Projects
openEuler:Mainline
jetty
_service:tar_scm:CVE-2020-27216.patch
Sign Up
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File _service:tar_scm:CVE-2020-27216.patch of Package jetty
From: Markus Koschany <apo@debian.org> Date: Sat, 3 Jul 2021 22:05:57 +0200 Subject: CVE-2020-27216 Origin: https://github.com/eclipse/jetty.project/commit/53e0e0e9b25a6309bf24ee3b10984f4145701edb Origin: https://github.com/eclipse/jetty.project/commit/9ad6beb80543b392c91653f6bfce233fc75b9d5f --- .../eclipse/jetty/webapp/WebInfConfiguration.java | 20 +-- .../server/session/InfinispanTestSupport.java | 173 +++++++++++++-------- .../test/java/org/eclipse/jetty/TestServer.java | 54 +++---- 3 files changed, 135 insertions(+), 112 deletions(-) diff --git a/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java b/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java index b94f788..19663bc 100644 --- a/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java +++ b/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java @@ -24,6 +24,8 @@ import java.net.URI; import java.net.URISyntaxException; import java.net.URL; import java.net.URLClassLoader; +import java.nio.file.Files; +import java.nio.file.Path; import java.util.ArrayList; import java.util.Arrays; import java.util.List; @@ -384,14 +386,10 @@ public class WebInfConfiguration extends AbstractConfiguration @Override public void cloneConfigure(WebAppContext template, WebAppContext context) throws Exception { - File tmpDir=File.createTempFile(WebInfConfiguration.getCanonicalNameForWebAppTmpDir(context),"",template.getTempDirectory().getParentFile()); - if (tmpDir.exists()) - { - IO.delete(tmpDir); - } - tmpDir.mkdir(); - tmpDir.deleteOnExit(); - context.setTempDirectory(tmpDir); + Path tmpDir = Files.createTempDirectory(template.getTempDirectory().getParentFile().toPath(), WebInfConfiguration.getCanonicalNameForWebAppTmpDir(context)); + File tmpDirAsFile = tmpDir.toFile(); + tmpDirAsFile.deleteOnExit(); + context.setTempDirectory(tmpDirAsFile); } @@ -522,11 +520,7 @@ public class WebInfConfiguration extends AbstractConfiguration else { //ensure file will always be unique by appending random digits - tmpDir = File.createTempFile(temp, ".dir", parent); - //delete the file that was created - tmpDir.delete(); - //and make a directory of the same name - tmpDir.mkdirs(); + tmpDir = Files.createTempDirectory(parent.toPath(), temp).toFile(); } configureTempDirectory(tmpDir, context); diff --git a/tests/test-sessions/test-infinispan-sessions/src/test/java/org/eclipse/jetty/server/session/InfinispanTestSupport.java b/tests/test-sessions/test-infinispan-sessions/src/test/java/org/eclipse/jetty/server/session/InfinispanTestSupport.java index 57ecb1f..663e8dd 100644 --- a/tests/test-sessions/test-infinispan-sessions/src/test/java/org/eclipse/jetty/server/session/InfinispanTestSupport.java +++ b/tests/test-sessions/test-infinispan-sessions/src/test/java/org/eclipse/jetty/server/session/InfinispanTestSupport.java @@ -1,6 +1,6 @@ // // ======================================================================== -// Copyright (c) 1995-2019 Mort Bay Consulting Pty. Ltd. +// Copyright (c) 1995-2021 Mort Bay Consulting Pty Ltd and others. // ------------------------------------------------------------------------ // All rights reserved. This program and the accompanying materials // are made available under the terms of the Eclipse Public License v1.0 @@ -16,38 +16,44 @@ // ======================================================================== // - package org.eclipse.jetty.server.session; -import static org.junit.jupiter.api.Assertions.assertEquals; -import static org.junit.jupiter.api.Assertions.assertTrue; - import java.io.File; +import java.lang.annotation.ElementType; +import java.nio.file.Files; +import java.nio.file.Path; +import java.util.Properties; +import org.eclipse.jetty.toolchain.test.FS; import org.eclipse.jetty.util.IO; +import org.hibernate.search.cfg.Environment; +import org.hibernate.search.cfg.SearchMapping; import org.infinispan.Cache; -import org.infinispan.configuration.cache.Configuration; import org.infinispan.configuration.cache.ConfigurationBuilder; +import org.infinispan.configuration.cache.ConfigurationChildBuilder; +import org.infinispan.configuration.cache.Index; import org.infinispan.configuration.global.GlobalConfigurationBuilder; import org.infinispan.manager.DefaultCacheManager; import org.infinispan.manager.EmbeddedCacheManager; +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertTrue; + /** * InfinispanTestSupport - * - * */ public class InfinispanTestSupport { - public static final String DEFAULT_CACHE_NAME = "session_test_cache"; - public Cache _cache; - + public static final String DEFAULT_CACHE_NAME = "session_test_cache"; + public Cache _cache; + public ConfigurationBuilder _builder; - private File _tmpdir; + private File _tmpdir; private boolean _useFileStore; + private boolean _serializeSessionData; private String _name; - public static EmbeddedCacheManager _manager; - + public static EmbeddedCacheManager _manager; + static { try @@ -59,53 +65,84 @@ public class InfinispanTestSupport e.printStackTrace(); } } - - - - - public InfinispanTestSupport () + + public InfinispanTestSupport() { - this (null); + this(null); } - + public InfinispanTestSupport(String cacheName) - { + { if (cacheName == null) - cacheName = DEFAULT_CACHE_NAME+System.currentTimeMillis(); - + cacheName = DEFAULT_CACHE_NAME + System.currentTimeMillis(); + _name = cacheName; _builder = new ConfigurationBuilder(); } - - public void setUseFileStore (boolean useFileStore) + + public void setUseFileStore(boolean useFileStore) { _useFileStore = useFileStore; } - - public Cache getCache () + + public void setSerializeSessionData(boolean serializeSessionData) { - return _cache; + _serializeSessionData = serializeSessionData; } - public void setup () throws Exception + public Cache getCache() { - if (_useFileStore) - { - _tmpdir = File.createTempFile("infini", "span"); - _tmpdir.delete(); - _tmpdir.mkdir(); - Configuration config = _builder.persistence().addSingleFileStore().location(_tmpdir.getAbsolutePath()).storeAsBinary().build(); - _manager.defineConfiguration(_name, config); - } - else - { - _manager.defineConfiguration(_name, _builder.build()); - } - _cache = _manager.getCache(_name); + return _cache; } + public void setup(Path root) throws Exception + { + Path indexesDir = root.resolve("indexes"); + FS.ensureDirExists(indexesDir); + + SearchMapping mapping = new SearchMapping(); + mapping.entity(SessionData.class).indexed().providedId().property("expiry", ElementType.FIELD).field(); + Properties properties = new Properties(); + properties.put(Environment.MODEL_MAPPING, mapping); + properties.put("hibernate.search.default.indexBase", indexesDir.toString()); + + if (_useFileStore) + { + Path tmpDir = Files.createTempDirectory("infinispan"); + _tmpdir = tmpDir.toFile(); + + ConfigurationChildBuilder b = _builder.indexing() + .index(Index.ALL) + .addIndexedEntity(SessionData.class) + .withProperties(properties) + .persistence() + .addSingleFileStore() + .location(_tmpdir.getAbsolutePath()); + if (_serializeSessionData) + { + b = b.storeAsBinary().enable(); + } + + _manager.defineConfiguration(_name, b.build()); + } + else + { + ConfigurationChildBuilder b = _builder.indexing() + .withProperties(properties) + .index(Index.ALL) + .addIndexedEntity(SessionData.class); + + if (_serializeSessionData) + { + b = b.storeAsBinary().enable(); + } + + _manager.defineConfiguration(_name, b.build()); + } + _cache = _manager.getCache(_name); + } - public void teardown () throws Exception + public void teardown() throws Exception { _cache.clear(); _manager.removeCache(_name); @@ -117,39 +154,41 @@ public class InfinispanTestSupport } } } - - + @SuppressWarnings("unchecked") - public void createSession (SessionData data) - throws Exception + public void createSession(SessionData data) + throws Exception { - _cache.put(data.getContextPath()+"_"+data.getVhost()+"_"+data.getId(), data); + _cache.put(data.getContextPath() + "_" + data.getVhost() + "_" + data.getId(), data); } - - public void createUnreadableSession (SessionData data) + public void createUnreadableSession(SessionData data) { - + } - - - public boolean checkSessionExists (SessionData data) - throws Exception + + public boolean checkSessionExists(SessionData data) + throws Exception { - return (_cache.get(data.getContextPath()+"_"+data.getVhost()+"_"+data.getId()) != null); + return (_cache.get(data.getContextPath() + "_" + data.getVhost() + "_" + data.getId()) != null); } - - - public boolean checkSessionPersisted (SessionData data) - throws Exception + + public boolean checkSessionPersisted(SessionData data) + throws Exception { - Object obj = _cache.get(data.getContextPath()+"_"+data.getVhost()+"_"+data.getId()); + + //evicts the object from memory. Forces the cache to fetch the data from file + if (_useFileStore) + { + _cache.evict(data.getContextPath() + "_" + data.getVhost() + "_" + data.getId()); + } + + Object obj = _cache.get(data.getContextPath() + "_" + data.getVhost() + "_" + data.getId()); if (obj == null) return false; - + SessionData saved = (SessionData)obj; - - + //turn an Entity into a Session assertEquals(data.getId(), saved.getId()); assertEquals(data.getContextPath(), saved.getContextPath()); @@ -168,11 +207,11 @@ public class InfinispanTestSupport //same keys assertTrue(data.getKeys().equals(saved.getKeys())); //same values - for (String name:data.getKeys()) + for (String name : data.getKeys()) { assertTrue(data.getAttribute(name).equals(saved.getAttribute(name))); } - + return true; } } diff --git a/tests/test-webapps/test-jetty-webapp/src/test/java/org/eclipse/jetty/TestServer.java b/tests/test-webapps/test-jetty-webapp/src/test/java/org/eclipse/jetty/TestServer.java index a7af064..c1c5dc5 100644 --- a/tests/test-webapps/test-jetty-webapp/src/test/java/org/eclipse/jetty/TestServer.java +++ b/tests/test-webapps/test-jetty-webapp/src/test/java/org/eclipse/jetty/TestServer.java @@ -1,6 +1,6 @@ // // ======================================================================== -// Copyright (c) 1995-2019 Mort Bay Consulting Pty. Ltd. +// Copyright (c) 1995-2021 Mort Bay Consulting Pty Ltd and others. // ------------------------------------------------------------------------ // All rights reserved. This program and the accompanying materials // are made available under the terms of the Eclipse Public License v1.0 @@ -18,13 +18,11 @@ package org.eclipse.jetty; -import java.io.File; import java.io.IOException; import java.lang.management.ManagementFactory; import java.nio.file.FileSystems; import java.nio.file.Files; import java.nio.file.Path; - import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -65,11 +63,11 @@ public class TestServer ((StdErrLog)Log.getLog()).setSource(false); // TODO don't depend on this file structure - Path jetty_root = FileSystems.getDefault().getPath(".").toAbsolutePath().normalize(); - if (!Files.exists(jetty_root.resolve("VERSION.txt"))) - jetty_root = FileSystems.getDefault().getPath("../../..").toAbsolutePath().normalize(); - if (!Files.exists(jetty_root.resolve("VERSION.txt"))) - throw new IllegalArgumentException(jetty_root.toString()); + Path jettyRoot = FileSystems.getDefault().getPath(".").toAbsolutePath().normalize(); + if (!Files.exists(jettyRoot.resolve("VERSION.txt"))) + jettyRoot = FileSystems.getDefault().getPath("../../..").toAbsolutePath().normalize(); + if (!Files.exists(jettyRoot.resolve("VERSION.txt"))) + throw new IllegalArgumentException(jettyRoot.toString()); // Setup Threadpool QueuedThreadPool threadPool = new QueuedThreadPool(); @@ -80,10 +78,9 @@ public class TestServer server.manage(threadPool); // Setup JMX - MBeanContainer mbContainer=new MBeanContainer(ManagementFactory.getPlatformMBeanServer()); + MBeanContainer mbContainer = new MBeanContainer(ManagementFactory.getPlatformMBeanServer()); server.addBean(mbContainer); server.addBean(Log.getLog()); - // Common HTTP configuration HttpConfiguration config = new HttpConfiguration(); @@ -92,21 +89,19 @@ public class TestServer config.addCustomizer(new SecureRequestCustomizer()); config.setSendDateHeader(true); config.setSendServerVersion(true); - - + // Http Connector HttpConnectionFactory http = new HttpConnectionFactory(config); - ServerConnector httpConnector = new ServerConnector(server,http); + ServerConnector httpConnector = new ServerConnector(server, http); httpConnector.setPort(8080); httpConnector.setIdleTimeout(30000); server.addConnector(httpConnector); - // Handlers HandlerCollection handlers = new HandlerCollection(); ContextHandlerCollection contexts = new ContextHandlerCollection(); handlers.setHandlers(new Handler[] - { contexts, new DefaultHandler() }); + {contexts, new DefaultHandler()}); // Add restart handler to test the ability to save sessions and restart RestartHandler restart = new RestartHandler(); @@ -114,15 +109,14 @@ public class TestServer server.setHandler(restart); - // Setup context HashLoginService login = new HashLoginService(); login.setName("Test Realm"); - login.setConfig(jetty_root.resolve("tests/test-webapps/test-jetty-webapp/src/main/config/demo-base/etc/realm.properties").toString()); + login.setConfig(jettyRoot.resolve("tests/test-webapps/test-jetty-webapp/src/main/config/demo-base/etc/realm.properties").toString()); server.addBean(login); - File log=File.createTempFile("jetty-yyyy_mm_dd", "log"); - CustomRequestLog requestLog = new CustomRequestLog(log.toString()); + Path logPath = Files.createTempFile("jetty-yyyy_mm_dd", "log"); + CustomRequestLog requestLog = new CustomRequestLog(logPath.toString()); server.setRequestLog(requestLog); server.setStopAtShutdown(true); @@ -130,23 +124,19 @@ public class TestServer WebAppContext webapp = new WebAppContext(); webapp.setContextPath("/test"); webapp.setParentLoaderPriority(true); - webapp.setResourceBase(jetty_root.resolve("tests/test-webapps/test-jetty-webapp/src/main/webapp").toString()); - webapp.setAttribute("testAttribute","testValue"); - File sessiondir=File.createTempFile("sessions",null); - if (sessiondir.exists()) - sessiondir.delete(); - sessiondir.mkdir(); - sessiondir.deleteOnExit(); + webapp.setResourceBase(jettyRoot.resolve("tests/test-webapps/test-jetty-webapp/src/main/webapp").toString()); + webapp.setAttribute("testAttribute", "testValue"); + Path sessionDir = Files.createTempDirectory("sessions"); DefaultSessionCache ss = new DefaultSessionCache(webapp.getSessionHandler()); FileSessionDataStore sds = new FileSessionDataStore(); ss.setSessionDataStore(sds); - sds.setStoreDir(sessiondir); + sds.setStoreDir(sessionDir.toFile()); webapp.getSessionHandler().setSessionCache(ss); contexts.addHandler(webapp); ContextHandler srcroot = new ContextHandler(); - srcroot.setResourceBase(jetty_root.resolve("tests/test-webapps/test-jetty-webapp/src").toString()); + srcroot.setResourceBase(jettyRoot.resolve("tests/test-webapps/test-jetty-webapp/src").toString()); srcroot.setHandler(new ResourceHandler()); srcroot.setContextPath("/src"); contexts.addHandler(srcroot); @@ -158,17 +148,17 @@ public class TestServer private static class RestartHandler extends HandlerWrapper { - /* ------------------------------------------------------------ */ + /** * @see org.eclipse.jetty.server.handler.HandlerWrapper#handle(java.lang.String, org.eclipse.jetty.server.Request, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse) */ @Override public void handle(String target, Request baseRequest, HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException { - super.handle(target,baseRequest,request,response); + super.handle(target, baseRequest, request, response); if (Boolean.valueOf(request.getParameter("restart"))) { - final Server server=getServer(); + final Server server = getServer(); new Thread() { @@ -182,7 +172,7 @@ public class TestServer Thread.sleep(100); server.start(); } - catch(Exception e) + catch (Exception e) { LOG.warn(e); }
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.
浙ICP备2022010568号-2