From 820b3373a2e932bd255c3a0951eb014d96729a7e Mon Sep 17 00:00:00 2001
From: markt <markt@13f79535-47bb-0310-9956-ffa450edef68>
Date: Tue, 13 Jul 2010 21:35:39 +0000
Subject: [PATCH] Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=48960
 Disable exec by default in SSI and provide an option to enable it for both 
 Servlet and Filter

git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@963868 13f79535-47bb-0310-9956-ffa450edef68
---
 conf/web.xml                                   | 4 ++++
 java/org/apache/catalina/ssi/SSIFilter.java    | 6 +++++-
 java/org/apache/catalina/ssi/SSIProcessor.java | 9 +++++++--
 java/org/apache/catalina/ssi/SSIServlet.java   | 7 ++++++-
 webapps/docs/changelog.xml                     | 5 +++++
 webapps/docs/ssi-howto.xml                     | 4 ++++
 6 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/conf/web.xml b/conf/web.xml
index 4db42c396..5e85d7348 100644
--- a/conf/web.xml
+++ b/conf/web.xml
@@ -267,6 +267,8 @@
   <!--                                                                      -->
   <!--   outputEncoding      The encoding to use for the page that results  -->
   <!--                       from the SSI processing. [UTF-8]               -->
+  <!--                                                                      -->
+  <!--   allowExec           Is use of the exec command enabled? [false]    -->
 
 <!--
     <servlet>
@@ -415,6 +417,8 @@
   <!--                       Should "virtual" paths be interpreted as       -->
   <!--                       relative to the context root, instead of       -->
   <!--                       the server root?  (0=false, 1=true) [0]        -->
+  <!--                                                                      -->
+  <!--   allowExec           Is use of the exec command enabled? [false]    -->
 
 <!--
     <filter>
diff --git a/java/org/apache/catalina/ssi/SSIFilter.java b/java/org/apache/catalina/ssi/SSIFilter.java
index ed500e94a..567cd1f34 100644
--- a/java/org/apache/catalina/ssi/SSIFilter.java
+++ b/java/org/apache/catalina/ssi/SSIFilter.java
@@ -59,6 +59,8 @@ public class SSIFilter implements Filter {
 	/** default pattern for ssi filter content type matching */
 	protected Pattern shtmlRegEx =
         Pattern.compile("text/x-server-parsed-html(;.*)?");
+	/** Allow exec (normally blocked for security) */
+	protected boolean allowExec = false;
 
 
     //----------------- Public methods.
@@ -87,6 +89,8 @@ public class SSIFilter implements Filter {
         if (config.getInitParameter("expires") != null)
             expires = Long.valueOf(config.getInitParameter("expires"));
 
+        allowExec = Boolean.parseBoolean(config.getInitParameter("allowExec"));
+
         if (debug > 0)
             config.getServletContext().log(
                     "SSIFilter.init() SSI invoker started with 'debug'=" + debug);
@@ -125,7 +129,7 @@ public class SSIFilter implements Filter {
                 new SSIServletExternalResolver(config.getServletContext(), req,
                         res, isVirtualWebappRelative, debug, encoding);
             SSIProcessor ssiProcessor = new SSIProcessor(ssiExternalResolver,
-                    debug);
+                    debug, allowExec);
             
             // prepare readers/writers
             Reader reader =
diff --git a/java/org/apache/catalina/ssi/SSIProcessor.java b/java/org/apache/catalina/ssi/SSIProcessor.java
index 98c9f3753..6dd72a703 100644
--- a/java/org/apache/catalina/ssi/SSIProcessor.java
+++ b/java/org/apache/catalina/ssi/SSIProcessor.java
@@ -44,11 +44,14 @@ public class SSIProcessor {
     protected HashMap<String,SSICommand> commands =
         new HashMap<String,SSICommand>();
     protected int debug;
+    protected final boolean allowExec;
 
 
-    public SSIProcessor(SSIExternalResolver ssiExternalResolver, int debug) {
+    public SSIProcessor(SSIExternalResolver ssiExternalResolver, int debug,
+            boolean allowExec) {
         this.ssiExternalResolver = ssiExternalResolver;
         this.debug = debug;
+        this.allowExec = allowExec;
         addBuiltinCommands();
     }
 
@@ -56,7 +59,9 @@ public class SSIProcessor {
     protected void addBuiltinCommands() {
         addCommand("config", new SSIConfig());
         addCommand("echo", new SSIEcho());
-        addCommand("exec", new SSIExec());
+        if (allowExec) {
+            addCommand("exec", new SSIExec());
+        }
         addCommand("include", new SSIInclude());
         addCommand("flastmod", new SSIFlastmod());
         addCommand("fsize", new SSIFsize());
diff --git a/java/org/apache/catalina/ssi/SSIServlet.java b/java/org/apache/catalina/ssi/SSIServlet.java
index cc2b146bd..119a5aa28 100644
--- a/java/org/apache/catalina/ssi/SSIServlet.java
+++ b/java/org/apache/catalina/ssi/SSIServlet.java
@@ -56,6 +56,8 @@ public class SSIServlet extends HttpServlet {
     protected String inputEncoding = null;
     /** Output encoding. If not specified, uses platform default */
     protected String outputEncoding = "UTF-8";
+    /** Allow exec (normally blocked for security) */
+    protected boolean allowExec = false;
 
 
     //----------------- Public methods.
@@ -84,6 +86,9 @@ public class SSIServlet extends HttpServlet {
         if (getServletConfig().getInitParameter("outputEncoding") != null)
             outputEncoding = getServletConfig().getInitParameter("outputEncoding");
         
+        allowExec = Boolean.parseBoolean(
+                getServletConfig().getInitParameter("allowExec"));
+
         if (debug > 0)
             log("SSIServlet.init() SSI invoker started with 'debug'=" + debug);
 
@@ -181,7 +186,7 @@ public class SSIServlet extends HttpServlet {
             new SSIServletExternalResolver(getServletContext(), req, res,
                     isVirtualWebappRelative, debug, inputEncoding);
         SSIProcessor ssiProcessor = new SSIProcessor(ssiExternalResolver,
-                debug);
+                debug, allowExec);
         PrintWriter printWriter = null;
         StringWriter stringWriter = null;
         if (buffered) {
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 902f392bb..82e719493 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -60,6 +60,11 @@
         <bug>48297</bug>: Correctly initialise handler chain for web services
         resources. (markt)
       </fix>
+      <add>
+        <bug>48960</bug>: Add a new option to the SSI Servlet and SSI Filter to
+        allow the disabling of the <code>exec</code> command. This is now
+        disabled by default. Based on a patch by Yair Lenga. (markt)
+      </add>
       <fix>
         <bug>49030</bug>: When initializing/starting/stopping connectors and
         one of them fails, do not ignore the others. (markt/kkolinko)
diff --git a/webapps/docs/ssi-howto.xml b/webapps/docs/ssi-howto.xml
index 0479a8b51..3e8f5b21d 100644
--- a/webapps/docs/ssi-howto.xml
+++ b/webapps/docs/ssi-howto.xml
@@ -105,6 +105,8 @@ resources if one cannot be determined from the resource itself. Default is
 the default platform encoding.</li>
 <li><strong>outputEncoding</strong> - The encoding to be used for the result
 of the SSI processing. Default is UTF-8.</li>
+<li><strong>allowExec</strong> - Is the exec command enabled? Default is
+false.</li>
 </ul>
 </p>
 
@@ -128,6 +130,8 @@ evaluated for every request.</li>
 <li><strong>isVirtualWebappRelative</strong> - Should "virtual" SSI directive
 paths be interpreted as relative to the context root, instead of the server
 root? (0=false, 1=true) Default 0 (false).</li>
+<li><strong>allowExec</strong> - Is the exec command enabled? Default is
+false.</li>
 </ul>
 </p>
 
-- 
2.11.0