cvs commit: jakarta-tomcat/src/examples/WEB-INF/classes/examples ShowSource.java

2000-12-09 Thread craigmcc 

craigmcc00/12/09 19:07:51

  Modified:src/examples/WEB-INF/classes/examples Tag: tomcat_32
ShowSource.java
  Log:
  Fix a security vulnerability -- the "ShowSource" custom tag in conjunction
  with the "/examples/jsp/source.jsp page could be used to expose the contents
  of sensitive information in the WEB-INF or META-INF directories.
  
  Revision  ChangesPath
  No   revision
  
  
  No   revision
  
  
  1.4.4.1   +3 -1  
jakarta-tomcat/src/examples/WEB-INF/classes/examples/ShowSource.java
  
  Index: ShowSource.java
  ===
  RCS file: 
/home/cvs/jakarta-tomcat/src/examples/WEB-INF/classes/examples/ShowSource.java,v
  retrieving revision 1.4
  retrieving revision 1.4.4.1
  diff -u -r1.4 -r1.4.4.1
  --- ShowSource.java   2000/03/07 19:53:39 1.4
  +++ ShowSource.java   2000/12/10 03:07:51 1.4.4.1
  @@ -20,7 +20,9 @@
   }
   
   public int doEndTag() throws JspException {
  - if (jspFile.indexOf( ".." ) >= 0)
  + if ((jspFile.indexOf( ".." ) >= 0) ||
  +(jspFile.toUpperCase().indexOf("/WEB-INF/") != 0) ||
  +(jspFile.toUpperCase().indexOf("/META-INF/") != 0))
throw new JspTagException("Invalid JSP file " + jspFile);
   
   InputStream in

cvs commit: jakarta-tomcat/src/examples/WEB-INF/classes/examples ShowSource.java

2001-06-14 Thread marcsaeg 

marcsaeg01/06/14 08:23:47

  Modified:src/examples/WEB-INF/classes/examples Tag: tomcat_32
ShowSource.java
  Log:
  The code that attempted to prevent exposing the contents of files in the WEB-INF and 
META-INF directories was broken and actually prevented source files from being 
displayed.
  
  PR:  372
  Submitted by: Tony Robertson ([EMAIL PROTECTED])
  
  Revision  ChangesPath
  No   revision
  
  
  No   revision
  
  
  1.4.4.2   +2 -2  
jakarta-tomcat/src/examples/WEB-INF/classes/examples/ShowSource.java
  
  Index: ShowSource.java
  ===
  RCS file: 
/home/cvs/jakarta-tomcat/src/examples/WEB-INF/classes/examples/ShowSource.java,v
  retrieving revision 1.4.4.1
  retrieving revision 1.4.4.2
  diff -u -r1.4.4.1 -r1.4.4.2
  --- ShowSource.java   2000/12/10 03:07:51 1.4.4.1
  +++ ShowSource.java   2001/06/14 15:23:46 1.4.4.2
  @@ -21,8 +21,8 @@
   
   public int doEndTag() throws JspException {
if ((jspFile.indexOf( ".." ) >= 0) ||
  -(jspFile.toUpperCase().indexOf("/WEB-INF/") != 0) ||
  -(jspFile.toUpperCase().indexOf("/META-INF/") != 0))
  +(jspFile.toUpperCase().indexOf("/WEB-INF/") >= 0) ||
  +(jspFile.toUpperCase().indexOf("/META-INF/") >= 0))
throw new JspTagException("Invalid JSP file " + jspFile);
   
   InputStream in

cvs commit: jakarta-tomcat/src/examples/WEB-INF/classes/examples ShowSource.java

2001-06-14 Thread marcsaeg 

marcsaeg01/06/14 08:26:09

  Modified:src/examples/WEB-INF/classes/examples ShowSource.java
  Log:
  Porting ShowSource.java from 3.2.x.  This contains the code that prevents
  the ShowSource servlet from displaying contents of files in WEB-INF and META-INF
  directories.
  PR:  372
  Submitted by: Tony Robertson ([EMAIL PROTECTED])
  
  Revision  ChangesPath
  1.5   +3 -1  
jakarta-tomcat/src/examples/WEB-INF/classes/examples/ShowSource.java
  
  Index: ShowSource.java
  ===
  RCS file: 
/home/cvs/jakarta-tomcat/src/examples/WEB-INF/classes/examples/ShowSource.java,v
  retrieving revision 1.4
  retrieving revision 1.5
  diff -u -r1.4 -r1.5
  --- ShowSource.java   2000/03/07 19:53:39 1.4
  +++ ShowSource.java   2001/06/14 15:26:07 1.5
  @@ -20,7 +20,9 @@
   }
   
   public int doEndTag() throws JspException {
  - if (jspFile.indexOf( ".." ) >= 0)
  + if ((jspFile.indexOf( ".." ) >= 0) ||
  +(jspFile.toUpperCase().indexOf("/WEB-INF/") >= 0) ||
  +(jspFile.toUpperCase().indexOf("/META-INF/") >= 0))
throw new JspTagException("Invalid JSP file " + jspFile);
   
   InputStream in