Eclipse
/
jetty.project
mirror of https://github.com/jetty/jetty.project.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

413684 deprecated unsafe alias checkers

This commit is contained in:
Greg Wilkins 2013-08-23 16:49:42 +10:00
parent b4fab3fbc5
commit b33b5f2f5d
4 changed files with 53 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
example-jetty-embedded/src/main/java/org/eclipse/jetty/embedded/DumpServlet.java
View File

@ -43,6 +43,11 @@ public class DumpServlet extends HttpServlet
response.getWriter().println("servletPath=" + request.getServletPath());
response.getWriter().println("pathInfo=" + request.getPathInfo());
response.getWriter().println("session=" + request.getSession(true).getId());
String r=request.getParameter("resource");
if (r!=null)
response.getWriter().println("resource("+r+")=" + getServletContext().getResource(r));
response.getWriter().println("</pre>");
}
}

49
jetty-server/src/main/java/org/eclipse/jetty/server/handler/ContextHandler.java
View File

@ -1580,23 +1580,46 @@ public class ContextHandler extends ScopedHandler implements Attributes, Server.
path = URIUtil.canonicalPath(path);
Resource resource = _baseResource.addPath(path);
System.err.println();
System.err.println("resource="+resource);
try
{
System.err.println("path="+path);
System.err.println("resource="+resource);
System.err.println("resource.getURI()="+resource.getURI());
System.err.println("resource.getURL()="+resource.getURL());
System.err.println("resource.getAlias()="+resource.getAlias());
System.err.println("resource.getFile() ="+resource.getFile());
System.err.println("resource.getFile().getCanonicalPath()="+resource.getFile().getCanonicalPath());
System.err.println("resource.getFile().getAbsolutePath() ="+resource.getFile().getAbsolutePath());
System.err.println("resource.exists() ="+resource.exists());
}
catch(Exception e)
{
e.printStackTrace();
}
// Is the resource aliased?
if (!_aliases && resource.getAlias() != null)
{
if (LOG.isDebugEnabled())
LOG.debug("Aliased resource: " + resource + "~=" + resource.getAlias());
System.err.println("ALIAS="+resource.getAlias());
// alias checks
for (Iterator<AliasCheck> i=_aliasChecks.iterator();i.hasNext();)
{
AliasCheck check = i.next();
System.err.println("check="+check);
if (check.check(path,resource))
{
System.err.println("OK???");
if (LOG.isDebugEnabled())
LOG.debug("Aliased resource: " + resource + " approved by " + check);
return resource;
}
}
System.err.println("NULL ALIAS");
return null;
}
@ -2474,7 +2497,6 @@ public class ContextHandler extends ScopedHandler implements Attributes, Server.
}
}
}
}
@ -2498,8 +2520,13 @@ public class ContextHandler extends ScopedHandler implements Attributes, Server.
* Eg. a symbolic link from /foobar.html to /somewhere/wibble.html would be
* approved because both the resource and alias end with ".html".
*/
@Deprecated
public static class ApproveSameSuffixAliases implements AliasCheck
{
{
LOG.warn("ApproveSameSuffixAlias is not safe for production");
}
public boolean check(String path, Resource resource)
{
int dot = path.lastIndexOf('.');
@ -2516,8 +2543,13 @@ public class ContextHandler extends ScopedHandler implements Attributes, Server.
* Eg. a symbolic link from /dirA/foobar.html to /dirB/foobar.html would be
* approved because both the resource and alias end with "/foobar.html".
*/
@Deprecated
public static class ApprovePathPrefixAliases implements AliasCheck
{
{
LOG.warn("ApprovePathPrefixAliases is not safe for production");
}
public boolean check(String path, Resource resource)
{
int slash = path.lastIndexOf('/');
@ -2527,6 +2559,7 @@ public class ContextHandler extends ScopedHandler implements Attributes, Server.
return resource.toString().endsWith(suffix);
}
}
/* ------------------------------------------------------------ */
/** Approve Aliases of a non existent directory.
* If a directory "/foobar/" does not exist, then the resource is
@ -2536,11 +2569,17 @@ public class ContextHandler extends ScopedHandler implements Attributes, Server.
{
public boolean check(String path, Resource resource)
{
int slash = path.lastIndexOf('/');
if (slash<0 || resource.exists())
if (resource.exists())
return false;
String suffix=path.substring(slash);
return resource.getAlias().toString().endsWith(suffix);
String a=resource.getAlias().toString();
String r=resource.getURL().toString();
if (a.length()>r.length())
return a.startsWith(r) && a.length()==r.length()+1 && a.endsWith("/");
else
return r.startsWith(a) && r.length()==a.length()+1 && r.endsWith("/");
}
}
}

8
jetty-util/src/main/java/org/eclipse/jetty/util/resource/FileResource.java
View File

@ -45,7 +45,6 @@ import org.eclipse.jetty.util.log.Logger;
* insensitivity). By default this is turned on, or it can be controlled
* by calling the static method @see FileResource#setCheckAliases(boolean)
*
*
*/
public class FileResource extends URLResource
{
@ -167,15 +166,16 @@ public class FileResource extends URLResource
r=(URLResource)Resource.newResource(url);
}
// Check for encoding aliases
// The encoded path should be a suffix of the resource (give or take a directory / )
String encoded=URIUtil.encodePath(path);
int expected=r.toString().length()-encoded.length();
int index = r._urlString.lastIndexOf(encoded, expected);
if (expected!=index && ((expected-1)!=index || path.endsWith("/") || !r.isDirectory()))
{
if (!(r instanceof BadResource))
if (r instanceof FileResource)
{
((FileResource)r)._alias=new URL(url);
((FileResource)r)._alias=((FileResource)r)._file.getCanonicalFile().toURI().toURL();
((FileResource)r)._aliasChecked=true;
}
}

13
test-jetty-webapp/src/main/config/contexts/test.xml
View File

@ -29,19 +29,6 @@ detected.
<Set name="defaultsDescriptor"><SystemProperty name="jetty.home" default="."/>/etc/webdefault.xml</Set>
<Set name="overrideDescriptor"><SystemProperty name="jetty.home" default="."/>/contexts/test.d/override-web.xml</Set>
<!-- Allow directory symbolic links -->
<Call name="addAliasCheck">
<Arg>
<New class="org.eclipse.jetty.server.handler.ContextHandler$ApprovePathPrefixAliases"/>
</Arg>
</Call>
<!-- Allow file symbolic links -->
<Call name="addAliasCheck">
<Arg>
<New class="org.eclipse.jetty.server.handler.ContextHandler$ApproveSameSuffixAliases"/>
</Arg>
</Call>
<!-- virtual hosts
<Set name="virtualHosts">
<Array type="String">