http://svn.apache.org/viewvc?view=rev&revision=782757 http://svn.apache.org/viewvc?view=rev&revision=783291 diff -Naur tomcat5-5.5.27/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/connector/Request.java tomcat5-5.5.27.oden/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/connector/Request.java --- tomcat5-5.5.27/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/connector/Request.java 2008-08-29 05:13:54.000000000 +0200 +++ tomcat5-5.5.27.oden/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/connector/Request.java 2009-06-18 19:02:41.000000000 +0200 @@ -1243,10 +1243,9 @@ int pos = requestPath.lastIndexOf('/'); String relative = null; if (pos >= 0) { - relative = RequestUtil.normalize - (requestPath.substring(0, pos + 1) + path); + relative = requestPath.substring(0, pos + 1) + path; } else { - relative = RequestUtil.normalize(requestPath + path); + relative = requestPath + path; } return (context.getServletContext().getRequestDispatcher(relative)); diff -Naur tomcat5-5.5.27/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/core/ApplicationContext.java tomcat5-5.5.27.oden/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/core/ApplicationContext.java --- tomcat5-5.5.27/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/core/ApplicationContext.java 2008-08-29 05:13:54.000000000 +0200 +++ tomcat5-5.5.27.oden/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/core/ApplicationContext.java 2009-06-18 19:02:41.000000000 +0200 @@ -43,6 +43,7 @@ import org.apache.catalina.Wrapper; import org.apache.catalina.deploy.ApplicationParameter; import org.apache.catalina.util.Enumerator; +import org.apache.catalina.util.RequestUtil; import org.apache.catalina.util.ResourceSet; import org.apache.catalina.util.ServerInfo; import org.apache.catalina.util.StringManager; @@ -388,7 +389,7 @@ path = path.substring(0, pos); } - path = normalize(path); + path = RequestUtil.normalize(path); if (path == null) return (null); @@ -475,7 +476,7 @@ throw new MalformedURLException(sm.getString("applicationContext.requestDispatcher.iae", path)); } - path = normalize(path); + path = RequestUtil.normalize(path); if (path == null) return (null); @@ -524,10 +525,13 @@ */ public InputStream getResourceAsStream(String path) { - path = normalize(path); if (path == null || !path.startsWith("/")) return (null); + path = RequestUtil.normalize(path); + if (path == null) + return null; + DirContext resources = context.getResources(); if (resources != null) { try { @@ -560,7 +564,7 @@ (sm.getString("applicationContext.resourcePaths.iae", path)); } - path = normalize(path); + path = RequestUtil.normalize(path); if (path == null) return (null); @@ -870,45 +874,6 @@ /** - * Return a context-relative path, beginning with a "/", that represents - * the canonical version of the specified path after ".." and "." elements - * are resolved out. If the specified path attempts to go outside the - * boundaries of the current context (i.e. too many ".." path elements - * are present), return <code>null</code> instead. - * - * @param path Path to be normalized - */ - private String normalize(String path) { - - if (path == null) { - return null; - } - - String normalized = path; - - // Normalize the slashes - if (normalized.indexOf('\\') >= 0) - normalized = normalized.replace('\\', '/'); - - // Resolve occurrences of "/../" in the normalized path - while (true) { - int index = normalized.indexOf("/../"); - if (index < 0) - break; - if (index == 0) - return (null); // Trying to go outside our context - int index2 = normalized.lastIndexOf('/', index - 1); - normalized = normalized.substring(0, index2) + - normalized.substring(index + 3); - } - - // Return the normalized path that we have completed - return (normalized); - - } - - - /** * Merge the context initialization parameters specified in the application * deployment descriptor with the application parameters described in the * server configuration, respecting the <code>override</code> property of diff -Naur tomcat5-5.5.27/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/core/ApplicationHttpRequest.java tomcat5-5.5.27.oden/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/core/ApplicationHttpRequest.java --- tomcat5-5.5.27/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/core/ApplicationHttpRequest.java 2008-08-29 05:13:54.000000000 +0200 +++ tomcat5-5.5.27.oden/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/core/ApplicationHttpRequest.java 2009-06-18 19:02:41.000000000 +0200 @@ -318,10 +318,9 @@ int pos = requestPath.lastIndexOf('/'); String relative = null; if (pos >= 0) { - relative = RequestUtil.normalize - (requestPath.substring(0, pos + 1) + path); + relative = requestPath.substring(0, pos + 1) + path; } else { - relative = RequestUtil.normalize(requestPath + path); + relative = requestPath + path; } return (context.getServletContext().getRequestDispatcher(relative)); diff -Naur tomcat5-5.5.27/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/servlets/WebdavServlet.java tomcat5-5.5.27.oden/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/servlets/WebdavServlet.java --- tomcat5-5.5.27/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/servlets/WebdavServlet.java 2008-08-29 05:13:56.000000000 +0200 +++ tomcat5-5.5.27.oden/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/servlets/WebdavServlet.java 2009-06-18 19:02:41.000000000 +0200 @@ -1362,76 +1362,6 @@ resp.setStatus(WebdavStatus.SC_NO_CONTENT); } - /** - * Return a context-relative path, beginning with a "/", that represents - * the canonical version of the specified path after ".." and "." elements - * are resolved out. If the specified path attempts to go outside the - * boundaries of the current context (i.e. too many ".." path elements - * are present), return <code>null</code> instead. - * - * @param path Path to be normalized - */ - protected String normalize(String path) { - if (path == null) { - return null; - } - - // Create a place for the normalized path - String normalized = path; - - if (normalized.equals("/.")) { - return "/"; - } - - // Normalize the slashes and add leading slash if necessary - if (normalized.indexOf('\\') >= 0) { - normalized = normalized.replace('\\', '/'); - } - - if (!normalized.startsWith("/")) { - normalized = "/" + normalized; - } - - // Resolve occurrences of "//" in the normalized path - while (true) { - int index = normalized.indexOf("//"); - if (index < 0) { - break; - } - normalized = normalized.substring(0, index) + - normalized.substring(index + 1); - } - - // Resolve occurrences of "/./" in the normalized path - while (true) { - int index = normalized.indexOf("/./"); - if (index < 0) { - break; - } - normalized = normalized.substring(0, index) + - normalized.substring(index + 2); - } - - // Resolve occurrences of "/../" in the normalized path - while (true) { - int index = normalized.indexOf("/../"); - if (index < 0) { - break; - } - if (index == 0) { - return (null); // Trying to go outside our context - } - - int index2 = normalized.lastIndexOf('/', index - 1); - normalized = normalized.substring(0, index2) + - normalized.substring(index + 3); - } - - // Return the normalized path that we have completed - return (normalized); - } - - // -------------------------------------------------------- Private Methods /** @@ -1582,7 +1512,7 @@ } // Normalise destination path (remove '.' and '..') - destinationPath = normalize(destinationPath); + destinationPath = RequestUtil.normalize(destinationPath); String contextPath = req.getContextPath(); if ((contextPath != null) && @@ -2323,7 +2253,8 @@ if (!toAppend.startsWith("/")) toAppend = "/" + toAppend; - generatedXML.writeText(rewriteUrl(normalize(absoluteUri + toAppend))); + generatedXML.writeText(rewriteUrl(RequestUtil.normalize( + absoluteUri + toAppend))); generatedXML.writeElement(null, "href", XMLWriter.CLOSING); diff -Naur tomcat5-5.5.27/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/ssi/SSIServletExternalResolver.java tomcat5-5.5.27.oden/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/ssi/SSIServletExternalResolver.java --- tomcat5-5.5.27/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/ssi/SSIServletExternalResolver.java 2008-08-29 05:13:56.000000000 +0200 +++ tomcat5-5.5.27.oden/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/ssi/SSIServletExternalResolver.java 2009-06-18 19:02:41.000000000 +0200 @@ -32,6 +32,7 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import org.apache.catalina.connector.Request; +import org.apache.catalina.util.RequestUtil; import org.apache.coyote.Constants; /** @@ -373,7 +374,7 @@ + pathWithoutContext); } String fullPath = prefix + path; - String retVal = SSIServletRequestUtil.normalize(fullPath); + String retVal = RequestUtil.normalize(fullPath); if (retVal == null) { throw new IOException("Normalization yielded null on path: " + fullPath); @@ -406,7 +407,7 @@ return new ServletContextAndPath(context, getAbsolutePath(virtualPath)); } else { - String normalized = SSIServletRequestUtil.normalize(virtualPath); + String normalized = RequestUtil.normalize(virtualPath); if (isVirtualWebappRelative) { return new ServletContextAndPath(context, normalized); } else { diff -Naur tomcat5-5.5.27/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/ssi/SSIServletRequestUtil.java tomcat5-5.5.27.oden/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/ssi/SSIServletRequestUtil.java --- tomcat5-5.5.27/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/ssi/SSIServletRequestUtil.java 2008-08-29 05:13:56.000000000 +0200 +++ tomcat5-5.5.27.oden/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/ssi/SSIServletRequestUtil.java 2009-06-18 19:02:41.000000000 +0200 @@ -48,7 +48,7 @@ if ((result == null) || (result.equals(""))) { result = "/"; } - return normalize(result); + return RequestUtil.normalize(result); } @@ -64,15 +64,9 @@ * * @param path * Path to be normalized + * @deprecated */ public static String normalize(String path) { - if (path == null) return null; - String normalized = path; - //Why doesn't RequestUtil do this?? - // Normalize the slashes and add leading slash if necessary - if (normalized.indexOf('\\') >= 0) - normalized = normalized.replace('\\', '/'); - normalized = RequestUtil.normalize(path); - return normalized; + return RequestUtil.normalize(path); } } diff -Naur tomcat5-5.5.27/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/util/RequestUtil.java tomcat5-5.5.27.oden/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/util/RequestUtil.java --- tomcat5-5.5.27/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/util/RequestUtil.java 2008-08-29 05:13:57.000000000 +0200 +++ tomcat5-5.5.27.oden/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/catalina/util/RequestUtil.java 2009-06-18 19:02:41.000000000 +0200 @@ -147,6 +147,19 @@ * @param path Relative path to be normalized */ public static String normalize(String path) { + return normalize(path, true); + } + + /** + * Normalize a relative URI path that may have relative values ("/./", + * "/../", and so on ) it it. <strong>WARNING</strong> - This method is + * useful only for normalizing application-generated paths. It does not + * try to perform security checks for malicious input. + * + * @param path Relative path to be normalized + * @param replaceBackSlash Should '\\' be replaced with '/' + */ + public static String normalize(String path, boolean replaceBackSlash) { if (path == null) return null; @@ -154,6 +167,9 @@ // Create a place for the normalized path String normalized = path; + if (replaceBackSlash && normalized.indexOf('\\') >= 0) + normalized = normalized.replace('\\', '/'); + if (normalized.equals("/.")) return "/"; diff -Naur tomcat5-5.5.27/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/naming/resources/FileDirContext.java tomcat5-5.5.27.oden/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/naming/resources/FileDirContext.java --- tomcat5-5.5.27/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/naming/resources/FileDirContext.java 2008-08-29 05:13:57.000000000 +0200 +++ tomcat5-5.5.27.oden/apache-tomcat-5.5.27-src/container/catalina/src/share/org/apache/naming/resources/FileDirContext.java 2009-06-18 19:02:41.000000000 +0200 @@ -771,46 +771,54 @@ */ protected String normalize(String path) { - String normalized = path; + if (path == null) + return null; - // Normalize the slashes and add leading slash if necessary - if (File.separatorChar == '\\' && normalized.indexOf('\\') >= 0) - normalized = normalized.replace('\\', '/'); - if (!normalized.startsWith("/")) - normalized = "/" + normalized; - - // Resolve occurrences of "//" in the normalized path - while (true) { - int index = normalized.indexOf("//"); - if (index < 0) - break; - normalized = normalized.substring(0, index) + - normalized.substring(index + 1); - } + // Create a place for the normalized path + String normalized = path; - // Resolve occurrences of "/./" in the normalized path - while (true) { - int index = normalized.indexOf("/./"); - if (index < 0) - break; - normalized = normalized.substring(0, index) + - normalized.substring(index + 2); - } + if (File.separatorChar == '\\' && normalized.indexOf('\\') >= 0) + normalized = normalized.replace('\\', '/'); - // Resolve occurrences of "/../" in the normalized path - while (true) { - int index = normalized.indexOf("/../"); - if (index < 0) - break; - if (index == 0) - return (null); // Trying to go outside our context - int index2 = normalized.lastIndexOf('/', index - 1); - normalized = normalized.substring(0, index2) + - normalized.substring(index + 3); - } + if (normalized.equals("/.")) + return "/"; + + // Add a leading "/" if necessary + if (!normalized.startsWith("/")) + normalized = "/" + normalized; + + // Resolve occurrences of "//" in the normalized path + while (true) { + int index = normalized.indexOf("//"); + if (index < 0) + break; + normalized = normalized.substring(0, index) + + normalized.substring(index + 1); + } + + // Resolve occurrences of "/./" in the normalized path + while (true) { + int index = normalized.indexOf("/./"); + if (index < 0) + break; + normalized = normalized.substring(0, index) + + normalized.substring(index + 2); + } + + // Resolve occurrences of "/../" in the normalized path + while (true) { + int index = normalized.indexOf("/../"); + if (index < 0) + break; + if (index == 0) + return (null); // Trying to go outside our context + int index2 = normalized.lastIndexOf('/', index - 1); + normalized = normalized.substring(0, index2) + + normalized.substring(index + 3); + } - // Return the normalized path that we have completed - return (normalized); + // Return the normalized path that we have completed + return (normalized); }