commit 5877390a9605f56d9bd6859a54ccbfb16374a78b

Author: Mark Thomas <markt@apache.org>

Date:   Wed May 16 14:56:34 2018 +0000

    Fix https://bz.apache.org/bugzilla/show_bug.cgi?id=62343

    Make CORS filter defaults more secure.

    This is the fix for CVE-2018-8014.

    git-svn-id: https://svn.apache.org/repos/asf/tomcat/tc7.0.x/trunk@1831730 13f79535-47bb-0310-9956-ffa450edef68

diff -up java/org/apache/catalina/filters/CorsFilter.java.orig java/org/apache/catalina/filters/CorsFilter.java

--- java/org/apache/catalina/filters/CorsFilter.java.orig	2019-02-28 16:37:12.512591576 -0500

+++ java/org/apache/catalina/filters/CorsFilter.java	2019-02-28 16:39:43.449141647 -0500

@@ -260,17 +260,14 @@ public class CorsFilter implements Filte

         // Section 6.1.3

         // Add a single Access-Control-Allow-Origin header.

-        if (anyOriginAllowed && !supportsCredentials) {

-            // If resource doesn't support credentials and if any origin is

-            // allowed

-            // to make CORS request, return header with '*'.

+        if (anyOriginAllowed) {

+            // If any origin is allowed, return header with '*'.

             response.addHeader(

                     CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,

                     "*");

         } else {

-            // If the resource supports credentials add a single

-            // Access-Control-Allow-Origin header, with the value of the Origin

-            // header as value.

+            // Add a single Access-Control-Allow-Origin header, with the value

+            // of the Origin header as value.

             response.addHeader(

                     CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,

                     origin);

@@ -799,6 +796,10 @@ public class CorsFilter implements Filte

                     .parseBoolean(supportsCredentials);

         }

+        if (this.supportsCredentials && this.anyOriginAllowed) {

+            throw new ServletException(sm.getString("corsFilter.invalidSupportsCredentials"));

+        }

+

         if (preflightMaxAge != null) {

             try {

                 if (!preflightMaxAge.isEmpty()) {

@@ -1156,7 +1156,7 @@ public class CorsFilter implements Filte

     /**

      * By default, all origins are allowed to make requests.

      */

-    public static final String DEFAULT_ALLOWED_ORIGINS = "*";

+    public static final String DEFAULT_ALLOWED_ORIGINS = "";

     /**

      * By default, following methods are supported: GET, POST, HEAD and OPTIONS.

@@ -1172,7 +1172,7 @@ public class CorsFilter implements Filte

     /**

      * By default, support credentials is turned on.

      */

-    public static final String DEFAULT_SUPPORTS_CREDENTIALS = "true";

+    public static final String DEFAULT_SUPPORTS_CREDENTIALS = "false";

     /**

      * By default, following headers are supported:

diff --git a/java/org/apache/catalina/filters/LocalStrings.properties b/java/org/apache/catalina/filters/LocalStrings.properties

index 5c4c792f82..921f101456 100644

--- java/org/apache/catalina/filters/LocalStrings.properties

+++ java/org/apache/catalina/filters/LocalStrings.properties

@@ -14,6 +14,8 @@

 # limitations under the License.

 addDefaultCharset.unsupportedCharset=Specified character set [{0}] is not supported

+

+corsFilter.invalidSupportsCredentials=It is not allowed to configure supportsCredentials=[true] when allowedOrigins=[*]

 corsFilter.invalidPreflightMaxAge=Unable to parse preflightMaxAge

 corsFilter.nullRequest=HttpServletRequest object is null

 corsFilter.nullRequestType=CORSRequestType object is null

diff --git a/test/org/apache/catalina/filters/TestCorsFilter.java b/test/org/apache/catalina/filters/TestCorsFilter.java

index 06634fbb57..47d520a08e 100644

--- test/org/apache/catalina/filters/TestCorsFilter.java

+++ test/org/apache/catalina/filters/TestCorsFilter.java

@@ -52,8 +52,7 @@ public class TestCorsFilter {

         corsFilter.doFilter(request, response, filterChain);

         Assert.assertTrue(response.getHeader(

-                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(

-                "https://www.apache.org"));

+                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals("*"));

         Assert.assertTrue(((Boolean) request.getAttribute(

                 CorsFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST)).booleanValue());

         Assert.assertTrue(request.getAttribute(

@@ -85,8 +84,7 @@ public class TestCorsFilter {

         corsFilter.doFilter(request, response, filterChain);

         Assert.assertTrue(response.getHeader(

-                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(

-                "https://www.apache.org"));

+                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals("*"));

         Assert.assertTrue(((Boolean) request.getAttribute(

                 CorsFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST)).booleanValue());

         Assert.assertTrue(request.getAttribute(

@@ -117,8 +115,7 @@ public class TestCorsFilter {

         corsFilter.doFilter(request, response, filterChain);

         Assert.assertTrue(response.getHeader(

-                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(

-                "https://www.apache.org"));

+                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals("*"));

         Assert.assertTrue(((Boolean) request.getAttribute(

                 CorsFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST)).booleanValue());

         Assert.assertTrue(request.getAttribute(

@@ -163,41 +160,15 @@ public class TestCorsFilter {

     }

     /**

-     * Tests the presence of the origin (and not '*') in the response, when

-     * supports credentials is enabled alongwith any origin, '*'.

+     * Tests the that supports credentials may not be enabled with any origin,

+     * '*'.

      *

-     * @throws IOException

      * @throws ServletException

      */

-    @Test

-    public void testDoFilterSimpleAnyOriginAndSupportsCredentials()

-            throws IOException, ServletException {

-        TesterHttpServletRequest request = new TesterHttpServletRequest();

-        request.setHeader(CorsFilter.REQUEST_HEADER_ORIGIN,

-                TesterFilterConfigs.HTTPS_WWW_APACHE_ORG);

-        request.setMethod("GET");

-        TesterHttpServletResponse response = new TesterHttpServletResponse();

-

+    @Test(expected=ServletException.class)

+    public void testDoFilterSimpleAnyOriginAndSupportsCredentials() throws ServletException {

         CorsFilter corsFilter = new CorsFilter();

-        corsFilter.init(TesterFilterConfigs

-                .getFilterConfigAnyOriginAndSupportsCredentials());

-        corsFilter.doFilter(request, response, filterChain);

-

-        Assert.assertTrue(response.getHeader(

-                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(

-                TesterFilterConfigs.HTTPS_WWW_APACHE_ORG));

-        Assert.assertTrue(response.getHeader(

-                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS)

-                .equals(

-                        "true"));

-        Assert.assertTrue(((Boolean) request.getAttribute(

-                CorsFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST)).booleanValue());

-        Assert.assertTrue(request.getAttribute(

-                CorsFilter.HTTP_REQUEST_ATTRIBUTE_ORIGIN).equals(

-                TesterFilterConfigs.HTTPS_WWW_APACHE_ORG));

-        Assert.assertTrue(request.getAttribute(

-                CorsFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE).equals(

-                CorsFilter.CORSRequestType.SIMPLE.name().toLowerCase(Locale.ENGLISH)));

+        corsFilter.init(TesterFilterConfigs.getFilterConfigAnyOriginAndSupportsCredentials());

     }

     /**

@@ -258,8 +229,7 @@ public class TestCorsFilter {

         corsFilter.doFilter(request, response, filterChain);

         Assert.assertTrue(response.getHeader(

-                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(

-                "https://www.apache.org"));

+                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals("*"));

         Assert.assertTrue(response.getHeader(

                 CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_EXPOSE_HEADERS)

                 .equals(TesterFilterConfigs.EXPOSED_HEADERS));

@@ -707,9 +677,8 @@ public class TestCorsFilter {

         corsFilter.init(null);

         corsFilter.doFilter(request, response, filterChain);

-        Assert.assertTrue(response.getHeader(

-                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(

-                "https://www.apache.org"));

+        Assert.assertNull(response.getHeader(

+                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN));

         Assert.assertTrue(((Boolean) request.getAttribute(

                 CorsFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST)).booleanValue());

         Assert.assertTrue(request.getAttribute(

@@ -1401,7 +1370,7 @@ public class TestCorsFilter {

         Assert.assertTrue(corsFilter.getAllowedOrigins().size() == 0);

         Assert.assertTrue(corsFilter.isAnyOriginAllowed());

         Assert.assertTrue(corsFilter.getExposedHeaders().size() == 0);

-        Assert.assertTrue(corsFilter.isSupportsCredentials());

+        Assert.assertFalse(corsFilter.isSupportsCredentials());

         Assert.assertTrue(corsFilter.getPreflightMaxAge() == 1800);

     }

@@ -1437,9 +1406,9 @@ public class TestCorsFilter {

         Assert.assertTrue(corsFilter.getAllowedHttpHeaders().size() == 6);

         Assert.assertTrue(corsFilter.getAllowedHttpMethods().size() == 4);

         Assert.assertTrue(corsFilter.getAllowedOrigins().size() == 0);

-        Assert.assertTrue(corsFilter.isAnyOriginAllowed());

+        Assert.assertFalse(corsFilter.isAnyOriginAllowed());

         Assert.assertTrue(corsFilter.getExposedHeaders().size() == 0);

-        Assert.assertTrue(corsFilter.isSupportsCredentials());

+        Assert.assertFalse(corsFilter.isSupportsCredentials());

         Assert.assertTrue(corsFilter.getPreflightMaxAge() == 1800);

     }

@@ -1543,8 +1512,7 @@ public class TestCorsFilter {

         corsFilter.doFilter(request, response, filterChain);

         Assert.assertTrue(response.getHeader(

-                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(

-                "https://www.apache.org"));

+                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals("*"));

         Assert.assertNull(request

                 .getAttribute(CorsFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST));

         Assert.assertNull(request

diff --git a/test/org/apache/catalina/filters/TesterFilterConfigs.java b/test/org/apache/catalina/filters/TesterFilterConfigs.java

index 941d8949d7..cb3d04f813 100644

--- test/org/apache/catalina/filters/TesterFilterConfigs.java

+++ test/org/apache/catalina/filters/TesterFilterConfigs.java

@@ -36,12 +36,13 @@ public class TesterFilterConfigs {

     public static final TesterServletContext mockServletContext =

             new TesterServletContext();

+    // Default config for the test is to allow any origin

     public static FilterConfig getDefaultFilterConfig() {

         final String allowedHttpHeaders =

                 CorsFilter.DEFAULT_ALLOWED_HTTP_HEADERS;

         final String allowedHttpMethods =

                 CorsFilter.DEFAULT_ALLOWED_HTTP_METHODS;

-        final String allowedOrigins = CorsFilter.DEFAULT_ALLOWED_ORIGINS;

+        final String allowedOrigins = ANY_ORIGIN;

         final String exposedHeaders = CorsFilter.DEFAULT_EXPOSED_HEADERS;

         final String supportCredentials =

                 CorsFilter.DEFAULT_SUPPORTS_CREDENTIALS;

@@ -59,7 +60,7 @@ public class TesterFilterConfigs {

                 CorsFilter.DEFAULT_ALLOWED_HTTP_HEADERS;

         final String allowedHttpMethods =

                 CorsFilter.DEFAULT_ALLOWED_HTTP_METHODS + ",PUT";

-        final String allowedOrigins = CorsFilter.DEFAULT_ALLOWED_ORIGINS;

+        final String allowedOrigins = ANY_ORIGIN;

         final String exposedHeaders = CorsFilter.DEFAULT_EXPOSED_HEADERS;

         final String supportCredentials = "true";

         final String preflightMaxAge =

@@ -77,7 +78,7 @@ public class TesterFilterConfigs {

                 CorsFilter.DEFAULT_ALLOWED_HTTP_HEADERS;

         final String allowedHttpMethods =

                 CorsFilter.DEFAULT_ALLOWED_HTTP_METHODS + ",PUT";

-        final String allowedOrigins = CorsFilter.DEFAULT_ALLOWED_ORIGINS;

+        final String allowedOrigins = ANY_ORIGIN;

         final String exposedHeaders = CorsFilter.DEFAULT_EXPOSED_HEADERS;

         final String supportCredentials = "false";

         final String preflightMaxAge =

@@ -131,7 +132,7 @@ public class TesterFilterConfigs {

                 CorsFilter.DEFAULT_ALLOWED_HTTP_HEADERS;

         final String allowedHttpMethods =

                 CorsFilter.DEFAULT_ALLOWED_HTTP_METHODS;

-        final String allowedOrigins = CorsFilter.DEFAULT_ALLOWED_ORIGINS;

+        final String allowedOrigins = ANY_ORIGIN;

         final String exposedHeaders = EXPOSED_HEADERS;

         final String supportCredentials =

                 CorsFilter.DEFAULT_SUPPORTS_CREDENTIALS;

@@ -240,7 +241,7 @@ public class TesterFilterConfigs {

                 CorsFilter.DEFAULT_ALLOWED_HTTP_HEADERS;

         final String allowedHttpMethods =

                 CorsFilter.DEFAULT_ALLOWED_HTTP_METHODS;

-        final String allowedOrigins = CorsFilter.DEFAULT_ALLOWED_ORIGINS;

+        final String allowedOrigins = ANY_ORIGIN;

         final String exposedHeaders = CorsFilter.DEFAULT_EXPOSED_HEADERS;

         final String supportCredentials =

                 CorsFilter.DEFAULT_SUPPORTS_CREDENTIALS;

diff -up webapps/docs/changelog.xml.orig webapps/docs/changelog.xml

--- webapps/docs/changelog.xml.orig	2019-02-28 16:33:00.254343407 -0500

+++ webapps/docs/changelog.xml	2019-02-28 16:33:24.135272232 -0500

@@ -78,6 +78,10 @@

         NonLoginAuthenticator has to be set for it to work (if no login method

         is specified). (remm)

       </fix>

+      <fix>

+        <bug>62343</bug>: Make CORS filter defaults more secure. This is the fix

+        for CVE-2018-8014. (markt)

+      </fix>

     </changelog>

   </subsection>

 </section>