From 3c520ca3cceadca765ed250c3f19ce69da945892 Mon Sep 17 00:00:00 2001 From: markt Date: Wed, 13 Jul 2011 13:28:24 +0000 Subject: [PATCH] When running under a security manager and using sendfile, validate sendfile attributes to prevent sendfile being used to bypass the security manager. Part of the fix for CVE-2011-2526 git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1146005 13f79535-47bb-0310-9956-ffa450edef68 --- .../catalina/connector/LocalStrings.properties | 1 + java/org/apache/catalina/connector/Request.java | 20 ++++++++++++++++++++ 2 files changed, 21 insertions(+) diff --git a/java/org/apache/catalina/connector/LocalStrings.properties b/java/org/apache/catalina/connector/LocalStrings.properties index a0d38fa42..e0120808d 100644 --- a/java/org/apache/catalina/connector/LocalStrings.properties +++ b/java/org/apache/catalina/connector/LocalStrings.properties @@ -66,6 +66,7 @@ coyoteRequest.noLoginConfig=No authentication mechanism has been configured for coyoteRequest.authenticate.ise=Cannot call authenticate() after the reponse has been committed coyoteRequest.uploadLocationInvalid=The temporary upload location [{0}] is not valid coyoteRequest.sessionEndAccessFail=Exception triggered ending access to session while recycling request +coyoteRequest.sendfileNotCanonical=Unable to determine canonical name of file [{0}] specified for use with sendfile requestFacade.nullRequest=The request object has been recycled and is no longer associated with this facade diff --git a/java/org/apache/catalina/connector/Request.java b/java/org/apache/catalina/connector/Request.java index 2d26be08d..87ce69009 100644 --- a/java/org/apache/catalina/connector/Request.java +++ b/java/org/apache/catalina/connector/Request.java @@ -1525,6 +1525,26 @@ public class Request return; } + // Do the security check before any updates are made + if (Globals.IS_SECURITY_ENABLED && + name.equals("org.apache.tomcat.sendfile.filename")) { + // Use the canonical file name to avoid any possible symlink and + // relative path issues + String canonicalPath; + try { + canonicalPath = new File(value.toString()).getCanonicalPath(); + } catch (IOException e) { + throw new SecurityException(sm.getString( + "coyoteRequest.sendfileNotCanonical", value), e); + } + // Sendfile is performed in Tomcat's security context so need to + // check if the web app is permitted to access the file while still + // in the web app's security context + System.getSecurityManager().checkRead(canonicalPath); + // Update the value so the canonical path is used + value = canonicalPath; + } + oldValue = attributes.put(name, value); if (oldValue != null) { replaced = true; -- 2.11.0