Release 5.1.6 (JSP+windows security fix).

Greg Wilkins <[email protected]> Sat, 19 Nov 2005 12:11:22 +0100

Newsgroups	gmane.comp.java.jetty.general,gmane.comp.java.jetty.announce,gmane.comp.java.jetty.support
Message-ID	<[email protected]>

Jetty release 5.1.6 is now available via http://jetty.mortbay.org.

This release fixes a security vulnerability with JSP and Windows that
allows the source of a JSP file to be viewed.   This issue appears to 
exist in all previous version of jetty.

Unix platforms are not affected.

If you are running on windows and use JSPs, then it is advisable
to update to 5.1.6 to protect your JSPs from inspection (and possible 
discovery of application vulnerabilities).  Alternately, the attached
filter may be deployed in existing Jetty releases to protect from this
issue.

Jetty-5.1.6 - 18 November 2005
 + Fixed JSP visibility security issue.
 + Improved jetty-web.xml access to org.mortbay classes.

Fix5CFilter.java (text/x-java, 1.2 KB)


import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/* Fix5CFilter. 
 * 
 * Configure with:
 * 
  <filter>
    <filter-name>Fix5C</filter-name>
    <filter-class>Fix5CFilter</filter-class>
  </filter>

  <filter-mapping>
    <filter-name>Fix5C</filter-name>
    <servlet-name>default</servlet-name>
  </filter-mapping>
 */
public class Fix5CFilter implements Filter
{

    public void init(FilterConfig filterConfig) throws ServletException
    {
    }

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException
    {
        if (((HttpServletRequest)request).getRequestURI().endsWith("%5c") ||
            ((HttpServletRequest)request).getRequestURI().endsWith("%5C"))
        {
            ((HttpServletResponse)response).sendError(403);
        }
        else
        {
            chain.doFilter(request, response);
        }
    }

    public void destroy()
    {
    }

}