From fe145345e828791a943fae1fda627cb14e830458 Mon Sep 17 00:00:00 2001
From: markt <markt@13f79535-47bb-0310-9956-ffa450edef68>
Date: Tue, 27 Sep 2011 20:08:59 +0000
Subject: [PATCH] ContainerServlets are always restricted.

git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1176584 13f79535-47bb-0310-9956-ffa450edef68
---
 java/org/apache/catalina/core/DefaultInstanceManager.java | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/java/org/apache/catalina/core/DefaultInstanceManager.java b/java/org/apache/catalina/core/DefaultInstanceManager.java
index cb383cb1b..3b8eed30d 100644
--- a/java/org/apache/catalina/core/DefaultInstanceManager.java
+++ b/java/org/apache/catalina/core/DefaultInstanceManager.java
@@ -532,6 +532,10 @@ public class DefaultInstanceManager implements InstanceManager {
         if (Filter.class.isAssignableFrom(clazz)) {
             checkAccess(clazz, restrictedFilters);
         } else if (Servlet.class.isAssignableFrom(clazz)) {
+            if (ContainerServlet.class.isAssignableFrom(clazz)) {
+                throw new SecurityException("Restricted (ContainerServlet) " +
+                        clazz);
+            }
             checkAccess(clazz, restrictedServlets);
         } else {
             checkAccess(clazz, restrictedListeners);
-- 
2.11.0