ContainerServlets are always restricted.

git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1176584 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/java/org/apache/catalina/core/DefaultInstanceManager.java b/java/org/apache/catalina/core/DefaultInstanceManager.java
index cb383cb..3b8eed3 100644 (file)
--- a/java/org/apache/catalina/core/DefaultInstanceManager.java
+++ b/java/org/apache/catalina/core/DefaultInstanceManager.java
@@ -532,6 +532,10 @@ public class DefaultInstanceManager implements InstanceManager {
         if (Filter.class.isAssignableFrom(clazz)) {
             checkAccess(clazz, restrictedFilters);
         } else if (Servlet.class.isAssignableFrom(clazz)) {
+            if (ContainerServlet.class.isAssignableFrom(clazz)) {
+                throw new SecurityException("Restricted (ContainerServlet) " +
+                        clazz);
+            }
             checkAccess(clazz, restrictedServlets);
         } else {
             checkAccess(clazz, restrictedListeners);