Skip to content
This repository was archived by the owner on Aug 17, 2018. It is now read-only.

Commit 7706958

Browse files
author
Kin Man Chung
committed
Fix security issues
svn path=/trunk/; revision=1478
1 parent e151d45 commit 7706958

File tree

10 files changed

+268
-31
lines changed

10 files changed

+268
-31
lines changed

‎impl/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -291,7 +291,7 @@
291291
<dependency>
292292
<groupId>org.glassfish</groupId>
293293
<artifactId>javax.el</artifactId>
294-
<version>[3.0.1-b02,)</version>
294+
<version>[3.0.1-b05,)</version>
295295
</dependency>
296296
<dependency>
297297
<groupId>javax.servlet.jsp</groupId>

‎impl/src/main/java/org/apache/jasper/Constants.java‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -291,6 +291,14 @@ public class Constants {
291291
* The name of the JSP engine. Used for X-Powered-By identification in
292292
* the response header
293293
*/
294-
public static final String JSP_NAME = "JSP/2.2";
294+
public static final String JSP_NAME = "JSP/2.3";
295+
296+
/**
297+
* Name of the ServletContext init-param that determines if the XML parsers
298+
* will block the resolution of external entities.
299+
*/
300+
public static final String XML_BLOCK_EXTERNAL_INIT_PARAM =
301+
"org.apache.jasper.XML_BLOCK_EXTERNAL";
302+
295303
}
296304

‎impl/src/main/java/org/apache/jasper/compiler/ImplicitTagLibraryInfo.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -255,7 +255,9 @@ private void parseImplicitTld(JspCompilationContext ctxt, String path)
255255
tld = new ParserUtils().parseXMLDocument(IMPLICIT_TLD, is);
256256
*/
257257
// START SJSAS 6384538
258-
tld = new ParserUtils().parseXMLDocument(
258+
boolean blockExternal = Boolean.parseBoolean(ctxt.getServletContext()
259+
.getInitParameter(Constants.XML_BLOCK_EXTERNAL_INIT_PARAM));
260+
tld = new ParserUtils(blockExternal).parseXMLDocument(
259261
IMPLICIT_TLD, is, ctxt.getOptions().isValidationEnabled());
260262
// END SJSAS 6384538
261263
} catch (Exception ex) {

‎impl/src/main/java/org/apache/jasper/compiler/JspDocumentParser.java‎

Lines changed: 46 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@
6969
import java.util.Iterator;
7070
import java.util.List;
7171
import java.util.jar.JarFile;
72+
import java.security.AccessController;
7273

7374
import javax.servlet.jsp.tagext.TagFileInfo;
7475
import javax.servlet.jsp.tagext.TagInfo;
@@ -77,6 +78,9 @@
7778
import javax.xml.parsers.SAXParserFactory;
7879

7980
import org.apache.jasper.JasperException;
81+
import org.apache.jasper.Constants;
82+
import org.apache.jasper.security.PrivilegedGetTccl;
83+
import org.apache.jasper.security.PrivilegedSetTccl;
8084
import org.apache.jasper.JspCompilationContext;
8185
import org.xml.sax.Attributes;
8286
import org.xml.sax.InputSource;
@@ -1456,24 +1460,49 @@ private static SAXParser getSAXParser(
14561460
JspDocumentParser jspDocParser)
14571461
throws Exception {
14581462

1459-
SAXParserFactory factory = SAXParserFactory.newInstance();
1460-
factory.setNamespaceAware(true);
1461-
1462-
// Preserve xmlns attributes
1463-
factory.setFeature(
1464-
"http://xml.org/sax/features/namespace-prefixes",
1465-
true);
1466-
factory.setFeature(
1467-
"http://xml.org/sax/features/validation",
1468-
validating);
1469-
1470-
// Configure the parser
1471-
SAXParser saxParser = factory.newSAXParser();
1472-
XMLReader xmlReader = saxParser.getXMLReader();
1473-
xmlReader.setProperty(LEXICAL_HANDLER_PROPERTY, jspDocParser);
1474-
xmlReader.setErrorHandler(jspDocParser);
1463+
ClassLoader original;
1464+
if (Constants.IS_SECURITY_ENABLED) {
1465+
PrivilegedGetTccl pa = new PrivilegedGetTccl();
1466+
original = AccessController.doPrivileged(pa);
1467+
} else {
1468+
original = Thread.currentThread().getContextClassLoader();
1469+
}
1470+
try {
1471+
if (Constants.IS_SECURITY_ENABLED) {
1472+
PrivilegedSetTccl pa =
1473+
new PrivilegedSetTccl(JspDocumentParser.class.getClassLoader());
1474+
AccessController.doPrivileged(pa);
1475+
} else {
1476+
Thread.currentThread().setContextClassLoader(
1477+
JspDocumentParser.class.getClassLoader());
1478+
}
14751479

1476-
return saxParser;
1480+
SAXParserFactory factory = SAXParserFactory.newInstance();
1481+
factory.setNamespaceAware(true);
1482+
1483+
// Preserve xmlns attributes
1484+
factory.setFeature(
1485+
"http://xml.org/sax/features/namespace-prefixes",
1486+
true);
1487+
factory.setFeature(
1488+
"http://xml.org/sax/features/validation",
1489+
validating);
1490+
1491+
// Configure the parser
1492+
SAXParser saxParser = factory.newSAXParser();
1493+
XMLReader xmlReader = saxParser.getXMLReader();
1494+
xmlReader.setProperty(LEXICAL_HANDLER_PROPERTY, jspDocParser);
1495+
xmlReader.setErrorHandler(jspDocParser);
1496+
1497+
return saxParser;
1498+
} finally {
1499+
if (Constants.IS_SECURITY_ENABLED) {
1500+
PrivilegedSetTccl pa = new PrivilegedSetTccl(original);
1501+
AccessController.doPrivileged(pa);
1502+
} else {
1503+
Thread.currentThread().setContextClassLoader(original);
1504+
}
1505+
}
14771506
}
14781507

14791508
/*

‎impl/src/main/java/org/apache/jasper/compiler/TagLibraryInfoImpl.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -336,8 +336,11 @@ private void parseTLD(JspCompilationContext ctxt,
336336
new HashMap<String, FunctionInfo>();
337337

338338
// Create an iterator over the child elements of our <taglib> element
339-
ParserUtils pu = new ParserUtils();
340-
TreeNode tld = pu.parseXMLDocument(uri, in);
339+
boolean blockExternal = Boolean.parseBoolean(ctxt.getServletContext()
340+
.getInitParameter(Constants.XML_BLOCK_EXTERNAL_INIT_PARAM));
341+
ParserUtils pu = new ParserUtils(blockExternal);
342+
TreeNode tld = pu.parseXMLDocument(uri, in,
343+
ctxt.getOptions().isValidationEnabled());
341344

342345
// Check to see if the <taglib> root element contains a 'version'
343346
// attribute, which was added in JSP 2.0 to replace the <jsp-version>

‎impl/src/main/java/org/apache/jasper/compiler/TagPluginManager.java‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@
6262
import java.io.*;
6363
import javax.servlet.ServletContext;
6464

65+
import org.apache.jasper.Constants;
6566
import org.apache.jasper.JasperException;
6667
import org.apache.jasper.xmlparser.ParserUtils;
6768
import org.apache.jasper.xmlparser.TreeNode;
@@ -115,7 +116,9 @@ private void init(ErrorDispatcher err) throws JasperException {
115116
if (is == null)
116117
return;
117118

118-
TreeNode root = (new ParserUtils()).parseXMLDocument(TAG_PLUGINS_XML,
119+
boolean blockExternal = Boolean.parseBoolean(ctxt.getInitParameter(
120+
Constants.XML_BLOCK_EXTERNAL_INIT_PARAM));
121+
TreeNode root = (new ParserUtils(blockExternal)).parseXMLDocument(TAG_PLUGINS_XML,
119122
is);
120123
if (root == null) {
121124
return;

‎impl/src/main/java/org/apache/jasper/runtime/TldScanner.java‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,7 @@ public class TldScanner implements ServletContainerInitializer {
186186
private boolean useMyFaces = false;
187187
private boolean scanListeners; // true if scan tlds for listeners
188188
private boolean doneScanning; // true if all tld scanning done
189+
private boolean blockExternal; // Don't allow external entities
189190

190191

191192
//*********************************************************************
@@ -218,6 +219,8 @@ public TldScanner(ServletContext ctxt, boolean isValidationEnabled) {
218219
if (b != null) {
219220
useMyFaces = b.booleanValue();
220221
}
222+
blockExternal = Boolean.parseBoolean(ctxt.getInitParameter(
223+
Constants.XML_BLOCK_EXTERNAL_INIT_PARAM));
221224
}
222225

223226

@@ -597,7 +600,7 @@ private TldInfo scanTld(String resourcePath, String entryName,
597600
throws JasperException {
598601
try {
599602
// Parse the tag library descriptor at the specified resource path
600-
TreeNode tld = new ParserUtils().parseXMLDocument(
603+
TreeNode tld = new ParserUtils(blockExternal).parseXMLDocument(
601604
resourcePath, stream, isValidationEnabled);
602605

603606
String uri = null;

‎impl/src/main/java/org/apache/jasper/security/PrivilegedGetTccl.java‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
/*
2+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
3+
*
4+
* Copyright (c) 2014 Oracle and/or its affiliates. All rights reserved.
5+
*
6+
* The contents of this file are subject to the terms of either the GNU
7+
* General Public License Version 2 only ("GPL") or the Common Development
8+
* and Distribution License("CDDL") (collectively, the "License"). You
9+
* may not use this file except in compliance with the License. You can
10+
* obtain a copy of the License at
11+
* https://glassfish.dev.java.net/public/CDDL+GPL_1_1.html
12+
* or packager/legal/LICENSE.txt. See the License for the specific
13+
* language governing permissions and limitations under the License.
14+
*
15+
* When distributing the software, include this License Header Notice in each
16+
* file and include the License file at packager/legal/LICENSE.txt.
17+
*
18+
* GPL Classpath Exception:
19+
* Oracle designates this particular file as subject to the "Classpath"
20+
* exception as provided by Oracle in the GPL Version 2 section of the License
21+
* file that accompanied this code.
22+
*
23+
* Modifications:
24+
* If applicable, add the following below the License Header, with the fields
25+
* enclosed by brackets [] replaced by your own identifying information:
26+
* "Portions Copyright [year] [name of copyright owner]"
27+
*
28+
* Contributor(s):
29+
* If you wish your version of this file to be governed by only the CDDL or
30+
* only the GPL Version 2, indicate your decision by adding "[Contributor]
31+
* elects to include this software in this distribution under the [CDDL or GPL
32+
* Version 2] license." If you don't indicate a single choice of license, a
33+
* recipient has the option to distribute your version of this file under
34+
* either the CDDL, the GPL Version 2 or to extend the choice of license to
35+
* its licensees as provided above. However, if you add GPL Version 2 code
36+
* and therefore, elected the GPL Version 2 license, then the option applies
37+
* only if the new code is made subject to such option by the copyright
38+
* holder.
39+
*
40+
*
41+
* This file incorporates work covered by the following copyright and
42+
* permission notice:
43+
*
44+
* Licensed to the Apache Software Foundation (ASF) under one or more
45+
* contributor license agreements. See the NOTICE file distributed with
46+
* this work for additional information regarding copyright ownership.
47+
* The ASF licenses this file to You under the Apache License, Version 2.0
48+
* (the "License"); you may not use this file except in compliance with
49+
* the License. You may obtain a copy of the License at
50+
*
51+
* http://www.apache.org/licenses/LICENSE-2.0
52+
*
53+
* Unless required by applicable law or agreed to in writing, software
54+
* distributed under the License is distributed on an "AS IS" BASIS,
55+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
56+
* See the License for the specific language governing permissions and
57+
* limitations under the License.
58+
*/
59+
60+
package org.apache.jasper.security;
61+
62+
import java.security.PrivilegedAction;
63+
64+
public class PrivilegedGetTccl implements PrivilegedAction<ClassLoader> {
65+
@Override
66+
public ClassLoader run() {
67+
return Thread.currentThread().getContextClassLoader();
68+
}
69+
}
70+
71+

‎impl/src/main/java/org/apache/jasper/security/PrivilegedSetTccl.java‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
/*
2+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
3+
*
4+
* Copyright (c) 2014 Oracle and/or its affiliates. All rights reserved.
5+
*
6+
* The contents of this file are subject to the terms of either the GNU
7+
* General Public License Version 2 only ("GPL") or the Common Development
8+
* and Distribution License("CDDL") (collectively, the "License"). You
9+
* may not use this file except in compliance with the License. You can
10+
* obtain a copy of the License at
11+
* https://glassfish.dev.java.net/public/CDDL+GPL_1_1.html
12+
* or packager/legal/LICENSE.txt. See the License for the specific
13+
* language governing permissions and limitations under the License.
14+
*
15+
* When distributing the software, include this License Header Notice in each
16+
* file and include the License file at packager/legal/LICENSE.txt.
17+
*
18+
* GPL Classpath Exception:
19+
* Oracle designates this particular file as subject to the "Classpath"
20+
* exception as provided by Oracle in the GPL Version 2 section of the License
21+
* file that accompanied this code.
22+
*
23+
* Modifications:
24+
* If applicable, add the following below the License Header, with the fields
25+
* enclosed by brackets [] replaced by your own identifying information:
26+
* "Portions Copyright [year] [name of copyright owner]"
27+
*
28+
* Contributor(s):
29+
* If you wish your version of this file to be governed by only the CDDL or
30+
* only the GPL Version 2, indicate your decision by adding "[Contributor]
31+
* elects to include this software in this distribution under the [CDDL or GPL
32+
* Version 2] license." If you don't indicate a single choice of license, a
33+
* recipient has the option to distribute your version of this file under
34+
* either the CDDL, the GPL Version 2 or to extend the choice of license to
35+
* its licensees as provided above. However, if you add GPL Version 2 code
36+
* and therefore, elected the GPL Version 2 license, then the option applies
37+
* only if the new code is made subject to such option by the copyright
38+
* holder.
39+
*
40+
*
41+
* This file incorporates work covered by the following copyright and
42+
* permission notice:
43+
*
44+
* Licensed to the Apache Software Foundation (ASF) under one or more
45+
* contributor license agreements. See the NOTICE file distributed with
46+
* this work for additional information regarding copyright ownership.
47+
* The ASF licenses this file to You under the Apache License, Version 2.0
48+
* (the "License"); you may not use this file except in compliance with
49+
* the License. You may obtain a copy of the License at
50+
*
51+
* http://www.apache.org/licenses/LICENSE-2.0
52+
*
53+
* Unless required by applicable law or agreed to in writing, software
54+
* distributed under the License is distributed on an "AS IS" BASIS,
55+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
56+
* See the License for the specific language governing permissions and
57+
* limitations under the License.
58+
*/
59+
60+
package org.apache.jasper.security;
61+
62+
import java.security.PrivilegedAction;
63+
64+
public class PrivilegedSetTccl implements PrivilegedAction<Void> {
65+
66+
private ClassLoader cl;
67+
68+
public PrivilegedSetTccl(ClassLoader cl) {
69+
this.cl = cl;
70+
}
71+
72+
@Override
73+
public Void run() {
74+
Thread.currentThread().setContextClassLoader(cl);
75+
return null;
76+
}
77+
}

0 commit comments

Comments
 (0)