5:13 p.m.
Author: bmaxwell
Date: 2012-01-04 11:13:17 -0500 (Wed, 04 Jan 2012)
New Revision: 1911
Modified:
branches/JBOSSWEB_2_0_0_GA_CP15_JBPAPP-7836/build.properties.default
branches/JBOSSWEB_2_0_0_GA_CP15_JBPAPP-7836/build.xml
branches/JBOSSWEB_2_0_0_GA_CP15_JBPAPP-7836/src/share/classes/org/apache/tomcat/util/http/MimeHeaders.java
branches/JBOSSWEB_2_0_0_GA_CP15_JBPAPP-7836/src/share/classes/org/apache/tomcat/util/http/Parameters.java
Log:
[JBPAPP-7836] JBWEB-209: CVE Fixes: 2011-2204, 2011-2729, 2011-1184, 2011-2526, 2011-4858
Modified: branches/JBOSSWEB_2_0_0_GA_CP15_JBPAPP-7836/build.properties.default
===================================================================
--- branches/JBOSSWEB_2_0_0_GA_CP15_JBPAPP-7836/build.properties.default 2012-01-03
21:46:24 UTC (rev 1910)
+++ branches/JBOSSWEB_2_0_0_GA_CP15_JBPAPP-7836/build.properties.default 2012-01-04
16:13:17 UTC (rev 1911)
@@ -13,7 +13,7 @@
version.major=2
version.minor=0
version.build=0
-version.patch=GA_CP
+version.patch=GA_CP15_JBPAPP-7836
# ----- Vesion Control Flags -----
jboss.version.major=4
Modified: branches/JBOSSWEB_2_0_0_GA_CP15_JBPAPP-7836/build.xml
===================================================================
--- branches/JBOSSWEB_2_0_0_GA_CP15_JBPAPP-7836/build.xml 2012-01-03 21:46:24 UTC (rev
1910)
+++ branches/JBOSSWEB_2_0_0_GA_CP15_JBPAPP-7836/build.xml 2012-01-04 16:13:17 UTC (rev
1911)
@@ -16,7 +16,7 @@
<property name="version.major" value="2" />
<property name="version.minor" value="0" />
<property name="version.build" value="0" />
- <property name="version.patch" value="snapshot" />
+ <property name="version.patch"
value="GA_CP15_JBPAPP-7836" />
<property name="version.flag" value="" />
<property name="version.number"
value="${version.major}.${version.minor}.${version.build}.${version.patch}"
/>
<property name="version"
value="${version.major}.${version.minor}.${version.build}.${version.patch}${version.flag}"
/>
Modified:
branches/JBOSSWEB_2_0_0_GA_CP15_JBPAPP-7836/src/share/classes/org/apache/tomcat/util/http/MimeHeaders.java
===================================================================
---
branches/JBOSSWEB_2_0_0_GA_CP15_JBPAPP-7836/src/share/classes/org/apache/tomcat/util/http/MimeHeaders.java 2012-01-03
21:46:24 UTC (rev 1910)
+++
branches/JBOSSWEB_2_0_0_GA_CP15_JBPAPP-7836/src/share/classes/org/apache/tomcat/util/http/MimeHeaders.java 2012-01-04
16:13:17 UTC (rev 1911)
@@ -23,9 +23,6 @@
import org.apache.tomcat.util.buf.MessageBytes;
-/* XXX XXX XXX Need a major rewrite !!!!
- */
-
/**
* This class is used to contain standard internet message headers,
* used for SMTP (RFC822) and HTTP (RFC2068) messages as well as for
@@ -79,12 +76,6 @@
* to avoid inside tomcat. The goal is to use _only_ MessageByte-based Fields,
* and reduce to 0 the memory overhead of tomcat.
*
- * TODO:
- * XXX one-buffer parsing - for http ( other protocols don't need that )
- * XXX remove unused methods
- * XXX External enumerations, with 0 GC.
- * XXX use HeaderName ID
- *
*
* @author dac(a)eng.sun.com
* @author James Todd [gonzo(a)eng.sun.com]
@@ -93,9 +84,11 @@
*/
public class MimeHeaders {
/** Initial size - should be == average number of headers per request
- * XXX make it configurable ( fine-tuning of web-apps )
*/
public static final int DEFAULT_HEADER_SIZE=8;
+ protected static final int MAX_COUNT =
+
Integer.valueOf(System.getProperty("org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT",
"128")).intValue();
+
/**
* The header fields.
@@ -216,6 +209,9 @@
MimeHeaderField mh;
int len = headers.length;
if (count >= len) {
+ if (count >= MAX_COUNT) {
+ throw new IllegalStateException("Header count exceeded allowed
maximum: " + MAX_COUNT);
+ }
// expand header list array
MimeHeaderField tmp[] = new MimeHeaderField[count * 2];
System.arraycopy(headers, 0, tmp, 0, len);
@@ -326,9 +322,7 @@
* @param name the name of the header field to be removed
*/
public void removeHeader(String name) {
- // XXX
// warning: rather sticky code; heavily tuned
-
for (int i = 0; i < count; i++) {
if (headers[i].getName().equalsIgnoreCase(name)) {
removeHeader(i--);
Modified:
branches/JBOSSWEB_2_0_0_GA_CP15_JBPAPP-7836/src/share/classes/org/apache/tomcat/util/http/Parameters.java
===================================================================
---
branches/JBOSSWEB_2_0_0_GA_CP15_JBPAPP-7836/src/share/classes/org/apache/tomcat/util/http/Parameters.java 2012-01-03
21:46:24 UTC (rev 1910)
+++
branches/JBOSSWEB_2_0_0_GA_CP15_JBPAPP-7836/src/share/classes/org/apache/tomcat/util/http/Parameters.java 2012-01-04
16:13:17 UTC (rev 1911)
@@ -51,6 +51,8 @@
MessageBytes decodedQuery=MessageBytes.newInstance();
public static final int INITIAL_SIZE=4;
+ protected static final int MAX_COUNT =
+
Integer.valueOf(System.getProperty("org.apache.tomcat.util.http.Parameters.MAX_COUNT",
"512")).intValue();
// Garbage-less parameter merging.
// In a sub-request with parameters, the new parameters
@@ -175,6 +177,8 @@
values[i+ oldValues.length] = newValues[i];
}
} else {
+ if (paramHashStringArray.size() >=MAX_COUNT)
+ throw new IllegalStateException("Parameter count exceeded allowed
maximum: " + MAX_COUNT);
values = newValues;
}
@@ -316,6 +320,8 @@
}
values[oldValues.length] = value;
} else {
+ if (paramHashStringArray.size() >=MAX_COUNT)
+ throw new IllegalStateException("Parameter count exceeded allowed
maximum: " + MAX_COUNT);
values = new String[1];
values[0] = value;
}