File tomcat-8.0-hardening_getResources.patch of Package tomcat.28070

Overview Repositories Revisions Requests Users Attributes Meta

File tomcat-8.0-hardening_getResources.patch of Package tomcat.28070

From 530108cb568ba7bb51594d0ecfc2421db2e4bf53 Mon Sep 17 00:00:00 2001
From: Mark Thomas <markt@apache.org>
Date: Wed, 30 Mar 2022 20:22:49 +0100
Subject: [PATCH] Security hardening. Deprecate getResources() and always
 return null.

This method is never used by Tomcat. If something accidently exposes the
class loader then this method can be used to gain access to Tomcat
internals.
---
 java/org/apache/catalina/loader/WebappClassLoaderBase.java | 7 ++++++-
 webapps/docs/changelog.xml                                 | 6 ++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

Index: apache-tomcat-8.0.53-src/java/org/apache/catalina/loader/WebappClassLoaderBase.java
===================================================================
--- apache-tomcat-8.0.53-src.orig/java/org/apache/catalina/loader/WebappClassLoaderBase.java
+++ apache-tomcat-8.0.53-src/java/org/apache/catalina/loader/WebappClassLoaderBase.java
@@ -428,10 +428,15 @@ public abstract class WebappClassLoaderB
     // ------------------------------------------------------------- Properties
 
     /**
+     * Unused. Always returns {@code null}.
+     *
      * Get associated resources.
+     *
+     * @deprecated This will be removed in Tomcat 10.1.x onwards
      */
+    @Deprecated
     public WebResourceRoot getResources() {
-        return this.resources;
+        return null;
     }
 
 
Index: apache-tomcat-8.0.53-src/webapps/docs/changelog.xml
===================================================================
--- apache-tomcat-8.0.53-src.orig/webapps/docs/changelog.xml
+++ apache-tomcat-8.0.53-src/webapps/docs/changelog.xml
@@ -150,6 +150,12 @@
         <bug>65224</bug>: Ensure the correct escaping of attribute values and
         search filters in the JNDIRealm. (markt)
       </fix>
+      <add>
+         Effectively disable the
+         <code>WebappClassLoaderBase.getResources()</code> method as it is not
+         used and if something accidently exposes the class loader this method
+         can be used to gain access to Tomcat internals. (markt)
+      </add>
     </changelog>
   </subsection>
   <subsection name="Coyote">

Places

File tomcat-8.0-hardening_getResources.patch of Package tomcat.28070

Places