File tomcat-9.0-hardening_getResources.patch of Package tomcat.28016

Overview Repositories Revisions Requests Users Attributes Meta

File tomcat-9.0-hardening_getResources.patch of Package tomcat.28016

From 8a904f6065080409a1e00606cd7bceec6ad8918c Mon Sep 17 00:00:00 2001
From: Mark Thomas <markt@apache.org>
Date: Wed, 30 Mar 2022 20:22:49 +0100
Subject: [PATCH] Security hardening. Deprecate getResources() and always
 return null.

This method is never used by Tomcat. If something accidently exposes the
class loader then this method can be used to gain access to Tomcat
internals.
---
 .../apache/catalina/loader/WebappClassLoaderBase.java  |  7 ++++++-
 webapps/docs/changelog.xml                             | 10 ++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)
Index: apache-tomcat-9.0.43-src/java/org/apache/catalina/loader/WebappClassLoaderBase.java
===================================================================
--- apache-tomcat-9.0.43-src.orig/java/org/apache/catalina/loader/WebappClassLoaderBase.java
+++ apache-tomcat-9.0.43-src/java/org/apache/catalina/loader/WebappClassLoaderBase.java
@@ -425,10 +425,15 @@ public abstract class WebappClassLoaderB
     // ------------------------------------------------------------- Properties
 
     /**
+     * Unused. Always returns {@code null}.
+     *
      * @return associated resources.
+     *
+     * @deprecated This will be removed in Tomcat 10.1.x onwards
      */
+    @Deprecated
     public WebResourceRoot getResources() {
-        return this.resources;
+        return null;
     }
 
 
Index: apache-tomcat-9.0.43-src/webapps/docs/changelog.xml
===================================================================
--- apache-tomcat-9.0.43-src.orig/webapps/docs/changelog.xml
+++ apache-tomcat-9.0.43-src/webapps/docs/changelog.xml
@@ -106,6 +106,12 @@
 <section name="Tomcat 9.0.43 (markt)">
   <subsection name="Catalina">
     <changelog>
+      <add>
+         Effectively disable the
+         <code>WebappClassLoaderBase.getResources()</code> method as it is not
+         used and if something accidently exposes the class loader this method
+         can be used to gain access to Tomcat internals. (markt)
+      </add>
       <fix>
         <bug>63508</bug>: NPE in JNDIRealm when no <code>userRoleAttribute</code>
         is given. (fschumacher)

Places

File tomcat-9.0-hardening_getResources.patch of Package tomcat.28016

Places