https://bz.apache.org/bugzilla/show_bug.cgi?id=69752
--- Comment #5 from Christopher Schultz <ch...@christopherschultz.net> --- (In reply to Mark Thomas from comment #2) > I might be persuaded to support logging a waring if appBase == $CATALINA_BASE I would highly recommend that we should do this. It's almost unthinkable that conf/server.xml contains nothing of any value, and obviously any non-default conf/tomcat-users.xml file would be very interesting to a potential attacker. > but given all the other possible appBase values that could have similar > concerns I'm not seeing a need to treat this as a special case. There may also be some very stupid cases that might happen accidentally, such as "/" but you are right, we can't really stop you from setting appBase="/etc" or similar. But I do think that the specific check for appBase == $CATALINA_BASE is worth refusing to start the server. I can't see a valid use-case for appBase==$CATALINA_BASE and the failure cases are pretty bad. This seems like a reasonable "secure by default" hardening maneuver. -- You are receiving this mail because: You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
