Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=48960

Disable exec by default in SSI and provide an option to enable it for both  Servlet and Filter

git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@963868 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/conf/web.xml b/conf/web.xml
index 4db42c3..5e85d73 100644 (file)
--- a/conf/web.xml
+++ b/conf/web.xml
@@ -267,6 +267,8 @@
   <!--                                                                      -->
   <!--   outputEncoding      The encoding to use for the page that results  -->
   <!--                       from the SSI processing. [UTF-8]               -->
+  <!--                                                                      -->
+  <!--   allowExec           Is use of the exec command enabled? [false]    -->
 
 <!--
     <servlet>
@@ -415,6 +417,8 @@
   <!--                       Should "virtual" paths be interpreted as       -->
   <!--                       relative to the context root, instead of       -->
   <!--                       the server root?  (0=false, 1=true) [0]        -->
+  <!--                                                                      -->
+  <!--   allowExec           Is use of the exec command enabled? [false]    -->
 
 <!--
     <filter>

diff --git a/java/org/apache/catalina/ssi/SSIFilter.java b/java/org/apache/catalina/ssi/SSIFilter.java
index ed500e9..567cd1f 100644 (file)
--- a/java/org/apache/catalina/ssi/SSIFilter.java
+++ b/java/org/apache/catalina/ssi/SSIFilter.java
@@ -59,6 +59,8 @@ public class SSIFilter implements Filter {
        /** default pattern for ssi filter content type matching */
        protected Pattern shtmlRegEx =
         Pattern.compile("text/x-server-parsed-html(;.*)?");
+       /** Allow exec (normally blocked for security) */
+       protected boolean allowExec = false;
 
 
     //----------------- Public methods.
@@ -87,6 +89,8 @@ public class SSIFilter implements Filter {
         if (config.getInitParameter("expires") != null)
             expires = Long.valueOf(config.getInitParameter("expires"));
 
+        allowExec = Boolean.parseBoolean(config.getInitParameter("allowExec"));
+
         if (debug > 0)
             config.getServletContext().log(
                     "SSIFilter.init() SSI invoker started with 'debug'=" + debug);
@@ -125,7 +129,7 @@ public class SSIFilter implements Filter {
                 new SSIServletExternalResolver(config.getServletContext(), req,
                         res, isVirtualWebappRelative, debug, encoding);
             SSIProcessor ssiProcessor = new SSIProcessor(ssiExternalResolver,
-                    debug);
+                    debug, allowExec);
             
             // prepare readers/writers
             Reader reader =

diff --git a/java/org/apache/catalina/ssi/SSIProcessor.java b/java/org/apache/catalina/ssi/SSIProcessor.java
index 98c9f37..6dd72a7 100644 (file)
--- a/java/org/apache/catalina/ssi/SSIProcessor.java
+++ b/java/org/apache/catalina/ssi/SSIProcessor.java
@@ -44,11 +44,14 @@ public class SSIProcessor {
     protected HashMap<String,SSICommand> commands =
         new HashMap<String,SSICommand>();
     protected int debug;
+    protected final boolean allowExec;
 
 
-    public SSIProcessor(SSIExternalResolver ssiExternalResolver, int debug) {
+    public SSIProcessor(SSIExternalResolver ssiExternalResolver, int debug,
+            boolean allowExec) {
         this.ssiExternalResolver = ssiExternalResolver;
         this.debug = debug;
+        this.allowExec = allowExec;
         addBuiltinCommands();
     }
 
@@ -56,7 +59,9 @@ public class SSIProcessor {
     protected void addBuiltinCommands() {
         addCommand("config", new SSIConfig());
         addCommand("echo", new SSIEcho());
-        addCommand("exec", new SSIExec());
+        if (allowExec) {
+            addCommand("exec", new SSIExec());
+        }
         addCommand("include", new SSIInclude());
         addCommand("flastmod", new SSIFlastmod());
         addCommand("fsize", new SSIFsize());

diff --git a/java/org/apache/catalina/ssi/SSIServlet.java b/java/org/apache/catalina/ssi/SSIServlet.java
index cc2b146..119a5aa 100644 (file)
--- a/java/org/apache/catalina/ssi/SSIServlet.java
+++ b/java/org/apache/catalina/ssi/SSIServlet.java
@@ -56,6 +56,8 @@ public class SSIServlet extends HttpServlet {
     protected String inputEncoding = null;
     /** Output encoding. If not specified, uses platform default */
     protected String outputEncoding = "UTF-8";
+    /** Allow exec (normally blocked for security) */
+    protected boolean allowExec = false;
 
 
     //----------------- Public methods.
@@ -84,6 +86,9 @@ public class SSIServlet extends HttpServlet {
         if (getServletConfig().getInitParameter("outputEncoding") != null)
             outputEncoding = getServletConfig().getInitParameter("outputEncoding");
         
+        allowExec = Boolean.parseBoolean(
+                getServletConfig().getInitParameter("allowExec"));
+
         if (debug > 0)
             log("SSIServlet.init() SSI invoker started with 'debug'=" + debug);
 
@@ -181,7 +186,7 @@ public class SSIServlet extends HttpServlet {
             new SSIServletExternalResolver(getServletContext(), req, res,
                     isVirtualWebappRelative, debug, inputEncoding);
         SSIProcessor ssiProcessor = new SSIProcessor(ssiExternalResolver,
-                debug);
+                debug, allowExec);
         PrintWriter printWriter = null;
         StringWriter stringWriter = null;
         if (buffered) {

diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 902f392..82e7194 100644 (file)
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -60,6 +60,11 @@
         <bug>48297</bug>: Correctly initialise handler chain for web services
         resources. (markt)
       </fix>
+      <add>
+        <bug>48960</bug>: Add a new option to the SSI Servlet and SSI Filter to
+        allow the disabling of the <code>exec</code> command. This is now
+        disabled by default. Based on a patch by Yair Lenga. (markt)
+      </add>
       <fix>
         <bug>49030</bug>: When initializing/starting/stopping connectors and
         one of them fails, do not ignore the others. (markt/kkolinko)

diff --git a/webapps/docs/ssi-howto.xml b/webapps/docs/ssi-howto.xml
index 0479a8b..3e8f5b2 100644 (file)
--- a/webapps/docs/ssi-howto.xml
+++ b/webapps/docs/ssi-howto.xml
@@ -105,6 +105,8 @@ resources if one cannot be determined from the resource itself. Default is
 the default platform encoding.</li>
 <li><strong>outputEncoding</strong> - The encoding to be used for the result
 of the SSI processing. Default is UTF-8.</li>
+<li><strong>allowExec</strong> - Is the exec command enabled? Default is
+false.</li>
 </ul>
 </p>
 
@@ -128,6 +130,8 @@ evaluated for every request.</li>
 <li><strong>isVirtualWebappRelative</strong> - Should "virtual" SSI directive
 paths be interpreted as relative to the context root, instead of the server
 root? (0=false, 1=true) Default 0 (false).</li>
+<li><strong>allowExec</strong> - Is the exec command enabled? Default is
+false.</li>
 </ul>
 </p>