tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Marc Slemko <ma...@znep.com>
Subject Re: cvs commit: jakarta-tomcat-connectors/jk/native/common jk_uri_worker_map.c jk_uri_worker_map.h
Date Fri, 27 Jun 2003 17:01:16 GMT
On Fri, 27 Jun 2003, Henri Gomez wrote:

> If you want to be very secure, you sue Apache in front of Tomcat,
> and tomcats located on other machines.
>
> In such case you use ajp13, and with this configuration, I DIDN'T HAVE
> ANY PROBLEM with '//' since it's handle by tomcat (tested with 3.3.1a),
> since Apache web server couldn't read NON LOCAL DATAS isn't it ?
>
> The general rule for security is to make use of JkMount to ROOT :
>
> JkMount /webappx/servlet/ ajpworker
> JkMount /webappx/*.jsp    ajpworker
>
> Or JkMount /webappx/* ajpworker
>
>
> And in your jsp/servlet/..., you put ref to Apache handled element,
> like images, html in /images, /text, /xxxx, which are NOT in the
> /webappx scope and so will be server by Apache.

Thanks for the suggestion, it certainly is one option that can work
for some people in some situations.  However, it isn't a very good
general purpose solution for a variety of reasons, and certainly should
not be necessary.

> You seems very aware of Apache Internals and I reiterate our proposal
> (at least Remy and I), to provide fixes.

Enough with the attitude.  I'm just trying to point out specific
instances where things are not or may not be handled properly so
perhaps someone can fix them if they so desire.  I am making no
demands that anyone jump up and do so, nor blaming anyone for
anything, but simply pointing out what is broken and why.

Is it reallly the case around here that people don't want to hear about
specifics of bugs and security holes that impact a large percent of users
unless a patch is provided?

All I am doing is trying to make sure people are aware that the particular
case of a double '/' is only a subset of the more general issue that has
to be dealt with.  Your "if you don't like it go fix it yourself"
responses are not appreciated nor are they condusive to making people feel
welcome or in any mood to contribute anything.  I already said I don't
have time to do that right now, but will likely do so in the future if it
is still broken by the time I need it to work right.

---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org


Mime
View raw message