null.
++ *
++ * @param name Normalized context-relative path (with leading '/')
++ * @param mustExist Must the specified resource exist?
++ */
++ protected File file(String name, boolean mustExist) {
++ if (name.equals("/")) {
++ name = "";
++ }
+
+ File file = new File(base, name);
+- if (file.exists() && file.canRead()) {
++ return validate(file, name, mustExist, absoluteBase, canonicalBase);
++ }
+
+- if (allowLinking)
+- return file;
+-
+- // Check that this file belongs to our root path
+- String canPath = null;
+- try {
+- canPath = file.getCanonicalPath();
+- } catch (IOException e) {
+- // Ignore
+- }
+- if (canPath == null)
+- return null;
+
+- // Check to see if going outside of the web application root
+- if (!canPath.startsWith(absoluteBase)) {
+- return null;
+- }
++ protected File validate(File file, String name, boolean mustExist, String absoluteBase,
++ String canonicalBase) {
+
+- // Case sensitivity check - this is now always done
+- String fileAbsPath = file.getAbsolutePath();
+- if (fileAbsPath.endsWith("."))
+- fileAbsPath = fileAbsPath + "/";
+- String absPath = normalize(fileAbsPath);
+- canPath = normalize(canPath);
+- if ((absoluteBase.length() < absPath.length())
+- && (absoluteBase.length() < canPath.length())) {
+- absPath = absPath.substring(absoluteBase.length() + 1);
+- if (absPath.equals(""))
+- absPath = "/";
+- canPath = canPath.substring(absoluteBase.length() + 1);
+- if (canPath.equals(""))
+- canPath = "/";
+- if (!canPath.equals(absPath))
+- return null;
+- }
++ // If the requested names ends in '/', the Java File API will return a
++ // matching file if one exists. This isn't what we want as it is not
++ // consistent with the Servlet spec rules for request mapping.
++ if (name.endsWith("/") && file.isFile()) {
++ return null;
++ }
+
+- } else {
++ // If the file/dir must exist but the identified file/dir can't be read
++ // then signal that the resource was not found
++ if (mustExist && !file.canRead()) {
++ return null;
++ }
++
++ // If allow linking is enabled, files are not limited to being located
++ // under the fileBase so all further checks are disabled.
++ if (allowLinking) {
++ return file;
++ }
++
++ // Additional Windows specific checks to handle known problems with
++ // File.getCanonicalPath()
++ if (JrePlatform.IS_WINDOWS && isInvalidWindowsFilename(name)) {
++ return null;
++ }
++
++ // Check that this file is located under the web application root
++ String canPath = null;
++ try {
++ canPath = file.getCanonicalPath();
++ } catch (IOException e) {
++ // Ignore
++ }
++ if (canPath == null || !canPath.startsWith(canonicalBase)) {
++ return null;
++ }
++
++ // Ensure that the file is not outside the fileBase. This should not be
++ // possible for standard requests (the request is normalized early in
++ // the request processing) but might be possible for some access via the
++ // Servlet API (RequestDispatcher etc.) therefore these checks are
++ // retained as an additional safety measure. absoluteBase has been
++ // normalized so absPath needs to be normalized as well.
++ String absPath = normalize(file.getAbsolutePath());
++ if ((absoluteBase.length() > absPath.length())) {
+ return null;
+ }
++
++ // Remove the fileBase location from the start of the paths since that
++ // was not part of the requested path and the remaining check only
++ // applies to the request path
++ absPath = absPath.substring(absoluteBase.length());
++ canPath = canPath.substring(canonicalBase.length());
++
++ // Case sensitivity check
++ // The normalized requested path should be an exact match the equivalent
++ // canonical path. If it is not, possible reasons include:
++ // - case differences on case insensitive file systems
++ // - Windows removing a trailing ' ' or '.' from the file name
++ //
++ // In all cases, a mis-match here results in the resource not being
++ // found
++ //
++ // absPath is normalized so canPath needs to be normalized as well
++ // Can't normalize canPath earlier as canonicalBase is not normalized
++ if (canPath.length() > 0) {
++ canPath = normalize(canPath);
++ }
++ if (!canPath.equals(absPath)) {
++ return null;
++ }
++
+ return file;
++ }
++
+
++ private boolean isInvalidWindowsFilename(String name) {
++ final int len = name.length();
++ if (len == 0) {
++ return false;
++ }
++ // This consistently ~10 times faster than the equivalent regular
++ // expression irrespective of input length.
++ for (int i = 0; i < len; i++) {
++ char c = name.charAt(i);
++ if (c == '\"' || c == '<' || c == '>') {
++ // These characters are disallowed in Windows file names and
++ // there are known problems for file names with these characters
++ // when using File#getCanonicalPath().
++ // Note: There are additional characters that are disallowed in
++ // Windows file names but these are not known to cause
++ // problems when using File#getCanonicalPath().
++ return true;
++ }
++ }
++ // Windows does not allow file names to end in ' ' unless specific low
++ // level APIs are used to create the files that bypass various checks.
++ // File names that end in ' ' are known to cause problems when using
++ // File#getCanonicalPath().
++ if (name.charAt(len -1) == ' ') {
++ return true;
++ }
++ return false;
+ }
+
+
+@@ -1054,10 +1161,10 @@
+ return super.getResourceType();
+ }
+
+-
++
+ /**
+ * Get canonical path.
+- *
++ *
+ * @return String the file's canonical path
+ */
+ @Override
+@@ -1071,10 +1178,6 @@
+ }
+ return canonicalPath;
+ }
+-
+-
+ }
+-
+-
+ }
+
+--- java/org/apache/naming/resources/VirtualDirContext.java.orig 2017-10-13 09:41:05.740302370 -0400
++++ java/org/apache/naming/resources/VirtualDirContext.java 2017-10-13 09:42:53.517701300 -0400
+@@ -76,7 +76,8 @@
+ * be listed twice.
+ *
+ *
+- * @param path
++ * @param path The set of file system paths and virtual paths to map them to
++ * in the required format
+ */
+ public void setExtraResourcePaths(String path) {
+ extraResourcePaths = path;
+@@ -106,13 +107,13 @@
+ }
+ path = resSpec.substring(0, idx);
+ }
+- String dir = resSpec.substring(idx + 1);
++ File dir = new File(resSpec.substring(idx + 1));
+ ListDefaultServlet when
++ determining if the current request is for custom error page or not.
++ (markt)
++ doGet() method irrespective of the method used for the
++ original request that triggered the error. (markt)
++ "". (markt)
++ Servlet.init is invoked.
+ */
+ protected static Class[] classType = new Class[]{ServletConfig.class};
+-
+-
++
++
+ /**
+- * Static class array used when the SecurityManager is turned on and
++ * Static class array used when the SecurityManager is turned on and
+ * Servlet.service is invoked.
+- */
++ */
+ @Deprecated
+ protected static Class[] classTypeUsedInService = new Class[]{
+ ServletRequest.class,
+ ServletResponse.class};
+-
++
+
+ private final ReentrantReadWriteLock parametersLock =
+ new ReentrantReadWriteLock();
+@@ -625,7 +619,7 @@ public class StandardWrapper extends Con
+ public String[] getServletMethods() throws ServletException {
+
+ instance = loadServlet();
+-
++
+ Class servletClazz = instance.getClass();
+ if (!javax.servlet.http.HttpServlet.class.isAssignableFrom(
+ servletClazz)) {
+@@ -665,8 +659,8 @@ public class StandardWrapper extends Con
+ public Servlet getServlet() {
+ return instance;
+ }
+-
+-
++
++
+ /**
+ * Set the associated servlet instance.
+ */
+@@ -675,13 +669,13 @@ public class StandardWrapper extends Con
+ instance = servlet;
+ }
+
+-
++
+ /**
+ * {@inheritDoc}
+ */
+ @Override
+ public void setServletSecurityAnnotationScanRequired(boolean b) {
+- this.servletSecurityAnnotationScanRequired = b;
++ // NO-OP
+ }
+
+ // --------------------------------------------------------- Public Methods
+@@ -695,19 +689,19 @@ public class StandardWrapper extends Con
+ @Override
+ public void backgroundProcess() {
+ super.backgroundProcess();
+-
++
+ if (!getState().isAvailable())
+ return;
+-
++
+ if (getServlet() != null && (getServlet() instanceof PeriodicEventListener)) {
+ ((PeriodicEventListener) getServlet()).periodicEvent();
+ }
+ }
+-
+-
++
++
+ /**
+ * Extract the root cause from a servlet exception.
+- *
++ *
+ * @param e The servlet exception
+ */
+ public static Throwable getRootCause(ServletException e) {
+@@ -836,7 +830,7 @@ public class StandardWrapper extends Con
+ }
+
+ boolean newInstance = false;
+-
++
+ // If not SingleThreadedModel, return the same instance every time
+ if (!singleThreadModel) {
+ // Load and initialize our instance if necessary
+@@ -1070,7 +1064,7 @@ public class StandardWrapper extends Con
+ @Override
+ public synchronized void load() throws ServletException {
+ instance = loadServlet();
+-
++
+ if (!instanceInitialized) {
+ initServlet(instance);
+ }
+@@ -1078,12 +1072,12 @@ public class StandardWrapper extends Con
+ if (isJspServlet) {
+ StringBuilder oname =
+ new StringBuilder(MBeanUtils.getDomain(getParent()));
+-
++
+ oname.append(":type=JspMonitor,name=");
+ oname.append(getName());
+-
++
+ oname.append(getWebModuleKeyProperties());
+-
++
+ try {
+ jspMonitorON = new ObjectName(oname.toString());
+ Registry.getRegistry(null, null)
+@@ -1161,8 +1155,6 @@ public class StandardWrapper extends Con
+ }
+ }
+
+- processServletSecurityAnnotation(servlet.getClass());
+-
+ // Special handling for ContainerServlet instances
+ if ((servlet instanceof ContainerServlet) &&
+ (isContainerProvidedServlet(servletClass) ||
+@@ -1205,44 +1197,13 @@ public class StandardWrapper extends Con
+ */
+ @Override
+ public void servletSecurityAnnotationScan() throws ServletException {
+- if (getServlet() == null) {
+- Class clazz = null;
+- try {
+- clazz = getParent().getLoader().getClassLoader().loadClass(
+- getServletClass());
+- processServletSecurityAnnotation(clazz);
+- } catch (ClassNotFoundException e) {
+- // Safe to ignore. No class means no annotations to process
+- }
+- } else {
+- if (servletSecurityAnnotationScanRequired) {
+- processServletSecurityAnnotation(getServlet().getClass());
+- }
+- }
++ // NO-OP
+ }
+
+- private void processServletSecurityAnnotation(Class clazz) {
+- // Calling this twice isn't harmful so no syncs
+- servletSecurityAnnotationScanRequired = false;
+-
+- Context ctxt = (Context) getParent();
+-
+- if (ctxt.getIgnoreAnnotations()) {
+- return;
+- }
+-
+- ServletSecurity secAnnotation =
+- clazz.getAnnotation(ServletSecurity.class);
+- if (secAnnotation != null) {
+- ctxt.addServletSecurity(
+- new ApplicationServletRegistration(this, ctxt),
+- new ServletSecurityElement(secAnnotation));
+- }
+- }
+
+ private synchronized void initServlet(Servlet servlet)
+ throws ServletException {
+-
++
+ if (instanceInitialized && !singleThreadModel) return;
+
+ // Call the initialization method of this servlet
+@@ -1454,12 +1415,12 @@ public class StandardWrapper extends Con
+ if (swallowOutput) {
+ SystemLogHandler.startCapture();
+ }
+-
++
+ // Call the servlet destroy() method
+ try {
+ instanceSupport.fireInstanceEvent
+ (InstanceEvent.BEFORE_DESTROY_EVENT, instance);
+-
++
+ if( Globals.IS_SECURITY_ENABLED) {
+ try {
+ SecurityUtil.doAsPrivilege("destroy",
+@@ -1470,7 +1431,7 @@ public class StandardWrapper extends Con
+ } else {
+ instance.destroy();
+ }
+-
++
+ instanceSupport.fireInstanceEvent
+ (InstanceEvent.AFTER_DESTROY_EVENT, instance);
+
+@@ -1701,7 +1662,7 @@ public class StandardWrapper extends Con
+ public boolean isAsyncSupported() {
+ return asyncSupported;
+ }
+-
++
+ @Override
+ public void setAsyncSupported(boolean asyncSupported) {
+ this.asyncSupported = asyncSupported;
+@@ -1711,7 +1672,7 @@ public class StandardWrapper extends Con
+ public boolean isEnabled() {
+ return enabled;
+ }
+-
++
+ @Override
+ public void setEnabled(boolean enabled) {
+ this.enabled = enabled;
+@@ -1787,24 +1748,24 @@ public class StandardWrapper extends Con
+ */
+ @Override
+ protected synchronized void startInternal() throws LifecycleException {
+-
+- // Send j2ee.state.starting notification
++
++ // Send j2ee.state.starting notification
+ if (this.getObjectName() != null) {
+- Notification notification = new Notification("j2ee.state.starting",
+- this.getObjectName(),
++ Notification notification = new Notification("j2ee.state.starting",
++ this.getObjectName(),
+ sequenceNumber++);
+ broadcaster.sendNotification(notification);
+ }
+-
++
+ // Start up this component
+ super.startInternal();
+
+ setAvailable(0L);
+
+- // Send j2ee.state.running notification
++ // Send j2ee.state.running notification
+ if (this.getObjectName() != null) {
+- Notification notification =
+- new Notification("j2ee.state.running", this.getObjectName(),
++ Notification notification =
++ new Notification("j2ee.state.running", this.getObjectName(),
+ sequenceNumber++);
+ broadcaster.sendNotification(notification);
+ }
+@@ -1823,15 +1784,15 @@ public class StandardWrapper extends Con
+ protected synchronized void stopInternal() throws LifecycleException {
+
+ setAvailable(Long.MAX_VALUE);
+-
+- // Send j2ee.state.stopping notification
++
++ // Send j2ee.state.stopping notification
+ if (this.getObjectName() != null) {
+- Notification notification =
+- new Notification("j2ee.state.stopping", this.getObjectName(),
++ Notification notification =
++ new Notification("j2ee.state.stopping", this.getObjectName(),
+ sequenceNumber++);
+ broadcaster.sendNotification(notification);
+ }
+-
++
+ // Shut down our servlet instance (if it has been initialized)
+ try {
+ unload();
+@@ -1843,43 +1804,43 @@ public class StandardWrapper extends Con
+ // Shut down this component
+ super.stopInternal();
+
+- // Send j2ee.state.stopped notification
++ // Send j2ee.state.stopped notification
+ if (this.getObjectName() != null) {
+- Notification notification =
+- new Notification("j2ee.state.stopped", this.getObjectName(),
++ Notification notification =
++ new Notification("j2ee.state.stopped", this.getObjectName(),
+ sequenceNumber++);
+ broadcaster.sendNotification(notification);
+ }
+-
+- // Send j2ee.object.deleted notification
+- Notification notification =
+- new Notification("j2ee.object.deleted", this.getObjectName(),
++
++ // Send j2ee.object.deleted notification
++ Notification notification =
++ new Notification("j2ee.object.deleted", this.getObjectName(),
+ sequenceNumber++);
+ broadcaster.sendNotification(notification);
+
+ }
+
+-
++
+ @Override
+ protected String getObjectNameKeyProperties() {
+
+ StringBuilder keyProperties =
+ new StringBuilder("j2eeType=Servlet,name=");
+-
++
+ String name = getName();
+ if (Util.objectNameValueNeedsQuote(name)) {
+ name = ObjectName.quote(name);
+ }
+ keyProperties.append(name);
+-
++
+ keyProperties.append(getWebModuleKeyProperties());
+
+ return keyProperties.toString();
+ }
+-
++
+
+ private String getWebModuleKeyProperties() {
+-
++
+ StringBuilder keyProperties = new StringBuilder(",WebModule=//");
+ String hostName = getParent().getParent().getName();
+ if (hostName == null) {
+@@ -1887,7 +1848,7 @@ public class StandardWrapper extends Con
+ } else {
+ keyProperties.append(hostName);
+ }
+-
++
+ String contextName = ((Context) getParent()).getName();
+ if (!contextName.startsWith("/")) {
+ keyProperties.append('/');
+@@ -1898,7 +1859,7 @@ public class StandardWrapper extends Con
+ if (parent instanceof StandardContext) {
+ ctx = (StandardContext) getParent();
+ }
+-
++
+ keyProperties.append(",J2EEApplication=");
+ if (ctx == null) {
+ keyProperties.append("none");
+@@ -1911,10 +1872,10 @@ public class StandardWrapper extends Con
+ } else {
+ keyProperties.append(ctx.getJ2EEServer());
+ }
+-
++
+ return keyProperties.toString();
+ }
+-
++
+
+ /**
+ * JSR 77. Always return false.
+@@ -1922,19 +1883,19 @@ public class StandardWrapper extends Con
+ public boolean isStateManageable() {
+ return false;
+ }
+-
+
+- /* Remove a JMX notificationListener
++
++ /* Remove a JMX notificationListener
+ * @see javax.management.NotificationEmitter#removeNotificationListener(javax.management.NotificationListener, javax.management.NotificationFilter, java.lang.Object)
+ */
+ @Override
+- public void removeNotificationListener(NotificationListener listener,
++ public void removeNotificationListener(NotificationListener listener,
+ NotificationFilter filter, Object object) throws ListenerNotFoundException {
+ broadcaster.removeNotificationListener(listener,filter,object);
+ }
+-
++
+ protected MBeanNotificationInfo[] notificationInfo;
+-
++
+ /* Get JMX Broadcaster Info
+ * @TODO use StringManager for international support!
+ * @TODO This two events we not send j2ee.state.failed and j2ee.attribute.changed!
+@@ -1949,7 +1910,7 @@ public class StandardWrapper extends Con
+ "j2ee.object.created"},
+ Notification.class.getName(),
+ "servlet is created"
+- ),
++ ),
+ new MBeanNotificationInfo(new String[] {
+ "j2ee.state.starting"},
+ Notification.class.getName(),
+@@ -1980,37 +1941,37 @@ public class StandardWrapper extends Con
+
+ return notificationInfo;
+ }
+-
+-
++
++
+ /* Add a JMX-NotificationListener
+ * @see javax.management.NotificationBroadcaster#addNotificationListener(javax.management.NotificationListener, javax.management.NotificationFilter, java.lang.Object)
+ */
+ @Override
+- public void addNotificationListener(NotificationListener listener,
++ public void addNotificationListener(NotificationListener listener,
+ NotificationFilter filter, Object object) throws IllegalArgumentException {
+ broadcaster.addNotificationListener(listener,filter,object);
+ }
+-
+-
++
++
+ /**
+- * Remove a JMX-NotificationListener
++ * Remove a JMX-NotificationListener
+ * @see javax.management.NotificationBroadcaster#removeNotificationListener(javax.management.NotificationListener)
+ */
+ @Override
+- public void removeNotificationListener(NotificationListener listener)
++ public void removeNotificationListener(NotificationListener listener)
+ throws ListenerNotFoundException {
+ broadcaster.removeNotificationListener(listener);
+ }
+-
+-
++
++
+ // ------------------------------------------------------------- Attributes
+-
+-
++
++
+ @Deprecated
+ public boolean isEventProvider() {
+ return false;
+ }
+-
++
+ @Deprecated
+ public boolean isStatisticsProvider() {
+ return false;
+diff -up java/org/apache/catalina/startup/ContextConfig.java.orig java/org/apache/catalina/startup/ContextConfig.java
+--- java/org/apache/catalina/startup/ContextConfig.java.orig 2019-02-28 15:41:52.580345992 -0500
++++ java/org/apache/catalina/startup/ContextConfig.java 2019-02-28 15:44:09.134930236 -0500
+@@ -433,15 +433,14 @@ public class ContextConfig implements Li
+ LoginConfig loginConfig = context.getLoginConfig();
+
+ SecurityConstraint constraints[] = context.findConstraints();
+- if (context.getIgnoreAnnotations() &&
+- (constraints == null || constraints.length ==0) &&
++ if ((constraints == null || constraints.length ==0) &&
+ !context.getPreemptiveAuthentication()) {
++ // No need for an authenticator
+ return;
+ } else {
+ if (loginConfig == null) {
+- // Not metadata-complete or security constraints present, need
+- // an authenticator to support @ServletSecurity annotations
+- // and/or constraints
++ // Security constraints present. Need an authenticator to
++ // support them.
+ loginConfig = DUMMY_LOGIN_CONFIG;
+ context.setLoginConfig(loginConfig);
+ }
+diff -up java/org/apache/catalina/startup/Tomcat.java.orig java/org/apache/catalina/startup/Tomcat.java
+--- java/org/apache/catalina/startup/Tomcat.java.orig 2019-02-28 15:44:09.135930233 -0500
++++ java/org/apache/catalina/startup/Tomcat.java 2019-02-28 15:47:52.376250650 -0500
+@@ -928,6 +928,9 @@ public class Tomcat {
+ Context context = (Context) event.getLifecycle();
+ if (event.getType().equals(Lifecycle.CONFIGURE_START_EVENT)) {
+ context.setConfigured(true);
++
++ // Process annotations
++ WebAnnotationSet.loadApplicationAnnotations(context);
+ }
+ // LoginConfig is required to process @ServletSecurity
+ // annotations
+diff -up java/org/apache/catalina/startup/WebAnnotationSet.java.orig java/org/apache/catalina/startup/WebAnnotationSet.java
+--- java/org/apache/catalina/startup/WebAnnotationSet.java.orig 2017-03-09 08:51:40.000000000 -0500
++++ java/org/apache/catalina/startup/WebAnnotationSet.java 2019-02-28 15:47:07.249388035 -0500
+@@ -23,10 +23,13 @@ import javax.annotation.Resource;
+ import javax.annotation.Resources;
+ import javax.annotation.security.DeclareRoles;
+ import javax.annotation.security.RunAs;
++import javax.servlet.ServletSecurityElement;
++import javax.servlet.annotation.ServletSecurity;
+
+ import org.apache.catalina.Container;
+ import org.apache.catalina.Context;
+ import org.apache.catalina.Wrapper;
++import org.apache.catalina.core.ApplicationServletRegistration;
+ import org.apache.catalina.deploy.ContextEnvironment;
+ import org.apache.catalina.deploy.ContextResource;
+ import org.apache.catalina.deploy.ContextResourceEnvRef;
+@@ -143,9 +146,17 @@ public class WebAnnotationSet {
+ * Ref JSR 250, equivalent to the run-as element in
+ * the deployment descriptor
+ */
+- RunAs annotation = classClass.getAnnotation(RunAs.class);
+- if (annotation != null) {
+- wrapper.setRunAs(annotation.value());
++ RunAs runAs = classClass.getAnnotation(RunAs.class);
++ if (runAs != null) {
++ wrapper.setRunAs(runAs.value());
++ }
++
++ // Process ServletSecurity annotation
++ ServletSecurity servletSecurity = classClass.getAnnotation(ServletSecurity.class);
++ if (servletSecurity != null) {
++ context.addServletSecurity(
++ new ApplicationServletRegistration(wrapper, context),
++ new ServletSecurityElement(servletSecurity));
+ }
+ }
+ }
+diff -up java/org/apache/catalina/Wrapper.java.orig java/org/apache/catalina/Wrapper.java
+--- java/org/apache/catalina/Wrapper.java.orig 2019-02-28 15:41:52.554346071 -0500
++++ java/org/apache/catalina/Wrapper.java 2019-02-28 15:44:09.129930251 -0500
+@@ -370,19 +370,23 @@ public interface Wrapper extends Contain
+ public void setEnabled(boolean enabled);
+
+ /**
+- * Set the flag that indicates
+- * {@link javax.servlet.annotation.ServletSecurity} annotations must be
+- * scanned when the Servlet is first used.
++ * This method is no longer used. All implementations should be NO-OPs.
+ *
+- * @param b The new value of the flag
++ * @param b Unused.
++ *
++ * @deprecated This will be removed in Tomcat 9.
+ */
++ @Deprecated
+ public void setServletSecurityAnnotationScanRequired(boolean b);
+
+ /**
+- * Scan for (if necessary) and process (if found) the
+- * {@link javax.servlet.annotation.ServletSecurity} annotations for the
+- * Servlet associated with this wrapper.
++ * This method is no longer used. All implementations should be NO-OPs.
++ *
++ * @throws ServletException Never thrown
++ *
++ * @deprecated This will be removed in Tomcat 9.
+ */
++ @Deprecated
+ public void servletSecurityAnnotationScan() throws ServletException;
+
+ /**
+diff -up webapps/docs/changelog.xml.orig webapps/docs/changelog.xml
+--- webapps/docs/changelog.xml.orig 2019-02-28 15:41:52.591345958 -0500
++++ webapps/docs/changelog.xml 2019-02-28 15:44:09.142930212 -0500
+@@ -68,6 +68,11 @@
+ "". (markt)
+
++ ServletSecurity annotations at web application
++ start rather than at servlet load time to ensure constraints are applied
++ consistently. (markt)
++ org.apache.tomcat.websocket.SSL_TRUSTSTORE_PWDThe default truststore password is changeit.
If the org.apache.tomcat.websocket.SSL_CONTEXT property is
+- set then the org.apache.tomcat.websocket.SSL_TRUSTSTORE and
+- org.apache.tomcat.websocket.SSL_TRUSTSTORE_PWD properties
+- will be ignored.
If the org.apache.tomcat.websocket.SSL_CONTEXT property is
++ set then the org.apache.tomcat.websocket.SSL_TRUSTSTORE and
++ org.apache.tomcat.websocket.SSL_TRUSTSTORE_PWD properties
++ will be ignored.
For secure server end points, host name verification is enabled by default.
++ To bypass this verification (not recommended), it is necessary to provide a
++ custom SSLContext via the
++ org.apache.tomcat.websocket.SSL_CONTEXT user property. The
++ custom SSLContext must be configured with a custom
++ TrustManager that extends
++ javax.net.ssl.X509ExtendedTrustManager. The desired verification
++ (or lack of verification) can then be controlled by appropriate
++ implementations of the individual abstract methods.
true if the start matches
++ */
+ public boolean startsWithIgnoreCase(String s, int pos) {
+ byte[] b = buff;
+ int len = s.length();
+diff -up java/org/apache/tomcat/util/http/parser/HttpParser.java.orig java/org/apache/tomcat/util/http/parser/HttpParser.java
+--- java/org/apache/tomcat/util/http/parser/HttpParser.java.orig 2017-03-09 08:51:41.000000000 -0500
++++ java/org/apache/tomcat/util/http/parser/HttpParser.java 2019-03-05 14:58:20.291295916 -0500
+@@ -67,9 +67,17 @@ public class HttpParser {
+ private static final boolean[] IS_SEPARATOR = new boolean[ARRAY_SIZE];
+ private static final boolean[] IS_TOKEN = new boolean[ARRAY_SIZE];
+ private static final boolean[] IS_HEX = new boolean[ARRAY_SIZE];
+- private static final boolean[] IS_NOT_REQUEST_TARGET = new boolean[ARRAY_SIZE];
+ private static final boolean[] IS_HTTP_PROTOCOL = new boolean[ARRAY_SIZE];
++ private static final boolean[] IS_ALPHA = new boolean[ARRAY_SIZE];
++ private static final boolean[] IS_NUMERIC = new boolean[ARRAY_SIZE];
+ private static final boolean[] REQUEST_TARGET_ALLOW = new boolean[ARRAY_SIZE];
++ private static final boolean[] IS_UNRESERVED = new boolean[ARRAY_SIZE];
++ private static final boolean[] IS_SUBDELIM = new boolean[ARRAY_SIZE];
++ private static final boolean[] IS_USERINFO = new boolean[ARRAY_SIZE];
++ private static final boolean[] IS_RELAXABLE = new boolean[ARRAY_SIZE];
++
++ private static final HttpParser DEFAULT;
++
+
+ static {
+ // Digest field types.
+@@ -91,19 +99,6 @@ public class HttpParser {
+ // RFC2617 says nc is 8LHEX. <">8LHEX<"> will also be accepted
+ fieldTypes.put("nc", FIELD_TYPE_LHEX);
+
+- String prop = System.getProperty("tomcat.util.http.parser.HttpParser.requestTargetAllow");
+- if (prop != null) {
+- for (int i = 0; i < prop.length(); i++) {
+- char c = prop.charAt(i);
+- if (c == '{' || c == '}' || c == '|') {
+- REQUEST_TARGET_ALLOW[c] = true;
+- } else {
+- log.warn(sm.getString("httpparser.invalidRequestTargetCharacter",
+- Character.valueOf(c)));
+- }
+- }
+- }
+-
+ for (int i = 0; i < ARRAY_SIZE; i++) {
+ // Control> 0-31, 127
+ if (i < 32 || i == 127) {
+@@ -128,6 +123,67 @@ public class HttpParser {
+ IS_HEX[i] = true;
+ }
+
++ // Not valid for HTTP protocol
++ // "HTTP/" DIGIT "." DIGIT
++ if (i == 'H' || i == 'T' || i == 'P' || i == '/' || i == '.' || (i >= '0' && i <= '9')) {
++ IS_HTTP_PROTOCOL[i] = true;
++ }
++
++ if (i >= '0' && i <= '9') {
++ IS_NUMERIC[i] = true;
++ }
++
++ if (i >= 'a' && i <= 'z' || i >= 'A' && i <= 'Z') {
++ IS_ALPHA[i] = true;
++ }
++
++ if (IS_ALPHA[i] || IS_NUMERIC[i] || i == '-' || i == '.' || i == '_' || i == '~') {
++ IS_UNRESERVED[i] = true;
++ }
++
++ if (i == '!' || i == '$' || i == '&' || i == '\'' || i == '(' || i == ')' || i == '*' ||
++ i == '+' || i == ',' || i == ';' || i == '=') {
++ IS_SUBDELIM[i] = true;
++ }
++
++ // userinfo = *( unreserved / pct-encoded / sub-delims / ":" )
++ if (IS_UNRESERVED[i] || i == '%' || IS_SUBDELIM[i] || i == ':') {
++ IS_USERINFO[i] = true;
++ }
++
++ // The characters that are normally not permitted for which the
++ // restrictions may be relaxed when used in the path and/or query
++ // string
++ if (i == '\"' || i == '<' || i == '>' || i == '[' || i == '\\' || i == ']' ||
++ i == '^' || i == '`' || i == '{' || i == '|' || i == '}') {
++ IS_RELAXABLE[i] = true;
++ }
++ }
++
++ String prop = System.getProperty("tomcat.util.http.parser.HttpParser.requestTargetAllow");
++ if (prop != null) {
++ for (int i = 0; i < prop.length(); i++) {
++ char c = prop.charAt(i);
++ if (c == '{' || c == '}' || c == '|') {
++ REQUEST_TARGET_ALLOW[c] = true;
++ } else {
++ log.warn(sm.getString("http.invalidRequestTargetCharacter",
++ Character.valueOf(c)));
++ }
++ }
++ }
++
++ DEFAULT = new HttpParser(null, null);
++ }
++
++
++ private final boolean[] IS_NOT_REQUEST_TARGET = new boolean[ARRAY_SIZE];
++ private final boolean[] IS_ABSOLUTEPATH_RELAXED = new boolean[ARRAY_SIZE];
++ private final boolean[] IS_QUERY_RELAXED = new boolean[ARRAY_SIZE];
++
++
++ public HttpParser(String relaxedPathChars, String relaxedQueryChars) {
++ for (int i = 0; i < ARRAY_SIZE; i++) {
+ // Not valid for request target.
+ // Combination of multiple rules from RFC7230 and RFC 3986. Must be
+ // ASCII, no controls plus a few additional characters excluded
+@@ -139,12 +195,29 @@ public class HttpParser {
+ }
+ }
+
+- // Not valid for HTTP protocol
+- // "HTTP/" DIGIT "." DIGIT
+- if (i == 'H' || i == 'T' || i == 'P' || i == '/' || i == '.' || (i >= '0' && i <= '9')) {
+- IS_HTTP_PROTOCOL[i] = true;
++ /*
++ * absolute-path = 1*( "/" segment )
++ * segment = *pchar
++ * pchar = unreserved / pct-encoded / sub-delims / ":" / "@"
++ *
++ * Note pchar allows everything userinfo allows plus "@"
++ */
++ if (IS_USERINFO[i] || i == '@' || i == '/' || REQUEST_TARGET_ALLOW[i]) {
++ IS_ABSOLUTEPATH_RELAXED[i] = true;
++ }
++
++ /*
++ * query = *( pchar / "/" / "?" )
++ *
++ * Note query allows everything absolute-path allows plus "?"
++ */
++ if (IS_ABSOLUTEPATH_RELAXED[i] || i == '?' || REQUEST_TARGET_ALLOW[i]) {
++ IS_QUERY_RELAXED[i] = true;
+ }
+ }
++
++ relax(IS_ABSOLUTEPATH_RELAXED, relaxedPathChars);
++ relax(IS_QUERY_RELAXED, relaxedQueryChars);
+ }
+
+ /**
+@@ -277,6 +350,39 @@ public class HttpParser {
+ }
+
+
++ public boolean isNotRequestTargetRelaxed(int c) {
++ // Fast for valid request target characters, slower for some incorrect
++ // ones
++ try {
++ return IS_NOT_REQUEST_TARGET[c];
++ } catch (ArrayIndexOutOfBoundsException ex) {
++ return true;
++ }
++ }
++
++
++ public boolean isAbsolutePathRelaxed(int c) {
++ // Fast for valid user info characters, slower for some incorrect
++ // ones
++ try {
++ return IS_ABSOLUTEPATH_RELAXED[c];
++ } catch (ArrayIndexOutOfBoundsException ex) {
++ return false;
++ }
++ }
++
++
++ public boolean isQueryRelaxed(int c) {
++ // Fast for valid user info characters, slower for some incorrect
++ // ones
++ try {
++ return IS_QUERY_RELAXED[c];
++ } catch (ArrayIndexOutOfBoundsException ex) {
++ return false;
++ }
++ }
++
++
+ public static String unquote(String input) {
+ if (input == null || input.length() < 2) {
+ return input;
+@@ -329,27 +435,53 @@ public class HttpParser {
+
+
+ public static boolean isNotRequestTarget(int c) {
+- // Fast for valid request target characters, slower for some incorrect
++ return DEFAULT.isNotRequestTargetRelaxed(c);
++ }
++
++
++ public static boolean isHttpProtocol(int c) {
++ // Fast for valid HTTP protocol characters, slower for some incorrect
+ // ones
+ try {
+- return IS_NOT_REQUEST_TARGET[c];
++ return IS_HTTP_PROTOCOL[c];
+ } catch (ArrayIndexOutOfBoundsException ex) {
+- return true;
++ return false;
+ }
+ }
+
+
+- public static boolean isHttpProtocol(int c) {
+- // Fast for valid HTTP protocol characters, slower for some incorrect
++ public static boolean isUserInfo(int c) {
++ // Fast for valid user info characters, slower for some incorrect
+ // ones
+ try {
+- return IS_HTTP_PROTOCOL[c];
++ return IS_USERINFO[c];
++ } catch (ArrayIndexOutOfBoundsException ex) {
++ return false;
++ }
++ }
++
++
++ private static boolean isRelaxable(int c) {
++ // Fast for valid user info characters, slower for some incorrect
++ // ones
++ try {
++ return IS_RELAXABLE[c];
+ } catch (ArrayIndexOutOfBoundsException ex) {
+ return false;
+ }
+ }
+
+
++ public static boolean isAbsolutePath(int c) {
++ return DEFAULT.isAbsolutePathRelaxed(c);
++ }
++
++
++ public static boolean isQuery(int c) {
++ return DEFAULT.isQueryRelaxed(c);
++ }
++
++
+ // Skip any LWS and return the next char
+ private static int skipLws(StringReader input, boolean withReset)
+ throws IOException {
+@@ -579,6 +711,18 @@ public class HttpParser {
+ }
+ }
+
++ private void relax(boolean[] flags, String relaxedChars) {
++ if (relaxedChars != null && relaxedChars.length() > 0) {
++ char[] chars = relaxedChars.toCharArray();
++ for (char c : chars) {
++ if (isRelaxable(c)) {
++ flags[c] = true;
++ IS_NOT_REQUEST_TARGET[c] = false;
++ }
++ }
++ }
++ }
++
+ private static enum SkipConstantResult {
+ FOUND,
+ NOT_FOUND,
+diff -up conf/catalina.properties.orig conf/catalina.properties
+--- conf/catalina.properties.orig 2019-03-05 12:13:51.934329862 -0500
++++ conf/catalina.properties 2019-03-05 12:14:08.094279997 -0500
+@@ -132,6 +132,9 @@ tomcat.util.buf.StringCache.byte.enabled
+ #tomcat.util.buf.StringCache.trainThreshold=500000
+ #tomcat.util.buf.StringCache.cacheSize=5000
+
++# This system property is deprecated. Use the relaxedPathChars relaxedQueryChars
++# attributes of the Connector instead. These attributes permit a wider range of
++# characters to be configured as valid.
+ # Allow for changes to HTTP request validation
+-# WARNING: Using this option will expose the server to CVE-2016-6816
++# WARNING: Using this option may expose the server to CVE-2016-6816
+ #tomcat.util.http.parser.HttpParser.requestTargetAllow=|
+diff -up webapps/docs/changelog.xml.orig webapps/docs/changelog.xml
+--- webapps/docs/changelog.xml.orig 2019-03-05 12:13:47.068344877 -0500
++++ webapps/docs/changelog.xml 2019-03-05 12:14:08.103279970 -0500
+@@ -108,6 +108,12 @@
+ Improve handing of overflow in the UTF-8 decoder with supplementary
+ characters. (markt)
+
++ The HTTP/1.1
++ specification requires that certain characters are %nn encoded when
++ used in URI paths. Unfortunately, many user agents including all the major
++ browsers are not compliant with this specification and use these
++ characters in unencoded form. To prevent Tomcat rejecting such requests,
++ this attribute may be used to specify the additional characters to allow.
++ If not specified, no addtional characters will be allowed. The value may
++ be any combination of the following characters:
++ " < > [ \ ] ^ ` { | } . Any other characters
++ present in the value will be ignored.
The HTTP/1.1
++ specification requires that certain characters are %nn encoded when
++ used in URI query strings. Unfortunately, many user agents including all
++ the major browsers are not compliant with this specification and use these
++ characters in unencoded form. To prevent Tomcat rejecting such requests,
++ this attribute may be used to specify the additional characters to allow.
++ If not specified, no addtional characters will be allowed. The value may
++ be any combination of the following characters:
++ " < > [ \ ] ^ ` { | } . Any other characters
++ present in the value will be ignored.
The value is a regular expression (using This system property is deprecated. Use the
++ A string comprised of characters the server should allow even when they are not encoded.
+ These characters would normally result in a 400 status. The acceptable characters for this property are: WARNING: Use of this option will expose the server to CVE-2016-6816.
++ WARNING: Use of this option may expose the server to CVE-2016-6816.
+ If not specified, the default value of java.util.regex)
+ matching the user-agent header of HTTP clients for which
+diff -up webapps/docs/config/systemprops.xml.orig webapps/docs/config/systemprops.xml
+--- webapps/docs/config/systemprops.xml.orig 2019-03-05 12:14:08.104279967 -0500
++++ webapps/docs/config/systemprops.xml 2019-03-05 12:16:02.075928285 -0500
+@@ -709,11 +709,15 @@
+
+
+ relaxedPathChars and relaxedQueryChars
++ attributes of the Connector instead. These attributes permit a wider range
++ of characters to be configured as valid.|, {
+ , and }null will be used.
OK
")); diff --git a/SOURCES/tomcat-7.0.76-rhbz-1588703.patch b/SOURCES/tomcat-7.0.76-rhbz-1588703.patch new file mode 100644 index 0000000..3834dd2 --- /dev/null +++ b/SOURCES/tomcat-7.0.76-rhbz-1588703.patch @@ -0,0 +1,39 @@ +commit 7f474ba097347fbe4c3db776b46eef59a587c0aa +Author: Coty Sutherland