Bug#845425: DataSource no longer accessible since jessie security update

[Arne Nordmark]

Den 2016-12-07 kl. 17:35, skrev Emmanuel Bourg:
> Le 7/12/2016 à 13:28, Arne Nordmark a écrit :
> 
> Thanks for the info. I'm trying to reproduce the same error but I
> haven't succeeded so far. Here is was I did:
> 

...

> 9. Create a test page /var/lib/tomcat7/webapps/ROOT/test.jsp with:
> 
>   <%@page import="javax.naming.*,javax.sql.*" %>
>   <%
>   Context initContext = new InitialContext();
>   Context envContext  = (Context) initContext.lookup("java:/comp/env");
>   DataSource ds = (DataSource) envContext.lookup("jdbc/test");
> 
>   out.println("DataSource: " + ds);
>   %>
> 
> There is still something different with your setup but I don't know what.

If I add

  out.println("Loaded by: " + ds.getClass().getClassLoader());

to test.jsp I get

Loaded by: org.apache.catalina.loader.StandardClassLoader@4876e0

so the WebappClassLoader is not being used in this example, probably
because there are no classes in the webapp.

> 
> 
>> Am I correct in understanding that you want me to add the loop on top of
>> version 7.0.56-3+deb8u5 without the other changes from upstream 7.0.73?
> 
> Yes please.

OK. I first built 7.0.56-3+deb8u5 as disatributed, installed, and
verified that your example works but not my webapp. Then I added the
loop to validateGlobalResourceAccess() (patch attached), reinstalled
libtomcat7-java, restarted tomcat7, and verified that both webapps now work.

> 
> Emmanuel Bourg
> 

Thanks for your patience,
Arne

--- a/java/org/apache/naming/factory/ResourceLinkFactory.java
+++ b/java/org/apache/naming/factory/ResourceLinkFactory.java
@@ -116,9 +116,12 @@
 
     private static boolean validateGlobalResourceAccess(String globalName) {
         ClassLoader cl = Thread.currentThread().getContextClassLoader();
-        Map<String,String> registrations = globalResourceRegistrations.get(cl);
-        if (registrations != null && registrations.containsValue(globalName)) {
-            return true;
+        while (cl != null) {
+            Map<String,String> registrations = globalResourceRegistrations.get(cl);
+            if (registrations != null && registrations.containsValue(globalName)) {
+                return true;
+            }
+            cl = cl.getParent();
         }
         return false;
     }