Author: aogburn
Date: 2014-09-04 17:30:47 -0400 (Thu, 04 Sep 2014)
New Revision: 2505
Modified:
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/catalina/security/SecurityClassLoad.java
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/catalina/servlets/DefaultServlet.java
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/coyote/ajp/AjpAprProcessor.java
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/coyote/ajp/AjpProcessor.java
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/coyote/http11/Http11AprProcessor.java
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/coyote/http11/Http11Processor.java
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/jasper/compiler/JspDocumentParser.java
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/tomcat/util/
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/tomcat/util/buf/Ascii.java
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/tomcat/util/net/JIoEndpoint.java
Log:
[JBPAPP-11181] merge fix for CVE-2013-4286
Property changes on: branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java
___________________________________________________________________
Modified: svn:mergeinfo
- /branches/2.1.x/java:2480-2482
+ /branches/2.1.x/java:2394,2480-2482
Property changes on:
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/catalina/security/SecurityClassLoad.java
___________________________________________________________________
Modified: svn:mergeinfo
- /branches/2.1.x/java/org/apache/catalina/security/SecurityClassLoad.java:2480-2482
/branches/7.4.x/src/main/java/org/apache/catalina/security/SecurityClassLoad.java:2460
+
/branches/2.1.x/java/org/apache/catalina/security/SecurityClassLoad.java:2394,2480-2482
/branches/7.4.x/src/main/java/org/apache/catalina/security/SecurityClassLoad.java:2460
Property changes on:
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/catalina/servlets/DefaultServlet.java
___________________________________________________________________
Modified: svn:mergeinfo
- /branches/2.1.x/java/org/apache/catalina/servlets/DefaultServlet.java:2480-2482
/branches/7.4.x/src/main/java/org/apache/catalina/servlets/DefaultServlet.java:2427
+ /branches/2.1.x/java/org/apache/catalina/servlets/DefaultServlet.java:2394,2480-2482
/branches/7.4.x/src/main/java/org/apache/catalina/servlets/DefaultServlet.java:2427
Modified:
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/coyote/ajp/AjpAprProcessor.java
===================================================================
---
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/coyote/ajp/AjpAprProcessor.java 2014-09-04
20:50:30 UTC (rev 2504)
+++
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/coyote/ajp/AjpAprProcessor.java 2014-09-04
21:30:47 UTC (rev 2505)
@@ -25,6 +25,8 @@
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
+import javax.servlet.http.HttpServletResponse;
+
import org.apache.coyote.ActionCode;
import org.apache.coyote.ActionHook;
import org.apache.coyote.Adapter;
@@ -654,6 +656,7 @@
// Decode headers
MimeHeaders headers = request.getMimeHeaders();
+ boolean contentLengthSet = false;
int hCount = requestHeaderMessage.getInt();
for(int i = 0 ; i < hCount ; i++) {
String hName = null;
@@ -689,7 +692,16 @@
if (hId == Constants.SC_REQ_CONTENT_LENGTH ||
(hId == -1 &&
tmpMB.equalsIgnoreCase("Content-Length"))) {
// just read the content-length header, so set it
- request.setContentLength( vMB.getInt() );
+ long cl = vMB.getLong();
+ if (contentLengthSet) {
+ response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
+ error = true;
+ } else {
+ contentLengthSet = true;
+ // Set the content-length header for the request
+ if(cl < Integer.MAX_VALUE)
+ request.setContentLength( (int)cl );
+ }
} else if (hId == Constants.SC_REQ_CONTENT_TYPE ||
(hId == -1 &&
tmpMB.equalsIgnoreCase("Content-Type"))) {
// just read the content-type header, so set it
Modified:
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/coyote/ajp/AjpProcessor.java
===================================================================
---
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/coyote/ajp/AjpProcessor.java 2014-09-04
20:50:30 UTC (rev 2504)
+++
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/coyote/ajp/AjpProcessor.java 2014-09-04
21:30:47 UTC (rev 2505)
@@ -27,6 +27,8 @@
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
+import javax.servlet.http.HttpServletResponse;
+
import org.apache.coyote.ActionCode;
import org.apache.coyote.ActionHook;
import org.apache.coyote.Adapter;
@@ -659,6 +661,7 @@
// Decode headers
MimeHeaders headers = request.getMimeHeaders();
+ boolean contentLengthSet = false;
int hCount = requestHeaderMessage.getInt();
for(int i = 0 ; i < hCount ; i++) {
String hName = null;
@@ -694,7 +697,16 @@
if (hId == Constants.SC_REQ_CONTENT_LENGTH ||
(hId == -1 &&
tmpMB.equalsIgnoreCase("Content-Length"))) {
// just read the content-length header, so set it
- request.setContentLength( vMB.getInt() );
+ long cl = vMB.getLong();
+ if (contentLengthSet) {
+ response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
+ error = true;
+ } else {
+ contentLengthSet = true;
+ // Set the content-length header for the request
+ if(cl < Integer.MAX_VALUE)
+ request.setContentLength( (int)cl );
+ }
} else if (hId == Constants.SC_REQ_CONTENT_TYPE ||
(hId == -1 &&
tmpMB.equalsIgnoreCase("Content-Type"))) {
// just read the content-type header, so set it
Modified:
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/coyote/http11/Http11AprProcessor.java
===================================================================
---
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/coyote/http11/Http11AprProcessor.java 2014-09-04
20:50:30 UTC (rev 2504)
+++
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/coyote/http11/Http11AprProcessor.java 2014-09-04
21:30:47 UTC (rev 2505)
@@ -1469,10 +1469,20 @@
// Parse content-length header
long contentLength = request.getContentLengthLong();
- if (contentLength >= 0 && !contentDelimitation) {
- inputBuffer.addActiveFilter
+ if (contentLength >= 0) {
+ if (contentDelimitation) {
+ // contentDelimitation being true at this point indicates that
+ // chunked encoding is being used but chunked encoding should
+ // not be used with a content length. RFC 2616, section 4.4,
+ // bullet 3 states Content-Length must be ignored in this case -
+ // so remove it.
+ headers.removeHeader("content-length");
+ request.setContentLength(-1);
+ } else {
+ inputBuffer.addActiveFilter
(inputFilters[Constants.IDENTITY_FILTER]);
- contentDelimitation = true;
+ contentDelimitation = true;
+ }
}
MessageBytes valueMB = headers.getValue("host");
Modified:
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/coyote/http11/Http11Processor.java
===================================================================
---
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/coyote/http11/Http11Processor.java 2014-09-04
20:50:30 UTC (rev 2504)
+++
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/coyote/http11/Http11Processor.java 2014-09-04
21:30:47 UTC (rev 2505)
@@ -1273,10 +1273,20 @@
// Parse content-length header
long contentLength = request.getContentLengthLong();
- if (contentLength >= 0 && !contentDelimitation) {
- inputBuffer.addActiveFilter
+ if (contentLength >= 0) {
+ if (contentDelimitation) {
+ // contentDelimitation being true at this point indicates that
+ // chunked encoding is being used but chunked encoding should
+ // not be used with a content length. RFC 2616, section 4.4,
+ // bullet 3 states Content-Length must be ignored in this case -
+ // so remove it.
+ headers.removeHeader("content-length");
+ request.setContentLength(-1);
+ } else {
+ inputBuffer.addActiveFilter
(inputFilters[Constants.IDENTITY_FILTER]);
- contentDelimitation = true;
+ contentDelimitation = true;
+ }
}
MessageBytes valueMB = headers.getValue("host");
Property changes on:
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java
___________________________________________________________________
Modified: svn:mergeinfo
-
/branches/2.1.x/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java:2480-2482
/branches/7.4.x/src/main/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java:2428
+
/branches/2.1.x/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java:2394,2480-2482
/branches/7.4.x/src/main/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java:2428
Property changes on:
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/jasper/compiler/JspDocumentParser.java
___________________________________________________________________
Modified: svn:mergeinfo
- /branches/2.1.x/java/org/apache/jasper/compiler/JspDocumentParser.java:2480-2482
/branches/7.4.x/src/main/java/org/apache/jasper/compiler/JspDocumentParser.java:2427
+
/branches/2.1.x/java/org/apache/jasper/compiler/JspDocumentParser.java:2394,2480-2482
/branches/7.4.x/src/main/java/org/apache/jasper/compiler/JspDocumentParser.java:2427
Property changes on: branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/tomcat/util
___________________________________________________________________
Modified: svn:mergeinfo
- /branches/2.1.x/java/org/apache/tomcat/util:2480-2482
/branches/7.4.x/src/main/java/org/apache/tomcat/util:2427
+ /branches/2.1.x/java/org/apache/tomcat/util:2394,2480-2482
/branches/7.4.x/src/main/java/org/apache/tomcat/util:2427
Property changes on:
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/tomcat/util/buf/Ascii.java
___________________________________________________________________
Modified: svn:mergeinfo
- /branches/2.1.x/java/org/apache/tomcat/util/buf/Ascii.java:2480-2482
/branches/7.4.x/src/main/java/org/apache/tomcat/util/buf/Ascii.java:2426-2427
+ /branches/2.1.x/java/org/apache/tomcat/util/buf/Ascii.java:2394,2480-2482
/branches/7.4.x/src/main/java/org/apache/tomcat/util/buf/Ascii.java:2426-2427
Property changes on:
branches/JBOSSWEB_2_1_12_GA_JBPAPP-11181/java/org/apache/tomcat/util/net/JIoEndpoint.java
___________________________________________________________________
Modified: svn:mergeinfo
- /branches/7.4.x/src/main/java/org/apache/tomcat/util/net/JIoEndpoint.java:2427
+ /branches/2.1.x/java/org/apache/tomcat/util/net/JIoEndpoint.java:2394
/branches/7.4.x/src/main/java/org/apache/tomcat/util/net/JIoEndpoint.java:2427
Show replies by date