLISH).contains("windows")) { - _env.set("SystemRoot","C:\\WINDOWS"); + _env.set("SystemRoot", "C:\\WINDOWS"); } } _ok = true; } - /* ------------------------------------------------------------ */ @Override public void service(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException { @@ -199,7 +194,7 @@ public class CGI extends HttpServlet File execCmd = new File(_docRoot, pathInContext); String pathInfo = pathInContext; - if(!_useFullPath) + if (!_useFullPath) { String path = pathInContext; String info = ""; @@ -208,30 +203,31 @@ public class CGI extends HttpServlet while ((path.endsWith("/") || !execCmd.exists()) && path.length() >= 0) { int index = path.lastIndexOf('/'); - path = path.substring(0,index); - info = pathInContext.substring(index,pathInContext.length()); - execCmd = new File(_docRoot,path); + path = path.substring(0, index); + info = pathInContext.substring(index, pathInContext.length()); + execCmd = new File(_docRoot, path); } - + if (path.length() == 0 || !execCmd.exists() || execCmd.isDirectory() || !execCmd.getCanonicalPath().equals(execCmd.getAbsolutePath())) { res.sendError(404); } - + pathInfo = info; } - exec(execCmd,pathInfo,req,res); + exec(execCmd, pathInfo, req, res); } - /** executes the CGI process - /* - * @param command the command to execute, this command is prefixed by - * the context parameter "commandPrefix". + /** + * executes the CGI process + * + * @param command the command to execute, this command is prefixed by + * the context parameter "commandPrefix". * @param pathInfo The PATH_INFO to process, - * see http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#getPathInfo%28%29. Cannot be null - * @param req - * @param res - * @exception IOException + * see http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#getPathInfo%28%29. Cannot be null + * @param req the HTTP request + * @param res the HTTP response + * @throws IOException if the execution of the CGI process throws */ private void exec(File command, String pathInfo, HttpServletRequest req, HttpServletResponse res) throws IOException { @@ -247,9 +243,9 @@ public class CGI extends HttpServlet } String bodyFormEncoded = null; - if ((HttpMethod.POST.equals(req.getMethod()) || HttpMethod.PUT.equals(req.getMethod())) && "application/x-www-form-urlencoded".equals(req.getContentType())) + if ((HttpMethod.POST.is(req.getMethod()) || HttpMethod.PUT.is(req.getMethod())) && "application/x-www-form-urlencoded".equals(req.getContentType())) { - MultiMap parameterMap = new MultiMap(); + MultiMap parameterMap = new MultiMap<>(); Enumeration names = req.getParameterNames(); while (names.hasMoreElements()) { @@ -302,15 +298,15 @@ public class CGI extends HttpServlet String scriptPath; String scriptName; // use docRoot for scriptPath, too - if(_cgiBinProvided) + if (_cgiBinProvided) { scriptPath = command.getAbsolutePath(); scriptName = scriptPath.substring(_docRoot.getAbsolutePath().length()); - } - else + } + else { String requestURI = req.getRequestURI(); - scriptName = requestURI.substring(0,requestURI.length() - pathInfo.length()); + scriptName = requestURI.substring(0, requestURI.length() - pathInfo.length()); scriptPath = getServletContext().getRealPath(scriptName); } env.set("SCRIPT_FILENAME", scriptPath); @@ -326,11 +322,11 @@ public class CGI extends HttpServlet { String name = enm.nextElement(); String value = req.getHeader(name); - env.set("HTTP_" + name.toUpperCase(Locale.ENGLISH).replace('-','_'),value); + env.set("HTTP_" + name.toUpperCase(Locale.ENGLISH).replace('-', '_'), value); } // these extra ones were from printenv on www.dev.nomura.co.uk - env.set("HTTPS", (req.isSecure()?"ON":"OFF")); + env.set("HTTPS", (req.isSecure() ? "ON" : "OFF")); // "DOCUMENT_ROOT" => root + "/docs", // "SERVER_URL" => "NYI - http://us0245", // "TZ" => System.getProperty("user.timezone"), @@ -342,13 +338,12 @@ public class CGI extends HttpServlet String execCmd = absolutePath; // escape the execCommand - if (execCmd.length() > 0 && execCmd.charAt(0) != '"' && execCmd.indexOf(" ") >= 0) + if (execCmd.length() > 0 && execCmd.charAt(0) != '"' && execCmd.contains(" ")) execCmd = "\"" + execCmd + "\""; if (_cmdPrefix != null) execCmd = _cmdPrefix + " " + execCmd; - assert execCmd != null; LOG.debug("Environment: " + env.getExportString()); LOG.debug("Command: " + execCmd); @@ -363,7 +358,7 @@ public class CGI extends HttpServlet // hook processes output to browser's input (sync) // if browser closes stream, we should detect it and kill process... OutputStream os = null; - AsyncContext async=req.startAsync(); + AsyncContext async = req.startAsync(); try { async.start(new Runnable() @@ -396,7 +391,7 @@ public class CGI extends HttpServlet int k = line.indexOf(':'); if (k > 0) { - String key = line.substring(0,k).trim(); + String key = line.substring(0, k).trim(); String value = line.substring(k + 1).trim(); if ("Location".equals(key)) { @@ -411,14 +406,14 @@ public class CGI extends HttpServlet else { // add remaining header items to our response header - res.addHeader(key,value); + res.addHeader(key, value); } } } } // copy cgi content to response stream... os = res.getOutputStream(); - IO.copy(inFromCgi,os); + IO.copy(inFromCgi, os); p.waitFor(); if (!_ignoreExitState) @@ -428,7 +423,7 @@ public class CGI extends HttpServlet { LOG.warn("Non-zero exit status (" + exitValue + ") from CGI program: " + absolutePath); if (!res.isCommitted()) - res.sendError(500,"Failed to exec CGI"); + res.sendError(500, "Failed to exec CGI"); } } } @@ -509,10 +504,9 @@ public class CGI extends HttpServlet /** * Utility method to get a line of text from the input stream. * - * @param is - * the input stream + * @param is the input stream * @return the line of text - * @throws IOException + * @throws IOException if reading from the input stream throws */ private static String getTextLineFromStream(InputStream is) throws IOException { @@ -526,7 +520,6 @@ public class CGI extends HttpServlet return buffer.toString().trim(); } - /* ------------------------------------------------------------ */ /** * private utility class that manages the Environment passed to exec. */ @@ -536,12 +529,12 @@ public class CGI extends HttpServlet EnvList() { - envMap = new HashMap(); + envMap = new HashMap<>(); } EnvList(EnvList l) { - envMap = new HashMap(l.envMap); + envMap = new HashMap<>(l.envMap); } /** @@ -549,10 +542,12 @@ public class CGI extends HttpServlet */ public void set(String name, String value) { - envMap.put(name,name + "=" + StringUtil.nonNull(value)); + envMap.put(name, name + "=" + StringUtil.nonNull(value)); } - /** Get representation suitable for passing to exec. */ + /** + * Get representation suitable for passing to exec. + */ public String[] getEnvArray() { return envMap.values().toArray(new String[envMap.size()]); @@ -576,4 +571,4 @@ public class CGI extends HttpServlet return envMap.toString(); } } -} \ No newline at end of file +} From ccff4b834627dcb05dfaffd0f3ac1bd37bf85ce6 Mon Sep 17 00:00:00 2001 From: Simone Bordet Date: Thu, 21 Jul 2016 16:48:49 +0200 Subject: [PATCH 3/3] Fixes #756 - Filter out headers. --- .../eclipse/jetty/fcgi/server/proxy/FastCGIProxyServlet.java | 3 +++ .../src/main/java/org/eclipse/jetty/servlets/CGI.java | 2 ++ 2 files changed, 5 insertions(+) diff --git a/jetty-fcgi/fcgi-server/src/main/java/org/eclipse/jetty/fcgi/server/proxy/FastCGIProxyServlet.java b/jetty-fcgi/fcgi-server/src/main/java/org/eclipse/jetty/fcgi/server/proxy/FastCGIProxyServlet.java index 38e176624f2..03ab0b89a25 100644 --- a/jetty-fcgi/fcgi-server/src/main/java/org/eclipse/jetty/fcgi/server/proxy/FastCGIProxyServlet.java +++ b/jetty-fcgi/fcgi-server/src/main/java/org/eclipse/jetty/fcgi/server/proxy/FastCGIProxyServlet.java @@ -21,6 +21,7 @@ package org.eclipse.jetty.fcgi.server.proxy; import java.net.URI; import java.util.regex.Matcher; import java.util.regex.Pattern; + import javax.servlet.RequestDispatcher; import javax.servlet.ServletConfig; import javax.servlet.ServletException; @@ -132,6 +133,8 @@ public class FastCGIProxyServlet extends AsyncProxyServlet.Transparent protected void customizeFastCGIHeaders(Request proxyRequest, HttpFields fastCGIHeaders) { + fastCGIHeaders.remove("HTTP_PROXY"); + fastCGIHeaders.put(FCGI.Headers.REMOTE_ADDR, (String)proxyRequest.getAttributes().get(REMOTE_ADDR_ATTRIBUTE)); fastCGIHeaders.put(FCGI.Headers.REMOTE_PORT, (String)proxyRequest.getAttributes().get(REMOTE_PORT_ATTRIBUTE)); fastCGIHeaders.put(FCGI.Headers.SERVER_NAME, (String)proxyRequest.getAttributes().get(SERVER_NAME_ATTRIBUTE)); diff --git a/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/CGI.java b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/CGI.java index 05cb6428cbc..6206423ee1b 100644 --- a/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/CGI.java +++ b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/CGI.java @@ -321,6 +321,8 @@ public class CGI extends HttpServlet while (enm.hasMoreElements()) { String name = enm.nextElement(); + if (name.equalsIgnoreCase("Proxy")) + continue; String value = req.getHeader(name); env.set("HTTP_" + name.toUpperCase(Locale.ENGLISH).replace('-', '_'), value); }