Skip to content

Commit

Permalink
Fix BZ 64871. Log if file access is blocked due to symlinks
Browse files Browse the repository at this point in the history
  • Loading branch information
markt-asf committed Nov 6, 2020
1 parent 69b328f commit 920dddb
Show file tree
Hide file tree
Showing 3 changed files with 24 additions and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -22,11 +22,15 @@
import java.net.URL;

import org.apache.catalina.LifecycleException;
import org.apache.juli.logging.Log;
import org.apache.juli.logging.LogFactory;
import org.apache.tomcat.util.compat.JrePlatform;
import org.apache.tomcat.util.http.RequestUtil;

public abstract class AbstractFileResourceSet extends AbstractResourceSet {

private static final Log log = LogFactory.getLog(AbstractFileResourceSet.class);

protected static final String[] EMPTY_STRING_ARRAY = new String[0];

private File fileBase;
Expand Down Expand Up @@ -128,6 +132,19 @@ protected final File file(String name, boolean mustExist) {
canPath = normalize(canPath);
}
if (!canPath.equals(absPath)) {
if (!canPath.equalsIgnoreCase(absPath)) {
// Typically means symlinks are in use but being ignored. Given
// the symlink was likely created for a reason, log a warning
// that it was ignored.
String msg = sm.getString("abstractFileResourceSet.canonicalfileCheckFailed",
getRoot().getContext().getName(), absPath, canPath);
// Log issues with configuration files at a higher level
if(absPath.startsWith("/META-INF/") || absPath.startsWith("/WEB-INF/")) {
log.error(msg);
} else {
log.warn(msg);
}
}
return null;
}

Expand All @@ -144,7 +161,7 @@ private boolean isInvalidWindowsFilename(String name) {
// expression irrespective of input length.
for (int i = 0; i < len; i++) {
char c = name.charAt(i);
if (c == '\"' || c == '<' || c == '>') {
if (c == '\"' || c == '<' || c == '>' || c == ':') {
// These characters are disallowed in Windows file names and
// there are known problems for file names with these characters
// when using File#getCanonicalPath().
Expand Down
2 changes: 2 additions & 0 deletions java/org/apache/catalina/webresources/LocalStrings.properties
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,8 @@

abstractArchiveResourceSet.setReadOnlyFalse=Archive based WebResourceSets such as those based on JARs are hard-coded to be read-only and may not be configured to be read-write

abstractFileResourceSet.canonicalfileCheckFailed=Resource for web application [{0}] at path [{1}] was not loaded as the canonical path [{2}] did not match. Use of symlinks is one possible cause.

abstractResource.getContentFail=Unable to return [{0}] as a byte array
abstractResource.getContentTooLarge=Unable to return [{0}] as a byte array since the resource is [{1}] bytes in size which is larger than the maximum size of a byte array

Expand Down
4 changes: 4 additions & 0 deletions webapps/docs/changelog.xml
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,10 @@
classloader as the thread context classloader, just like for the JAAS
realm. (remm)
</fix>
<add>
<bug>64871</bug>: Log a warning if Tomcat blocks access to a file
because it uses symlinks. (markt)
</add>
</changelog>
</subsection>
<subsection name="Coyote">
Expand Down

0 comments on commit 920dddb

Please sign in to comment.