tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From ma...@apache.org
Subject svn commit: r892612 - in /tomcat/trunk: java/org/apache/coyote/ajp/ java/org/apache/coyote/http11/ java/org/apache/tomcat/util/http/ java/org/apache/tomcat/util/http/res/ webapps/docs/config/
Date Sun, 20 Dec 2009 17:21:07 GMT
Author: markt
Date: Sun Dec 20 17:21:06 2009
New Revision: 892612

URL: http://svn.apache.org/viewvc?rev=892612&view=rev
Log:
Better fix for https://issues.apache.org/bugzilla/show_bug.cgi?id=47963

Added:
    tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings_ja.properties
      - copied, changed from r892604, tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings.properties
Modified:
    tomcat/trunk/java/org/apache/coyote/ajp/AjpAprProcessor.java
    tomcat/trunk/java/org/apache/coyote/ajp/AjpProcessor.java
    tomcat/trunk/java/org/apache/coyote/http11/AbstractOutputBuffer.java
    tomcat/trunk/java/org/apache/coyote/http11/InternalAprOutputBuffer.java
    tomcat/trunk/java/org/apache/tomcat/util/http/HttpMessages.java
    tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings.properties
    tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings_es.properties
    tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings_fr.properties
    tomcat/trunk/webapps/docs/config/systemprops.xml

Modified: tomcat/trunk/java/org/apache/coyote/ajp/AjpAprProcessor.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/coyote/ajp/AjpAprProcessor.java?rev=892612&r1=892611&r2=892612&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/coyote/ajp/AjpAprProcessor.java (original)
+++ tomcat/trunk/java/org/apache/coyote/ajp/AjpAprProcessor.java Sun Dec 20 17:21:06 2009
@@ -954,13 +954,12 @@
         // HTTP header contents
         responseHeaderMessage.appendInt(response.getStatus());
         String message = null;
-        if (org.apache.coyote.Constants.USE_CUSTOM_STATUS_MSG_IN_HEADER) {
+        if (org.apache.coyote.Constants.USE_CUSTOM_STATUS_MSG_IN_HEADER &&
+                HttpMessages.isSafeInHttpHeader(response.getMessage())) {
             message = response.getMessage();
         } 
         if (message == null){
             message = HttpMessages.getMessage(response.getStatus());
-        } else {
-            message = message.replace('\n', ' ').replace('\r', ' ');
         }
         if (message == null) {
             // mod_jk + httpd 2.x fails with a null status message - bug 45026

Modified: tomcat/trunk/java/org/apache/coyote/ajp/AjpProcessor.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/coyote/ajp/AjpProcessor.java?rev=892612&r1=892611&r2=892612&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/coyote/ajp/AjpProcessor.java (original)
+++ tomcat/trunk/java/org/apache/coyote/ajp/AjpProcessor.java Sun Dec 20 17:21:06 2009
@@ -959,13 +959,12 @@
         // HTTP header contents
         responseHeaderMessage.appendInt(response.getStatus());
         String message = null;
-        if (org.apache.coyote.Constants.USE_CUSTOM_STATUS_MSG_IN_HEADER) {
+        if (org.apache.coyote.Constants.USE_CUSTOM_STATUS_MSG_IN_HEADER &&
+                HttpMessages.isSafeInHttpHeader(response.getMessage())) {
             message = response.getMessage();
         }
         if (message == null){
             message = HttpMessages.getMessage(response.getStatus());
-        } else {
-            message = message.replace('\n', ' ').replace('\r', ' ');
         }
         if (message == null) {
             // mod_jk + httpd 2.x fails with a null status message - bug 45026

Modified: tomcat/trunk/java/org/apache/coyote/http11/AbstractOutputBuffer.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/coyote/http11/AbstractOutputBuffer.java?rev=892612&r1=892611&r2=892612&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/coyote/http11/AbstractOutputBuffer.java (original)
+++ tomcat/trunk/java/org/apache/coyote/http11/AbstractOutputBuffer.java Sun Dec 20 17:21:06
2009
@@ -339,13 +339,14 @@
 
         // Write message
         String message = null;
-        if (org.apache.coyote.Constants.USE_CUSTOM_STATUS_MSG_IN_HEADER) {
+        if (org.apache.coyote.Constants.USE_CUSTOM_STATUS_MSG_IN_HEADER &&
+                HttpMessages.isSafeInHttpHeader(response.getMessage())) {
             message = response.getMessage();
         }
         if (message == null) {
             write(HttpMessages.getMessage(status)); 
         } else {
-            write(message.replace('\n', ' ').replace('\r', ' '));
+            write(message);
         }
 
         // End the response status line

Modified: tomcat/trunk/java/org/apache/coyote/http11/InternalAprOutputBuffer.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/coyote/http11/InternalAprOutputBuffer.java?rev=892612&r1=892611&r2=892612&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/coyote/http11/InternalAprOutputBuffer.java (original)
+++ tomcat/trunk/java/org/apache/coyote/http11/InternalAprOutputBuffer.java Sun Dec 20 17:21:06
2009
@@ -414,13 +414,14 @@
 
         // Write message
         String message = null;
-        if (org.apache.coyote.Constants.USE_CUSTOM_STATUS_MSG_IN_HEADER) {
+        if (org.apache.coyote.Constants.USE_CUSTOM_STATUS_MSG_IN_HEADER &&
+                HttpMessages.isSafeInHttpHeader(response.getMessage())) {
             message = response.getMessage();
         }
         if (message == null) {
             write(HttpMessages.getMessage(status));
         } else {
-            write(message.replace('\n', ' ').replace('\r', ' '));
+            write(message);
         }
 
         // End the response status line

Modified: tomcat/trunk/java/org/apache/tomcat/util/http/HttpMessages.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/tomcat/util/http/HttpMessages.java?rev=892612&r1=892611&r2=892612&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/tomcat/util/http/HttpMessages.java (original)
+++ tomcat/trunk/java/org/apache/tomcat/util/http/HttpMessages.java Sun Dec 20 17:21:06 2009
@@ -104,4 +104,30 @@
         return (result.toString());
     }
 
+    /**
+     * Is the provided message safe to use in an HTTP header. Safe messages must
+     * meet the requirements of RFC2616 - i.e. must consist only of TEXT.
+     * 
+     * @param msg   The message to test
+     * @return      <code>true</code> if the message is safe to use in an HTTP
+     *              header else <code>false</code>
+     */
+    public static boolean isSafeInHttpHeader(String msg) {
+        // Nulls are fine. It is up to the calling code to address any NPE
+        // concerns
+        if (msg == null) {
+            return true;
+        }
+        
+        // TEXT is defined as OCTET excpet CTLs
+        // OCTET is defined as an 8-bit sequence of data
+        // CTL is defined as octets 0-31 and 127
+        for (char c : msg.toCharArray()) {
+            if (c > 255 || c < 32 || c == 127) {
+                return false;
+            }
+        }
+        
+        return true;
+    }
 }

Modified: tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings.properties
URL: http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings.properties?rev=892612&r1=892611&r2=892612&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings.properties (original)
+++ tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings.properties Sun Dec 20 17:21:06
2009
@@ -13,7 +13,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# HttpMessages
+# HttpMessages. The values in this file will be used in HTTP headers and as such
+# may only contain TEXT as defined by RFC 2616
 sc.100=Continue
 sc.101=Switching Protocols
 sc.200=OK

Modified: tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings_es.properties
URL: http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings_es.properties?rev=892612&r1=892611&r2=892612&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings_es.properties (original)
+++ tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings_es.properties Sun Dec 20
17:21:06 2009
@@ -13,7 +13,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# HttpMessages
+# HttpMessages. The values in this file will be used in HTTP headers and as such
+# may only contain TEXT as defined by RFC 2616
 sc.100=Continuar
 sc.101=Cambiando Protocolos
 sc.200=OK

Modified: tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings_fr.properties
URL: http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings_fr.properties?rev=892612&r1=892611&r2=892612&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings_fr.properties (original)
+++ tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings_fr.properties Sun Dec 20
17:21:06 2009
@@ -13,6 +13,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# HttpMessages. The values in this file will be used in HTTP headers and as such
+# may only contain TEXT as defined by RFC 2616
 sc.100=Continuer
 sc.101=Changement de Protocols
 sc.200=OK

Copied: tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings_ja.properties (from
r892604, tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings.properties)
URL: http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings_ja.properties?p2=tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings_ja.properties&p1=tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings.properties&r1=892604&r2=892612&rev=892612&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings.properties (original)
+++ tomcat/trunk/java/org/apache/tomcat/util/http/res/LocalStrings_ja.properties Sun Dec 20
17:21:06 2009
@@ -13,7 +13,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# HttpMessages
+# HttpMessages. The values in this file will be used in HTTP headers and as such
+# may only contain TEXT as defined by RFC 2616. Since Japanese language messages
+# do not meet this requirement, English text is used.
 sc.100=Continue
 sc.101=Switching Protocols
 sc.200=OK

Modified: tomcat/trunk/webapps/docs/config/systemprops.xml
URL: http://svn.apache.org/viewvc/tomcat/trunk/webapps/docs/config/systemprops.xml?rev=892612&r1=892611&r2=892612&view=diff
==============================================================================
--- tomcat/trunk/webapps/docs/config/systemprops.xml (original)
+++ tomcat/trunk/webapps/docs/config/systemprops.xml Sun Dec 20 17:21:06 2009
@@ -203,9 +203,11 @@
     <property
     name="org.apache.coyote. USE_CUSTOM_STATUS_MSG_IN_HEADER"><p>If this is
       <code>true</code> custom HTTP status messages will be used within HTTP
-      headers. Users must ensure that any such message is ISO-8859-1 encoded,
-      particularly if user provided input is included in the message, to prevent
-      a possible XSS vulnerability. If not specified the default value of
+      headers. If a custom message is specified that is not valid for use in an
+      HTTP header (as defined by RFC2616) then the custom message will be
+      ignored and the default message used. Note that there is some overhead
+      associated with the additional checking that is performed when custom
+      messages are used. If not specified the default value of
       <code>false</code> will be used.</p>
     </property>
 



---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org


Mime
View raw message