Author: jfrederic.clere(a)jboss.com Date: 2014-02-11 09:13:10 -0500 (Tue, 11 Feb 2014) New Revision: 2362 Modified: branches/2.1.x/java/org/apache/catalina/connector/LocalStrings.properties branches/2.1.x/java/org/apache/catalina/connector/Request.java branches/2.1.x/java/org/apache/coyote/http11/Http11AprProtocol.java branches/2.1.x/java/org/apache/coyote/http11/LocalStrings.properties Log: Fix for JBPAPP-10023. Modified: branches/2.1.x/java/org/apache/catalina/connector/LocalStrings.properties =================================================================== --- branches/2.1.x/java/org/apache/catalina/connector/LocalStrings.properties 2014-02-06 13:37:00 UTC (rev 2361) +++ branches/2.1.x/java/org/apache/catalina/connector/LocalStrings.properties 2014-02-11 14:13:10 UTC (rev 2362) @@ -49,6 +49,7 @@ coyoteRequest.attributeEvent=Exception thrown by attributes event listener coyoteRequest.parseParameters=Exception thrown whilst processing POSTed parameters coyoteRequest.postTooLarge=Parameters were not parsed because the size of the posted data was too big. Use the maxPostSize attribute of the connector to resolve this if the application should accept large POSTs. +coyoteRequest.sendfileNotCanonical=Unable to determine canonical name of file [{0}] specified for use with sendfile # # MapperListener Modified: branches/2.1.x/java/org/apache/catalina/connector/Request.java =================================================================== --- branches/2.1.x/java/org/apache/catalina/connector/Request.java 2014-02-06 13:37:00 UTC (rev 2361) +++ branches/2.1.x/java/org/apache/catalina/connector/Request.java 2014-02-11 14:13:10 UTC (rev 2362) @@ -20,6 +20,8 @@ import java.io.BufferedReader; +import java.io.FileReader; +import java.io.File; import java.io.IOException; import java.io.InputStream; import java.io.UnsupportedEncodingException; @@ -1434,6 +1436,26 @@ return; } + // Do the security check before any updates are made + if (Globals.IS_SECURITY_ENABLED && + name.equals("org.apache.tomcat.sendfile.filename")) { + // Use the canonical file name to avoid any possible symlink and + // relative path issues + String canonicalPath; + try { + canonicalPath = new File(value.toString()).getCanonicalPath(); + } catch (IOException e) { + throw new SecurityException(sm.getString( + "coyoteRequest.sendfileNotCanonical", value), e); + } + // Sendfile is performed in Tomcat's security context so need to + // check if the web app is permitted to access the file while still + // in the web app's security context + System.getSecurityManager().checkRead(canonicalPath); + // Update the value so the canonical path is used + value = canonicalPath; + } + oldValue = attributes.put(name, value); if (oldValue != null) { replaced = true; Modified: branches/2.1.x/java/org/apache/coyote/http11/Http11AprProtocol.java =================================================================== --- branches/2.1.x/java/org/apache/coyote/http11/Http11AprProtocol.java 2014-02-06 13:37:00 UTC (rev 2361) +++ branches/2.1.x/java/org/apache/coyote/http11/Http11AprProtocol.java 2014-02-11 14:13:10 UTC (rev 2362) @@ -31,6 +31,7 @@ import javax.management.MBeanServer; import javax.management.ObjectName; +import org.apache.catalina.Globals; import org.apache.coyote.ActionCode; import org.apache.coyote.Adapter; import org.apache.coyote.ProtocolHandler; @@ -278,7 +279,12 @@ public void setKeepAliveTimeout(int timeout) { endpoint.setKeepAliveTimeout(timeout); } public boolean getUseSendfile() { return endpoint.getUseSendfile(); } - public void setUseSendfile(boolean useSendfile) { endpoint.setUseSendfile(useSendfile); } + public void setUseSendfile(boolean useSendfile) { + if (Globals.IS_SECURITY_ENABLED) + endpoint.setUseSendfile(useSendfile); + else + log.warn(sm.getString("http11protocol.sendfiledisabled")); + } public int getPollTime() { return endpoint.getPollTime(); } public void setPollTime(int pollTime) { endpoint.setPollTime(pollTime); } Modified: branches/2.1.x/java/org/apache/coyote/http11/LocalStrings.properties =================================================================== --- branches/2.1.x/java/org/apache/coyote/http11/LocalStrings.properties 2014-02-06 13:37:00 UTC (rev 2361) +++ branches/2.1.x/java/org/apache/coyote/http11/LocalStrings.properties 2014-02-11 14:13:10 UTC (rev 2362) @@ -26,6 +26,7 @@ http11protocol.endpoint.pauseerror=Error pausing endpoint http11protocol.resume=Resuming Coyote HTTP/1.1 on {0} http11protocol.endpoint.resumeerror=Error resuming endpoint +http11protocol.sendfiledisabled=Sendfile disabled when no security manager # # Http11Processor