Eclipse
/
jetty.project
mirror of https://github.com/jetty/jetty.project.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

413684 deprecated unsafe alias checkers

This commit is contained in:
Greg Wilkins 2013-08-23 16:49:42 +10:00
parent 624a0d7e45
commit a731ec13c8
4 changed files with 53 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
example-jetty-embedded/src/main/java/org/eclipse/jetty/embedded/DumpServlet.java
View File

@ -43,6 +43,11 @@ public class DumpServlet extends HttpServlet
response.getWriter().println("servletPath=" + request.getServletPath());
response.getWriter().println("pathInfo=" + request.getPathInfo());
response.getWriter().println("session=" + request.getSession(true).getId());
String r=request.getParameter("resource");
if (r!=null)
response.getWriter().println("resource("+r+")=" + getServletContext().getResource(r));
response.getWriter().println("</pre>");
}
}

49
jetty-server/src/main/java/org/eclipse/jetty/server/handler/ContextHandler.java
View File

@ -1537,23 +1537,46 @@ public class ContextHandler extends ScopedHandler implements Attributes, Server.
path = URIUtil.canonicalPath(path);
Resource resource = _baseResource.addPath(path);
System.err.println();
System.err.println("resource="+resource);
try
{
System.err.println("path="+path);
System.err.println("resource="+resource);
System.err.println("resource.getURI()="+resource.getURI());
System.err.println("resource.getURL()="+resource.getURL());
System.err.println("resource.getAlias()="+resource.getAlias());
System.err.println("resource.getFile() ="+resource.getFile());
System.err.println("resource.getFile().getCanonicalPath()="+resource.getFile().getCanonicalPath());
System.err.println("resource.getFile().getAbsolutePath() ="+resource.getFile().getAbsolutePath());
System.err.println("resource.exists() ="+resource.exists());
}
catch(Exception e)
{
e.printStackTrace();
}
// Is the resource aliased?
if (!_aliases && resource.getAlias() != null)
{
if (LOG.isDebugEnabled())
LOG.debug("Aliased resource: " + resource + "~=" + resource.getAlias());
System.err.println("ALIAS="+resource.getAlias());
// alias checks
for (Iterator<AliasCheck> i=_aliasChecks.iterator();i.hasNext();)
{
AliasCheck check = i.next();
System.err.println("check="+check);
if (check.check(path,resource))
{
System.err.println("OK???");
if (LOG.isDebugEnabled())
LOG.debug("Aliased resource: " + resource + " approved by " + check);
return resource;
}
}
System.err.println("NULL ALIAS");
return null;
}
@ -2159,7 +2182,6 @@ public class ContextHandler extends ScopedHandler implements Attributes, Server.
}
}
}
}
@ -2183,8 +2205,13 @@ public class ContextHandler extends ScopedHandler implements Attributes, Server.
* Eg. a symbolic link from /foobar.html to /somewhere/wibble.html would be
* approved because both the resource and alias end with ".html".
*/
@Deprecated
public static class ApproveSameSuffixAliases implements AliasCheck
{
{
LOG.warn("ApproveSameSuffixAlias is not safe for production");
}
public boolean check(String path, Resource resource)
{
int dot = path.lastIndexOf('.');
@ -2201,8 +2228,13 @@ public class ContextHandler extends ScopedHandler implements Attributes, Server.
* Eg. a symbolic link from /dirA/foobar.html to /dirB/foobar.html would be
* approved because both the resource and alias end with "/foobar.html".
*/
@Deprecated
public static class ApprovePathPrefixAliases implements AliasCheck
{
{
LOG.warn("ApprovePathPrefixAliases is not safe for production");
}
public boolean check(String path, Resource resource)
{
int slash = path.lastIndexOf('/');
@ -2212,6 +2244,7 @@ public class ContextHandler extends ScopedHandler implements Attributes, Server.
return resource.toString().endsWith(suffix);
}
}
/* ------------------------------------------------------------ */
/** Approve Aliases of a non existent directory.
* If a directory "/foobar/" does not exist, then the resource is
@ -2221,11 +2254,17 @@ public class ContextHandler extends ScopedHandler implements Attributes, Server.
{
public boolean check(String path, Resource resource)
{
int slash = path.lastIndexOf('/');
if (slash<0 || resource.exists())
if (resource.exists())
return false;
String suffix=path.substring(slash);
return resource.getAlias().toString().endsWith(suffix);
String a=resource.getAlias().toString();
String r=resource.getURL().toString();
if (a.length()>r.length())
return a.startsWith(r) && a.length()==r.length()+1 && a.endsWith("/");
else
return r.startsWith(a) && r.length()==a.length()+1 && r.endsWith("/");
}
}
}

8
jetty-util/src/main/java/org/eclipse/jetty/util/resource/FileResource.java
View File

@ -44,7 +44,6 @@ import org.eclipse.jetty.util.log.Logger;
* This class can check for aliasing in the filesystem (eg case
* insensitivity). By default this is turned on, or it can be controlled
* by calling the static method @see FileResource#setCheckAliases(boolean)
*
*
*/
public class FileResource extends URLResource
@ -167,15 +166,16 @@ public class FileResource extends URLResource
r=(URLResource)Resource.newResource(url);
}
// Check for encoding aliases
// The encoded path should be a suffix of the resource (give or take a directory / )
String encoded=URIUtil.encodePath(path);
int expected=r.toString().length()-encoded.length();
int index = r._urlString.lastIndexOf(encoded, expected);
if (expected!=index && ((expected-1)!=index || path.endsWith("/") || !r.isDirectory()))
{
if (!(r instanceof BadResource))
if (r instanceof FileResource)
{
((FileResource)r)._alias=new URL(url);
((FileResource)r)._alias=((FileResource)r)._file.getCanonicalFile().toURI().toURL();
((FileResource)r)._aliasChecked=true;
}
}

13
test-jetty-webapp/src/main/config/contexts/test.xml
View File

@ -28,19 +28,6 @@ detected.
<Set name="copyWebDir">false</Set>
<Set name="defaultsDescriptor"><SystemProperty name="jetty.home" default="."/>/etc/webdefault.xml</Set>
<Set name="overrideDescriptor"><SystemProperty name="jetty.home" default="."/>/contexts/test.d/override-web.xml</Set>
<!-- Allow directory symbolic links -->
<Call name="addAliasCheck">
<Arg>
<New class="org.eclipse.jetty.server.handler.ContextHandler$ApprovePathPrefixAliases"/>
</Arg>
</Call>
<!-- Allow file symbolic links -->
<Call name="addAliasCheck">
<Arg>
<New class="org.eclipse.jetty.server.handler.ContextHandler$ApproveSameSuffixAliases"/>
</Arg>
</Call>
<!-- virtual hosts
<Set name="virtualHosts">