17243 Commits

Author SHA1 Message Date
Joakim Erdfelt
30bd3914cf Issue #4000 - SameFileAliasChecker to help with NFD/NFC
+ Adding SameFileAliasChecker to help with environments
  where the Alias and the Path point to the same file,
  by relying on the FileSystem and Path implementation
  to make the determination if the two Path references
  truly point to the same file.
+ Minor cleanup of FileSystemResourceTest
+ Additional DefaultServletTest for this UTF-8 differences

Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
2019-08-21 12:21:04 -05:00
Simone Bordet
32fe4e5ca8 Issue #3978 - HTTP/2 vulnerabilities.
Fixed load test that required `RateControl.NO_RATE_CONTROL`.

Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
2019-08-21 11:36:06 +02:00
Bruce
a1bb3b4491 fix formatting and change comment flags to attributes
Signed-off-by: Bruce MacDonald <brucewmacdonald@gmail.com>
2019-08-20 15:12:03 +10:00
Bruce
6ad148c8f9 parse samesite from cookie comment flag utility functions
Signed-off-by: Bruce MacDonald <brucewmacdonald@gmail.com>
2019-08-20 15:12:03 +10:00
Bruce
2e5f6fca4b parse SameSite specifier from cookie comment and move HttpOnly comment parsing to org.eclipse.jetty.http.HttpCookie
Signed-off-by: Bruce MacDonald <brucewmacdonald@gmail.com>
2019-08-20 15:12:03 +10:00
Bruce
7c691acbbe use null instead of EXCLUDED to indicate no SameSite attribute should be sent
Signed-off-by: Bruce MacDonald <brucewmacdonald@gmail.com>
2019-08-20 15:12:03 +10:00
Bruce
216f71469b Issue #3040 - Allow RFC6265 Cookies to include optional SameSite attribute
Signed-off-by: Bruce MacDonald <brucewmacdonald@gmail.com>
2019-08-20 15:12:03 +10:00
Lachlan
44986be6c0
fix flaky test ClientCloseTest.testStopLifecycle() in jetty 9.4.x (#3990)
* fix flaky test ClientCloseTest.testStopLifecycle() in 9.4.x

Signed-off-by: Lachlan Roberts <lachlan@webtide.com>

* test code cleanups in ClientCloseTest

Signed-off-by: Lachlan Roberts <lachlan@webtide.com>
2019-08-20 12:49:52 +10:00
Joakim Erdfelt
ef3f696a11 Issue #4000 - PathResource alias detection work around alt UTF-8 style
+ OSX File is `swedish-å.txt`
+ OSX has NFD form UTF-8 characters. `swedish-a%CC%8A.txt`
+ HTTP uses normal form UTF-8. `swedish-%C3%A5.txt`
+ A HTTP GET request should work against the resource
  being requested, regardless of UTF-8 style used.

Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
2019-08-19 13:52:22 -05:00
Joakim Erdfelt
407b564320 Issue #4000 - adding unit test for raw Resource access for unicode file.
Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
2019-08-19 12:52:43 -05:00
Simone Bordet
5184c4ec3d Issue #3978 - HTTP/2 vulnerabilities.
Small fixed after review.

Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
2019-08-19 11:38:01 +02:00
Olivier Lamy
95f7fddc59
ServletContext#setSessionTrackingModes must throw IAE if SSL and another mode (#3976)
* according to Javadoc and failing tck tests
ServletContext#setSessionTrackingModes
IllegalArgumentException - if sessionTrackingModes specifies a combination of SessionTrackingMode.SSL with a session tracking mode other than SessionTrackingMode.SSL

Signed-off-by: olivier lamy <oliver.lamy@gmail.com>

* test adding only SSL

Signed-off-by: olivier lamy <oliver.lamy@gmail.com>

* fixes from Jan review

Signed-off-by: olivier lamy <oliver.lamy@gmail.com>

* fix package order

Signed-off-by: olivier lamy <oliver.lamy@gmail.com>
2019-08-19 12:54:05 +10:00
Greg Wilkins
5fc83c3d0c Issue #3978 HTTP2 Vulnerabilities
Reduce the number of RateControl fields, instead using common field in
HeaderParser.

Avoid null checking rateControl by having a NO_RATE_CONTROL static

HPack does not emit field with empty header name.

Apply rate control to any header parsing issue resulting in
session/stream failure

Signed-off-by: Greg Wilkins <gregw@webtide.com>
2019-08-19 10:16:40 +10:00
Greg Wilkins
47fb8f4dea Issue #3978 HTTP2 Vulnerabilities
Fixed race in WindowRateControl by only removing the event that we
just inspected.

Added an AtomicInteger to track the size to avoid iterating over the
linked list.

Signed-off-by: Greg Wilkins <gregw@webtide.com>
2019-08-19 10:11:28 +10:00
Olivier Lamy
7c0266af4c
this is not supposed to return null (#3998)
see https://javaee.github.io/javaee-spec/javadocs/javax/servlet/http/Part.html#getHeaders-java.lang.String-
this fix related tck test

Signed-off-by: olivier lamy <oliver.lamy@gmail.com>
2019-08-19 10:08:21 +10:00
Greg Wilkins
764fcd63a1 Merge branch 'jetty-9.4.x' into jetty-9.4.x-3978-http2_vulnerabilities 2019-08-19 08:46:28 +10:00
Greg Wilkins
9fce1e8512
Merge pull request #3993 from barabadzhi/patch-1
Add WebAssembly MIME type support
2019-08-19 08:09:48 +10:00
Simone Bordet
cfe1baa048 Issue #3978 - HTTP/2 vulnerabilities.
Implemented rate control for HTTP/2 frames using a single RateControl
object to avoid that each individual vulnerability is within limits,
but combined they still overload the server.

Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
2019-08-17 22:51:39 +02:00
Bogdan Arabadzhi
f14abdd600 Add WebAssembly MIME type support
Signed-off-by: Bogdan Arabadzhi <bogdan.today@gmail.com>
2019-08-17 12:02:03 +02:00
Joakim Erdfelt
1254f6eb67 Issue #3985 - Fixing RequestTest
+ Moving overly bad cookie to CookieCutter_LenientTest
+ Changing expectation in RequestTest.testCookie()

Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
2019-08-16 15:57:26 -05:00
Joakim Erdfelt
472ede48cd Issue #3983 - JarFileResource directory listing is invalid
+ Correcting encoded path searching
+ Adding more unit tests to ensure no regression

Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
2019-08-16 15:48:42 -05:00
Joakim Erdfelt
f65e59cadf Issue #3983 - Modernizing JarResourceTest
Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
2019-08-16 15:13:53 -05:00
Joakim Erdfelt
fba010d33d Issue #3985 - Updates to CookieCutter to reject no-equal cookies
* If a cookie has no value it is rejected and not stored.
  - `name` is rejected
  - `name=` is accepted, with empty value

Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
2019-08-16 13:11:40 -05:00
Joakim Erdfelt
eaf2263053 Issue #3985 - Testcase for CookieCutter parsing issue of bad cookie
Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
2019-08-15 17:58:53 -05:00
Chris Walker
d6bd6e6e32
Updated security reports for HTTP/2 fix in #2722 2019-08-15 10:55:12 -04:00
Joakim Erdfelt
50b524bb6b Merge branch release-9.4.20 into jetty-9.4.x 2019-08-15 07:27:25 -05:00
Jan Bartel
af6c675023
Issue #3913 Fix races in session request reference counting (#3947)
* Issue #3913 Fix races in session request reference counting

Signed-off-by: Jan Bartel <janb@webtide.com>
2019-08-15 12:27:18 +10:00
Lachlan Roberts
7d7d932288 Issue #3968 - remove public from methods in ReadState
Signed-off-by: Lachlan Roberts <lachlan@webtide.com>
2019-08-15 09:16:05 +10:00
Lachlan Roberts
11d1ad6504 disable flaky test WebSocketConnectionStatsTest
Signed-off-by: Lachlan Roberts <lachlan@webtide.com>
2019-08-15 08:04:57 +10:00
Chris Walker
47759b3f9b
Updated security documentation with latest CVEs. Resolves #3980 2019-08-14 10:23:22 -04:00
Lachlan
2a109dccbc
Issue #3968 - prevent ReadPending and ISE from AbstractWebSocketConnection (#3979)
* Issue #3968 - websocket suspend fix and cleanups

Signed-off-by: Lachlan Roberts <lachlan@webtide.com>

* Issue #3968 - fixed race conditions when using websocket ReadState

combine the previous ReadMode into ReadState by using ReadState.Action
which is returned from ReadState.getAction(ByteBuffer) where an atomic
decision is made of what action to do

Signed-off-by: Lachlan Roberts <lachlan@webtide.com>
2019-08-14 21:28:35 +10:00
Olivier Lamy
8761b345b5
Jetty 9.4.x timeout to build only do not include time to get node (#3975)
* fix timeout to apply on build time not on getting node time

Signed-off-by: olivier lamy <oliver.lamy@gmail.com>

* fix typo

Signed-off-by: olivier lamy <oliver.lamy@gmail.com>
2019-08-14 20:30:54 +10:00
Joakim Erdfelt
f1efc99918 Updating to version 9.4.21-SNAPSHOT 2019-08-13 17:34:20 -05:00
Joakim Erdfelt
84700530e6 Updating to version 9.4.20.v20190813 jetty-9.4.20.v20190813 2019-08-13 16:13:21 -05:00
Joakim Erdfelt
cbe34d9bc2 Revert "Jetty 9.4.x release faster (no need of triggering plugins already triggered) (#3944)"
+ Breaks the release build.
  javadoc and source artifacts lack gpg signatures

This reverts commit 50aa1cf7864f14e572a3a9e5bf20b4232899db4e.
2019-08-13 16:05:35 -05:00
Joakim Erdfelt
982717cc77
Merge pull request #3972 from eclipse/jetty-9.4.x-3969-forwarded-headers-testing
Fixes #3969 - Fixing X-Forwarded-Port header setter
2019-08-13 16:01:32 -05:00
Joakim Erdfelt
fec01a4628 Fixes #3969 - Changing TYPE to class from PR review
Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
2019-08-13 16:00:18 -05:00
Joakim Erdfelt
3940baea9c Fixes #3969 - Adding comments from PR review
Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
2019-08-13 15:56:11 -05:00
Joakim Erdfelt
72c05bc8ba Fixes #3969 - Fixing X-Forwarded-Port header setter
+ Fixing ForwardedRequestCustomizer.getForwardedPortHeader()
+ Fixing ForwardedRequestCustomizer.setForwardedPortHeader(String)
+ Refactoring unit tests:
  + Tests default ForwardedRequestCustomizer behavior
    on one Connector
  + Tests header configured ForwardedRequestCustomizer behavior
    on different Connector

Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
2019-08-13 12:39:30 -05:00
Joakim Erdfelt
d10fea9b7e
Merge pull request #3970 from eclipse/jetty-9.4.x-3969-xforwarded-host
Issue #3969 - adding testcase to verify Host & X-Forwarded behavior
2019-08-13 09:16:08 -05:00
Joakim Erdfelt
e4b4a30c4c
Merge pull request #3961 from eclipse/jetty-9.4.x-3804-Decoration-Fixes
Fixed decoration changes for #3804
2019-08-13 09:15:31 -05:00
Joakim Erdfelt
4b17d28cb0 Issue #3969 - adding testcase to verify behavior
Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
2019-08-13 07:30:14 -05:00
olivier lamy
cfd01d6bbc remove non needed file
Signed-off-by: olivier lamy <oliver.lamy@gmail.com>
2019-08-13 16:36:24 +10:00
Lachlan
d3bc0b931a
Issue #3957 - fix bad usage of MethodHandles.lookup() (#3962)
* Issue #3957 - fix bad usage of MethodHandles.lookup()

Signed-off-by: Lachlan Roberts <lachlan@webtide.com>

* Issue #3957 CustomRequestLog remove unnecessary local string variables

Signed-off-by: Lachlan Roberts <lachlan@webtide.com>
2019-08-13 14:47:39 +10:00
Greg Wilkins
8c4dd7ab05 Fixed decoration changes for #3804
Fixed bad names in OWB webapp.
Don't have the owb jetty-web.xml on by default.

Signed-off-by: Greg Wilkins <gregw@webtide.com>
2019-08-13 11:14:44 +10:00
Olivier Lamy
02c247be5f
include test sources in checkstyle report (#3948)
Signed-off-by: olivier lamy <oliver.lamy@gmail.com>
2019-08-13 10:20:55 +10:00
Simone Bordet
46e1896322 Fixes #3960 - Fix HttpConfiguration copy constructor.
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
2019-08-12 17:42:54 +02:00
Simone Bordet
76612ea7ca Updated dependency to h2spec to 0.6.
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
2019-08-12 17:38:34 +02:00
Greg Wilkins
699f832632 Fixed test for symlinked directory
Signed-off-by: Greg Wilkins <gregw@webtide.com>
2019-08-12 17:21:49 +10:00
Joakim Erdfelt
e7a1978556
Merge pull request #3946 from eclipse/jetty-9.4.x-3804-Decoration-rename
Issue #3804 CDI integration rename
2019-08-09 08:43:07 -05:00