<?xml version="1.0" encoding="UTF-8"?>
<report tool_name="marfcat" tool_version="SATE2010.6">
	<weakness id="1" tool_specific_id="1">
		<name cweid="22">Path Traversal (CWE-22)</name>
		<location id="359" line="1328" path="apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/connector/Request.java">
			<fragment>
1318:                                            getRequest(), name, value);
1319:         for (int i = 0; i &lt; listeners.length; i++) {
1320:             if (!(listeners[i] instanceof ServletRequestAttributeListener))
1321:                 continue;
1322:             ServletRequestAttributeListener listener =
1323:                 (ServletRequestAttributeListener) listeners[i];
1324:             try {
1325:                 listener.attributeRemoved(event);
1326:             } catch (Throwable t) {
1327:                 context.getLogger().error(sm.getString("coyoteRequest.attributeEvent"), t);
1328:                 // Error valve will pick this execption up and display it to user
1329:                 attributes.put( Globals.EXCEPTION_ATTR, t );
1330:             }
1331:         }
1332:     }
1333: 
1334: 
1335:     /**
1336:      * Set the specified request attribute to the specified value.
1337:      *
1338:      * @param name Name of the request attribute to set

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Similarity.CosineSimilarityMeasure
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.

CVE details: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5515

			</explanation>
		</location>
		<grade
			severity="2"
			probability="0.9990193761255418"
			tool_specific_rank="0.9990193761255418"
		/>
		<output>
			<textoutput>
			
                 File: apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/connector/Request.java
              Path ID: 359
               Config: -nopreprep -raw -fft -cos 
      Processing time: 0d:0h:0m:0s:12ms:12ms
         Subject's ID: 44
   Subject identified: CVE-2008-5515
ResultSet: Raw ResultSet data:
[[35:0.9937072140142358:ID=35, outcome=0.9937072140142358], [60:0.9939334273212752:ID=60, outcome=0.9939334273212752], [57:0.9965890170417417:ID=57, outcome=0.9965890170417417], [56:0.9965890170417417:ID=56, outcome=0.9965890170417417], [54:0.9965890170417417:ID=54, outcome=0.9965890170417417], [62:0.9972942685042819:ID=62, outcome=0.9972942685042819], [51:0.9943942651504193:ID=51, outcome=0.9943942651504193], [42:0.997431615476792:ID=42, outcome=0.997431615476792], [20067197:0.9982689424276774:ID=20067197, outcome=0.9982689424276774], [43:0.9982689424276774:ID=43, outcome=0.9982689424276774], [49:0.9974402919484232:ID=49, outcome=0.9974402919484232], [45:0.9893459032170543:ID=45, outcome=0.9893459032170543], [53:0.9972008786806009:ID=53, outcome=0.9972008786806009], [38:0.9981580664440464:ID=38, outcome=0.9981580664440464], [37:0.9979944876866955:ID=37, outcome=0.9979944876866955], [36:0.9979944876866955:ID=36, outcome=0.9979944876866955], [39:0.9989490281534844:ID=39, outcome=0.9989490281534844], [44:0.9990193761255418:ID=44, outcome=0.9990193761255418], [47:0.9977425874426619:ID=47, outcome=0.9977425874426619], [52:0.998494766068896:ID=52, outcome=0.998494766068896], [46:0.9967983045288563:ID=46, outcome=0.9967983045288563], [41:0.9961970220716756:ID=41, outcome=0.9961970220716756], [50:0.9979215104044745:ID=50, outcome=0.9979215104044745], [61:0.9036152357275431:ID=61, outcome=0.9036152357275431], [58:0.9958222358125245:ID=58, outcome=0.9958222358125245], [55:0.9958222358125245:ID=55, outcome=0.9958222358125245], [48:0.9958222358125245:ID=48, outcome=0.9958222358125245], [59:0.9879832586786014:ID=59, outcome=0.9879832586786014], [64:0.9893042079276412:ID=64, outcome=0.9893042079276412], [63:0.9505683733321687:ID=63, outcome=0.9505683733321687], [40:0.9505683733321687:ID=40, outcome=0.9505683733321687]]

Sorted data:
([44:0.9990193761255418:ID=44, outcome=0.9990193761255418],[39:0.9989490281534844:ID=39, outcome=0.9989490281534844],[52:0.998494766068896:ID=52, outcome=0.998494766068896],[20067197:0.9982689424276774:ID=20067197, outcome=0.9982689424276774],[43:0.9982689424276774:ID=43, outcome=0.9982689424276774],[38:0.9981580664440464:ID=38, outcome=0.9981580664440464],[37:0.9979944876866955:ID=37, outcome=0.9979944876866955],[36:0.9979944876866955:ID=36, outcome=0.9979944876866955],[50:0.9979215104044745:ID=50, outcome=0.9979215104044745],[47:0.9977425874426619:ID=47, outcome=0.9977425874426619],[49:0.9974402919484232:ID=49, outcome=0.9974402919484232],[42:0.997431615476792:ID=42, outcome=0.997431615476792],[62:0.9972942685042819:ID=62, outcome=0.9972942685042819],[53:0.9972008786806009:ID=53, outcome=0.9972008786806009],[46:0.9967983045288563:ID=46, outcome=0.9967983045288563],[57:0.9965890170417417:ID=57, outcome=0.9965890170417417],[56:0.9965890170417417:ID=56, outcome=0.9965890170417417],[54:0.9965890170417417:ID=54, outcome=0.9965890170417417],[41:0.9961970220716756:ID=41, outcome=0.9961970220716756],[58:0.9958222358125245:ID=58, outcome=0.9958222358125245],[55:0.9958222358125245:ID=55, outcome=0.9958222358125245],[48:0.9958222358125245:ID=48, outcome=0.9958222358125245],[51:0.9943942651504193:ID=51, outcome=0.9943942651504193],[60:0.9939334273212752:ID=60, outcome=0.9939334273212752],[35:0.9937072140142358:ID=35, outcome=0.9937072140142358],[45:0.9893459032170543:ID=45, outcome=0.9893459032170543],[64:0.9893042079276412:ID=64, outcome=0.9893042079276412],[59:0.9879832586786014:ID=59, outcome=0.9879832586786014],[63:0.9505683733321687:ID=63, outcome=0.9505683733321687],[40:0.9505683733321687:ID=40, outcome=0.9505683733321687],[61:0.9036152357275431:ID=61, outcome=0.9036152357275431])
FileItem: strFileID: [359]
strPath: [apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/connector/Request.java]
strFileType: [ASCII C program text]
bEmpty: [false]
oLocations: [[[]]]

       Second Best ID: 39
     Second Best Name: CVE-2009-0783
            Date/time: Tue Sep 14 23:33:20 EDT 2010
Outcome o (classifier-specific): 0.9990193761255418
     Similarity threshold (1-T): 0.999
             Computed raw P = o: 0.9990193761255418
         Warning to be reported: true
          Computed normalized P: 0.9990193761255418

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="2" tool_specific_id="2">
		<name cweid="200">Information Leak / Disclosure (CWE-200)</name>
		<location id="380" line="2711" path="apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/core/StandardContext.java">
			<fragment>
2701:      * otherwise, return &lt;code&gt;null&lt;/code&gt;.
2702:      *
2703:      * @param name Name of the desired message destination
2704:      */
2705:     public MessageDestination findMessageDestination(String name) {
2706: 
2707:         synchronized (messageDestinations) {
2708:             return ((MessageDestination) messageDestinations.get(name));
2709:         }
2710: 
2711:     }
2712: 
2713: 
2714:     /**
2715:      * Return the set of defined message destinations for this web
2716:      * application.  If none have been defined, a zero-length array
2717:      * is returned.
2718:      */
2719:     public MessageDestination[] findMessageDestinations() {
2720: 
2721:         synchronized (messageDestinations) {

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Similarity.CosineSimilarityMeasure
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.

CVE details: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0783

			</explanation>
		</location>
		<grade
			severity="2"
			probability="0.9995371027137787"
			tool_specific_rank="0.9995371027137787"
		/>
		<output>
			<textoutput>
			
                 File: apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/core/StandardContext.java
              Path ID: 380
               Config: -nopreprep -raw -fft -cos 
      Processing time: 0d:0h:0m:0s:20ms:20ms
         Subject's ID: 39
   Subject identified: CVE-2009-0783
ResultSet: Raw ResultSet data:
[[35:0.9922410817805519:ID=35, outcome=0.9922410817805519], [60:0.9938670436981145:ID=60, outcome=0.9938670436981145], [57:0.9965231125756515:ID=57, outcome=0.9965231125756515], [56:0.9965231125756515:ID=56, outcome=0.9965231125756515], [54:0.9965231125756515:ID=54, outcome=0.9965231125756515], [62:0.9968538327248958:ID=62, outcome=0.9968538327248958], [51:0.9935540145097492:ID=51, outcome=0.9935540145097492], [42:0.997579271655155:ID=42, outcome=0.997579271655155], [20067197:0.9988873377040571:ID=20067197, outcome=0.9988873377040571], [43:0.9988873377040571:ID=43, outcome=0.9988873377040571], [49:0.997367421852827:ID=49, outcome=0.997367421852827], [45:0.9889169574709437:ID=45, outcome=0.9889169574709437], [53:0.9973148312170929:ID=53, outcome=0.9973148312170929], [38:0.9985123363709342:ID=38, outcome=0.9985123363709342], [37:0.9983254586856825:ID=37, outcome=0.9983254586856825], [36:0.9983254586856825:ID=36, outcome=0.9983254586856825], [39:0.9995371027137787:ID=39, outcome=0.9995371027137787], [44:0.9991260948042534:ID=44, outcome=0.9991260948042534], [47:0.9977080744459789:ID=47, outcome=0.9977080744459789], [52:0.9990622448217085:ID=52, outcome=0.9990622448217085], [46:0.9967850079500062:ID=46, outcome=0.9967850079500062], [41:0.9957985752975154:ID=41, outcome=0.9957985752975154], [50:0.9980936675838705:ID=50, outcome=0.9980936675838705], [61:0.9030757478701361:ID=61, outcome=0.9030757478701361], [58:0.9957546246152906:ID=58, outcome=0.9957546246152906], [55:0.9957546246152906:ID=55, outcome=0.9957546246152906], [48:0.9957546246152906:ID=48, outcome=0.9957546246152906], [59:0.9875531752144578:ID=59, outcome=0.9875531752144578], [64:0.9876665829163663:ID=64, outcome=0.9876665829163663], [63:0.9500950895940975:ID=63, outcome=0.9500950895940975], [40:0.9500950895940975:ID=40, outcome=0.9500950895940975]]

Sorted data:
([39:0.9995371027137787:ID=39, outcome=0.9995371027137787],[44:0.9991260948042534:ID=44, outcome=0.9991260948042534],[52:0.9990622448217085:ID=52, outcome=0.9990622448217085],[20067197:0.9988873377040571:ID=20067197, outcome=0.9988873377040571],[43:0.9988873377040571:ID=43, outcome=0.9988873377040571],[38:0.9985123363709342:ID=38, outcome=0.9985123363709342],[37:0.9983254586856825:ID=37, outcome=0.9983254586856825],[36:0.9983254586856825:ID=36, outcome=0.9983254586856825],[50:0.9980936675838705:ID=50, outcome=0.9980936675838705],[47:0.9977080744459789:ID=47, outcome=0.9977080744459789],[42:0.997579271655155:ID=42, outcome=0.997579271655155],[49:0.997367421852827:ID=49, outcome=0.997367421852827],[53:0.9973148312170929:ID=53, outcome=0.9973148312170929],[62:0.9968538327248958:ID=62, outcome=0.9968538327248958],[46:0.9967850079500062:ID=46, outcome=0.9967850079500062],[57:0.9965231125756515:ID=57, outcome=0.9965231125756515],[56:0.9965231125756515:ID=56, outcome=0.9965231125756515],[54:0.9965231125756515:ID=54, outcome=0.9965231125756515],[41:0.9957985752975154:ID=41, outcome=0.9957985752975154],[58:0.9957546246152906:ID=58, outcome=0.9957546246152906],[55:0.9957546246152906:ID=55, outcome=0.9957546246152906],[48:0.9957546246152906:ID=48, outcome=0.9957546246152906],[60:0.9938670436981145:ID=60, outcome=0.9938670436981145],[51:0.9935540145097492:ID=51, outcome=0.9935540145097492],[35:0.9922410817805519:ID=35, outcome=0.9922410817805519],[45:0.9889169574709437:ID=45, outcome=0.9889169574709437],[64:0.9876665829163663:ID=64, outcome=0.9876665829163663],[59:0.9875531752144578:ID=59, outcome=0.9875531752144578],[63:0.9500950895940975:ID=63, outcome=0.9500950895940975],[40:0.9500950895940975:ID=40, outcome=0.9500950895940975],[61:0.9030757478701361:ID=61, outcome=0.9030757478701361])
FileItem: strFileID: [380]
strPath: [apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/core/StandardContext.java]
strFileType: [ASCII C program text]
bEmpty: [false]
oLocations: [[[]]]

       Second Best ID: 44
     Second Best Name: CVE-2008-5515
            Date/time: Tue Sep 14 23:33:21 EDT 2010
Outcome o (classifier-specific): 0.9995371027137787
     Similarity threshold (1-T): 0.999
             Computed raw P = o: 0.9995371027137787
         Warning to be reported: true
          Computed normalized P: 0.9995371027137787

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="3" tool_specific_id="3">
		<name cweid="22">Path Traversal (CWE-22)</name>
		<location id="380" line="2711" path="apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/core/StandardContext.java">
			<fragment>
2701:      * otherwise, return &lt;code&gt;null&lt;/code&gt;.
2702:      *
2703:      * @param name Name of the desired message destination
2704:      */
2705:     public MessageDestination findMessageDestination(String name) {
2706: 
2707:         synchronized (messageDestinations) {
2708:             return ((MessageDestination) messageDestinations.get(name));
2709:         }
2710: 
2711:     }
2712: 
2713: 
2714:     /**
2715:      * Return the set of defined message destinations for this web
2716:      * application.  If none have been defined, a zero-length array
2717:      * is returned.
2718:      */
2719:     public MessageDestination[] findMessageDestinations() {
2720: 
2721:         synchronized (messageDestinations) {

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Similarity.CosineSimilarityMeasure
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.

CVE details: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5515

			</explanation>
		</location>
		<grade
			severity="2"
			probability="0.9991260948042534"
			tool_specific_rank="0.9991260948042534"
		/>
		<output>
			<textoutput>
			
                 File: apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/core/StandardContext.java
              Path ID: 380
               Config: -nopreprep -raw -fft -cos 
      Processing time: 0d:0h:0m:0s:20ms:20ms
         Subject's ID: 44
   Subject identified: CVE-2008-5515
ResultSet: Raw ResultSet data:
[[35:0.9922410817805519:ID=35, outcome=0.9922410817805519], [60:0.9938670436981145:ID=60, outcome=0.9938670436981145], [57:0.9965231125756515:ID=57, outcome=0.9965231125756515], [56:0.9965231125756515:ID=56, outcome=0.9965231125756515], [54:0.9965231125756515:ID=54, outcome=0.9965231125756515], [62:0.9968538327248958:ID=62, outcome=0.9968538327248958], [51:0.9935540145097492:ID=51, outcome=0.9935540145097492], [42:0.997579271655155:ID=42, outcome=0.997579271655155], [20067197:0.9988873377040571:ID=20067197, outcome=0.9988873377040571], [43:0.9988873377040571:ID=43, outcome=0.9988873377040571], [49:0.997367421852827:ID=49, outcome=0.997367421852827], [45:0.9889169574709437:ID=45, outcome=0.9889169574709437], [53:0.9973148312170929:ID=53, outcome=0.9973148312170929], [38:0.9985123363709342:ID=38, outcome=0.9985123363709342], [37:0.9983254586856825:ID=37, outcome=0.9983254586856825], [36:0.9983254586856825:ID=36, outcome=0.9983254586856825], [39:0.9995371027137787:ID=39, outcome=0.9995371027137787], [44:0.9991260948042534:ID=44, outcome=0.9991260948042534], [47:0.9977080744459789:ID=47, outcome=0.9977080744459789], [52:0.9990622448217085:ID=52, outcome=0.9990622448217085], [46:0.9967850079500062:ID=46, outcome=0.9967850079500062], [41:0.9957985752975154:ID=41, outcome=0.9957985752975154], [50:0.9980936675838705:ID=50, outcome=0.9980936675838705], [61:0.9030757478701361:ID=61, outcome=0.9030757478701361], [58:0.9957546246152906:ID=58, outcome=0.9957546246152906], [55:0.9957546246152906:ID=55, outcome=0.9957546246152906], [48:0.9957546246152906:ID=48, outcome=0.9957546246152906], [59:0.9875531752144578:ID=59, outcome=0.9875531752144578], [64:0.9876665829163663:ID=64, outcome=0.9876665829163663], [63:0.9500950895940975:ID=63, outcome=0.9500950895940975], [40:0.9500950895940975:ID=40, outcome=0.9500950895940975]]

Sorted data:
([39:0.9995371027137787:ID=39, outcome=0.9995371027137787],[44:0.9991260948042534:ID=44, outcome=0.9991260948042534],[52:0.9990622448217085:ID=52, outcome=0.9990622448217085],[20067197:0.9988873377040571:ID=20067197, outcome=0.9988873377040571],[43:0.9988873377040571:ID=43, outcome=0.9988873377040571],[38:0.9985123363709342:ID=38, outcome=0.9985123363709342],[37:0.9983254586856825:ID=37, outcome=0.9983254586856825],[36:0.9983254586856825:ID=36, outcome=0.9983254586856825],[50:0.9980936675838705:ID=50, outcome=0.9980936675838705],[47:0.9977080744459789:ID=47, outcome=0.9977080744459789],[42:0.997579271655155:ID=42, outcome=0.997579271655155],[49:0.997367421852827:ID=49, outcome=0.997367421852827],[53:0.9973148312170929:ID=53, outcome=0.9973148312170929],[62:0.9968538327248958:ID=62, outcome=0.9968538327248958],[46:0.9967850079500062:ID=46, outcome=0.9967850079500062],[57:0.9965231125756515:ID=57, outcome=0.9965231125756515],[56:0.9965231125756515:ID=56, outcome=0.9965231125756515],[54:0.9965231125756515:ID=54, outcome=0.9965231125756515],[41:0.9957985752975154:ID=41, outcome=0.9957985752975154],[58:0.9957546246152906:ID=58, outcome=0.9957546246152906],[55:0.9957546246152906:ID=55, outcome=0.9957546246152906],[48:0.9957546246152906:ID=48, outcome=0.9957546246152906],[60:0.9938670436981145:ID=60, outcome=0.9938670436981145],[51:0.9935540145097492:ID=51, outcome=0.9935540145097492],[35:0.9922410817805519:ID=35, outcome=0.9922410817805519],[45:0.9889169574709437:ID=45, outcome=0.9889169574709437],[64:0.9876665829163663:ID=64, outcome=0.9876665829163663],[59:0.9875531752144578:ID=59, outcome=0.9875531752144578],[63:0.9500950895940975:ID=63, outcome=0.9500950895940975],[40:0.9500950895940975:ID=40, outcome=0.9500950895940975],[61:0.9030757478701361:ID=61, outcome=0.9030757478701361])
FileItem: strFileID: [380]
strPath: [apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/core/StandardContext.java]
strFileType: [ASCII C program text]
bEmpty: [false]
oLocations: [[[]]]

       Second Best ID: 44
     Second Best Name: CVE-2008-5515
            Date/time: Tue Sep 14 23:33:21 EDT 2010
Outcome o (classifier-specific): 0.9991260948042534
     Similarity threshold (1-T): 0.999
             Computed raw P = o: 0.9991260948042534
         Warning to be reported: true
          Computed normalized P: 0.9991260948042534

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="4" tool_specific_id="4">
		<name cweid="22">Path Traversal (CWE-22)</name>
		<location id="380" line="1412" path="apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/core/StandardContext.java">
			<fragment>
1402:         this.loginConfig = config;
1403:         support.firePropertyChange("loginConfig",
1404:                                    oldLoginConfig, this.loginConfig);
1405: 
1406:     }
1407: 
1408: 
1409:     /**
1410:      * Get the mapper associated with the context.
1411:      */
1412:     public org.apache.tomcat.util.http.mapper.Mapper getMapper() {
1413:         return (mapper);
1414:     }
1415: 
1416: 
1417:     /**
1418:      * Return the naming resources associated with this web application.
1419:      */
1420:     public NamingResources getNamingResources() {
1421: 
1422:         if (namingResources == null) {
1423:             setNamingResources(new NamingResources());
1424:         }
1425:         return (namingResources);
1426: 
1427:     }
1428: 
1429: 
1430:     /**
1431:      * Set the naming resources for this web application.
1432:      *
1433:      * @param namingResources The new naming resources
1434:      */
1435:     public void setNamingResources(NamingResources namingResources) {
1436: 
1437:         // Process the property setting change
1438:         NamingResources oldNamingResources = this.namingResources;
1439:         this.namingResources = namingResources;
1440:         namingResources.setContainer(this);
1441:         support.firePropertyChange("namingResources",
1442:                                    oldNamingResources, this.namingResources);
1443: 
1444:     }
1445: 
1446: 
1447:     /**
1448:      * Return the parent class loader (if any) for this web application.
1449:      * This call is meaningful only &lt;strong&gt;after&lt;/strong&gt; a Loader has
1450:      * been configured.
1451:      */
1452:     public ClassLoader getParentClassLoader() {
1453:         if (parentClassLoader != null)
1454:             return (parentClassLoader);
1455:         if (getPrivileged()) {
1456:             return this.getClass().getClassLoader();
1457:         } else if (parent != null) {
1458:             return (parent.getParentClassLoader());
1459:         }
1460:         return (ClassLoader.getSystemClassLoader());
1461:     }
1462: 
1463: 
1464:     /**
1465:      * Return the context path for this Context.
1466:      */
1467:     public String getPath() {
1468: 
1469:         return (getName());
1470: 
1471:     }
1472: 
1473:     
1474:     /**
1475:      * Set the context path for this Context.
1476:      * &lt;p&gt;
1477:      * &lt;b&gt;IMPLEMENTATION NOTE&lt;/b&gt;:  The context path is used as the "name" of
1478:      * a Context, because it must be unique.
1479:      *
1480:      * @param path The new context path
1481:      */
1482:     public void setPath(String path) {
1483:         // XXX Use host in name
1484:         setName(RequestUtil.URLDecode(path));
1485: 
1486:     }
1487: 
1488: 
1489:     /**
1490:      * Return the public identifier of the deployment descriptor DTD that is
1491:      * currently being parsed.
1492:      */
1493:     public String getPublicId() {
1494: 
1495:         return (this.publicId);
1496: 
1497:     }
1498: 
1499: 
1500:     /**
1501:      * Set the public identifier of the deployment descriptor DTD that is
1502:      * currently being parsed.
1503:      *
1504:      * @param publicId The public identifier
1505:      */
1506:     public void setPublicId(String publicId) {
1507: 
1508:         if (log.isDebugEnabled())
1509:             log.debug("Setting deployment descriptor public ID to '" +
1510:                 publicId + "'");
1511: 
1512:         String oldPublicId = this.publicId;
1513:         this.publicId = publicId;
1514:         support.firePropertyChange("publicId", oldPublicId, publicId);
1515: 
1516:     }
1517: 
1518: 
1519:     /**
1520:      * Return the reloadable flag for this web application.
1521:      */
1522:     public boolean getReloadable() {
1523: 
1524:         return (this.reloadable);
1525: 
1526:     }
1527: 
1528: 
1529:     /**
1530:      * Return the DefaultContext override flag for this web application.
1531:      */
1532:     public boolean getOverride() {
1533: 
1534:         return (this.override);
1535: 
1536:     }
1537: 
1538: 
1539:     /**
1540:      * Return the privileged flag for this web application.
1541:      */
1542:     public boolean getPrivileged() {
1543: 
1544:         return (this.privileged);
1545: 
1546:     }
1547: 
1548: 
1549:     /**
1550:      * Set the privileged flag for this web application.
1551:      *
1552:      * @param privileged The new privileged flag
1553:      */
1554:     public void setPrivileged(boolean privileged) {
1555: 
1556:         boolean oldPrivileged = this.privileged;
1557:         this.privileged = privileged;
1558:         support.firePropertyChange("privileged",
1559:                                    new Boolean(oldPrivileged),
1560:                                    new Boolean(this.privileged));
1561: 
1562:     }
1563: 
1564: 
1565:     /**
1566:      * Set the reloadable flag for this web application.
1567:      *
1568:      * @param reloadable The new reloadable flag
1569:      */
1570:     public void setReloadable(boolean reloadable) {
1571: 
1572:         boolean oldReloadable = this.reloadable;
1573:         this.reloadable = reloadable;
1574:         support.firePropertyChange("reloadable",
1575:                                    new Boolean(oldReloadable),
1576:                                    new Boolean(this.reloadable));
1577: 
1578:     }
1579: 
1580: 
1581:     /**
1582:      * Set the DefaultContext override flag for this web application.
1583:      *
1584:      * @param override The new override flag
1585:      */
1586:     public void setOverride(boolean override) {
1587: 
1588:         boolean oldOverride = this.override;
1589:         this.override = override;
1590:         support.firePropertyChange("override",
1591:                                    new Boolean(oldOverride),
1592:                                    new Boolean(this.override));
1593: 
1594:     }
1595: 
1596: 
1597:     /**
1598:      * Return the "replace welcome files" property.
1599:      */
1600:     public boolean isReplaceWelcomeFiles() {
1601: 
1602:         return (this.replaceWelcomeFiles);
1603: 
1604:     }
1605: 
1606: 
1607:     /**
1608:      * Set the "replace welcome files" property.
1609:      *
1610:      * @param replaceWelcomeFiles The new property value
1611:      */
1612:     public void setReplaceWelcomeFiles(boolean replaceWelcomeFiles) {
1613: 
1614:         boolean oldReplaceWelcomeFiles = this.replaceWelcomeFiles;
1615:         this.replaceWelcomeFiles = replaceWelcomeFiles;
1616:         support.firePropertyChange("replaceWelcomeFiles",
1617:                                    new Boolean(oldReplaceWelcomeFiles),
1618:                                    new Boolean(this.replaceWelcomeFiles));
1619: 
1620:     }
1621: 
1622: 
1623:     /**
1624:      * Return the servlet context for which this Context is a facade.
1625:      */
1626:     public ServletContext getServletContext() {
1627: 
1628:         if (context == null) {
1629:             context = new ApplicationContext(getBasePath(), this);
1630:             if (altDDName != null)
1631:                 context.setAttribute(Globals.ALT_DD_ATTR,altDDName);
1632:         }
1633:         return (context.getFacade());
1634: 
1635:     }
1636: 
1637: 
1638:     /**
1639:      * Return the default session timeout (in minutes) for this
1640:      * web application.
1641:      */
1642:     public int getSessionTimeout() {
1643: 
1644:         return (this.sessionTimeout);
1645: 
1646:     }
1647: 
1648: 
1649:     /**
1650:      * Set the default session timeout (in minutes) for this
1651:      * web application.
1652:      *
1653:      * @param timeout The new default session timeout
1654:      */
1655:     public void setSessionTimeout(int timeout) {
1656: 
1657:         int oldSessionTimeout = this.sessionTimeout;
1658:         /*
1659:          * SRV.13.4 ("Deployment Descriptor"):
1660:          * If the timeout is 0 or less, the container ensures the default
1661:          * behaviour of sessions is never to time out.
1662:          */
1663:         this.sessionTimeout = (timeout == 0) ? -1 : timeout;
1664:         support.firePropertyChange("sessionTimeout",
1665:                                    new Integer(oldSessionTimeout),
1666:                                    new Integer(this.sessionTimeout));
1667: 
1668:     }
1669: 
1670: 
1671:     /**
1672:      * Return the value of the swallowOutput flag.
1673:      */
1674:     public boolean getSwallowOutput() {
1675: 
1676:         return (this.swallowOutput);
1677: 
1678:     }
1679: 
1680: 
1681:     /**
1682:      * Set the value of the swallowOutput flag. If set to true, the system.out
1683:      * and system.err will be redirected to the logger during a servlet
1684:      * execution.
1685:      *
1686:      * @param swallowOutput The new value
1687:      */
1688:     public void setSwallowOutput(boolean swallowOutput) {
1689: 
1690:         boolean oldSwallowOutput = this.swallowOutput;
1691:         this.swallowOutput = swallowOutput;
1692:         support.firePropertyChange("swallowOutput",
1693:                                    new Boolean(oldSwallowOutput),
1694:                                    new Boolean(this.swallowOutput));
1695: 
1696:     }
1697: 
1698: 
1699:     /**
1700:      * Return the value of the unloadDelay flag.
1701:      */
1702:     public long getUnloadDelay() {
1703: 
1704:         return (this.unloadDelay);
1705: 
1706:     }
1707: 
1708: 
1709:     /**
1710:      * Set the value of the unloadDelay flag, which represents the amount
1711:      * of ms that the container will wait when unloading servlets.
1712:      * Setting this to a small value may cause more requests to fail 
1713:      * to complete when stopping a web application.
1714:      *
1715:      * @param unloadDelay The new value
1716:      */
1717:     public void setUnloadDelay(long unloadDelay) {
1718: 
1719:         long oldUnloadDelay = this.unloadDelay;
1720:         this.unloadDelay = unloadDelay;
1721:         support.firePropertyChange("unloadDelay",
1722:                                    new Long(oldUnloadDelay),
1723:                                    new Long(this.unloadDelay));
1724: 
1725:     }
1726: 
1727: 
1728:     /**
1729:      * Unpack WAR flag accessor.
1730:      */
1731:     public boolean getUnpackWAR() {
1732: 
1733:         return (unpackWAR);
1734: 
1735:     }
1736: 
1737: 
1738:     /**
1739:      * Unpack WAR flag mutator.
1740:      */
1741:     public void setUnpackWAR(boolean unpackWAR) {
1742: 
1743:         this.unpackWAR = unpackWAR;
1744: 
1745:     }
1746: 
1747:     /**
1748:      * Return the Java class name of the Wrapper implementation used
1749:      * for servlets registered in this Context.
1750:      */
1751:     public String getWrapperClass() {
1752: 
1753:         return (this.wrapperClassName);
1754: 
1755:     }
1756: 
1757: 
1758:     /**
1759:      * Set the Java class name of the Wrapper implementation used
1760:      * for servlets registered in this Context.
1761:      *
1762:      * @param wrapperClassName The new wrapper class name
1763:      *
1764:      * @throws IllegalArgumentException if the specified wrapper class
1765:      * cannot be found or is not a subclass of StandardWrapper
1766:      */
1767:     public void setWrapperClass(String wrapperClassName) {
1768: 
1769:         this.wrapperClassName = wrapperClassName;
1770: 
1771:         try {
1772:             wrapperClass = Class.forName(wrapperClassName);         
1773:             if (!StandardWrapper.class.isAssignableFrom(wrapperClass)) {
1774:                 throw new IllegalArgumentException(
1775:                     sm.getString("standardContext.invalidWrapperClass",
1776:                                  wrapperClassName));
1777:             }
1778:         } catch (ClassNotFoundException cnfe) {
1779:             throw new IllegalArgumentException(cnfe.getMessage());
1780:         }
1781:     }
1782: 
1783: 
1784:     /**
1785:      * Set the resources DirContext object with which this Container is
1786:      * associated.
1787:      *
1788:      * @param resources The newly associated DirContext
1789:      */
1790:     public synchronized void setResources(DirContext resources) {
1791: 
1792:         if (started) {
1793:             throw new IllegalStateException
1794:                 (sm.getString("standardContext.resources.started"));
1795:         }
1796: 
1797:         DirContext oldResources = this.webappResources;
1798:         if (oldResources == resources)
1799:             return;
1800: 
1801:         if (resources instanceof BaseDirContext) {
1802:             ((BaseDirContext) resources).setCached(isCachingAllowed());
1803:             ((BaseDirContext) resources).setCacheTTL(getCacheTTL());
1804:             ((BaseDirContext) resources).setCacheMaxSize(getCacheMaxSize());
1805:         }
1806:         if (resources instanceof FileDirContext) {
1807:             filesystemBased = true;
1808:             ((FileDirContext) resources).setCaseSensitive(isCaseSensitive());
1809:             ((FileDirContext) resources).setAllowLinking(isAllowLinking());
1810:         }
1811:         this.webappResources = resources;
1812: 
1813:         // The proxied resources will be refreshed on start
1814:         this.resources = null;
1815: 
1816:         support.firePropertyChange("resources", oldResources,
1817:                                    this.webappResources);
1818: 
1819:     }
1820: 
1821: 
1822:     // ------------------------------------------------------ Public Properties
1823: 
1824: 
1825:     /**
1826:      * Return the Locale to character set mapper class for this Context.
1827:      */
1828:     public String getCharsetMapperClass() {
1829: 
1830:         return (this.charsetMapperClass);
1831: 
1832:     }
1833: 
1834: 
1835:     /**
1836:      * Set the Locale to character set mapper class for this Context.
1837:      *
1838:      * @param mapper The new mapper class
1839:      */
1840:     public void setCharsetMapperClass(String mapper) {
1841: 
1842:         String oldCharsetMapperClass = this.charsetMapperClass;
1843:         this.charsetMapperClass = mapper;
1844:         support.firePropertyChange("charsetMapperClass",
1845:                                    oldCharsetMapperClass,
1846:                                    this.charsetMapperClass);
1847: 
1848:     }
1849: 
1850: 
1851:     /** Get the absolute path to the work dir.
1852:      *  To avoid duplication.
1853:      * 
1854:      * @return The work path
1855:      */ 
1856:     public String getWorkPath() {
1857:         File workDir = new File(getWorkDir());
1858:         if (!workDir.isAbsolute()) {
1859:             File catalinaHome = engineBase();
1860:             String catalinaHomePath = null;
1861:             try {
1862:                 catalinaHomePath = catalinaHome.getCanonicalPath();
1863:                 workDir = new File(catalinaHomePath,
1864:                         getWorkDir());
1865:             } catch (IOException e) {
1866:                 log.warn("Exception obtaining work path for " + getPath());
1867:             }
1868:         }
1869:         return workDir.getAbsolutePath();
1870:     }
1871:     
1872:     /**
1873:      * Return the work directory for this Context.
1874:      */
1875:     public String getWorkDir() {
1876: 
1877:         return (this.workDir);
1878: 
1879:     }
1880: 
1881: 
1882:     /**
1883:      * Set the work directory for this Context.
1884:      *
1885:      * @param workDir The new work directory
1886:      */
1887:     public void setWorkDir(String workDir) {
1888: 
1889:         this.workDir = workDir;
1890: 
1891:         if (started) {
1892:             postWorkDirectory();
1893:         }
1894:     }
1895: 
1896: 
1897:     /**
1898:      * Save config ?
1899:      */
1900:     public boolean isSaveConfig() {
1901:         return saveConfig;
1902:     }
1903: 
1904: 
1905:     /**
1906:      * Set save config flag.
1907:      */
1908:     public void setSaveConfig(boolean saveConfig) {
1909:         this.saveConfig = saveConfig;
1910:     }
1911: 
1912: 
1913:     // -------------------------------------------------------- Context Methods
1914: 
1915: 
1916:     /**
1917:      * Add a new Listener class name to the set of Listeners
1918:      * configured for this application.
1919:      *
1920:      * @param listener Java class name of a listener class
1921:      */
1922:     public void addApplicationListener(String listener) {
1923: 
1924:         synchronized (applicationListeners) {
1925:             String results[] =new String[applicationListeners.length + 1];
1926:             for (int i = 0; i &lt; applicationListeners.length; i++) {
1927:                 if (listener.equals(applicationListeners[i]))
1928:                     return;
1929:                 results[i] = applicationListeners[i];
1930:             }
1931:             results[applicationListeners.length] = listener;
1932:             applicationListeners = results;
1933:         }
1934:         fireContainerEvent("addApplicationListener", listener);
1935: 
1936:         // FIXME - add instance if already started?
1937: 
1938:     }
1939: 
1940: 
1941:     /**
1942:      * Add a new application parameter for this application.
1943:      *
1944:      * @param parameter The new application parameter
1945:      */
1946:     public void addApplicationParameter(ApplicationParameter parameter) {
1947: 
1948:         synchronized (applicationParameters) {
1949:             String newName = parameter.getName();
1950:             for (int i = 0; i &lt; applicationParameters.length; i++) {
1951:                 if (newName.equals(applicationParameters[i].getName()) &amp;&amp;
1952:                     !applicationParameters[i].getOverride())
1953:                     return;
1954:             }
1955:             ApplicationParameter results[] =
1956:                 new ApplicationParameter[applicationParameters.length + 1];
1957:             System.arraycopy(applicationParameters, 0, results, 0,
1958:                              applicationParameters.length);
1959:             results[applicationParameters.length] = parameter;
1960:             applicationParameters = results;
1961:         }
1962:         fireContainerEvent("addApplicationParameter", parameter);
1963: 
1964:     }
1965: 
1966: 
1967:     /**
1968:      * Add a child Container, only if the proposed child is an implementation
1969:      * of Wrapper.
1970:      *
1971:      * @param child Child container to be added
1972:      *
1973:      * @exception IllegalArgumentException if the proposed container is
1974:      *  not an implementation of Wrapper
1975:      */
1976:     public void addChild(Container child) {
1977: 
1978:         // Global JspServlet
1979:         Wrapper oldJspServlet = null;
1980: 
1981:         if (!(child instanceof Wrapper)) {
1982:             throw new IllegalArgumentException
1983:                 (sm.getString("standardContext.notWrapper"));
1984:         }
1985: 
1986:         Wrapper wrapper = (Wrapper) child;
1987:         boolean isJspServlet = "jsp".equals(child.getName());
1988: 
1989:         // Allow webapp to override JspServlet inherited from global web.xml.
1990:         if (isJspServlet) {
1991:             oldJspServlet = (Wrapper) findChild("jsp");
1992:             if (oldJspServlet != null) {
1993:                 removeChild(oldJspServlet);
1994:             }
1995:         }
1996: 
1997:         String jspFile = wrapper.getJspFile();
1998:         if ((jspFile != null) &amp;&amp; !jspFile.startsWith("/")) {
1999:             if (isServlet22()) {
2000:                 if(log.isDebugEnabled())
2001:                     log.debug(sm.getString("standardContext.wrapper.warning", 
2002:                                        jspFile));
2003:                 wrapper.setJspFile("/" + jspFile);
2004:             } else {
2005:                 throw new IllegalArgumentException
2006:                     (sm.getString("standardContext.wrapper.error", jspFile));
2007:             }
2008:         }
2009: 
2010:         super.addChild(child);
2011: 
2012:         if (isJspServlet &amp;&amp; oldJspServlet != null) {
2013:             /*
2014:              * The webapp-specific JspServlet inherits all the mappings
2015:              * specified in the global web.xml, and may add additional ones.
2016:              */
2017:             String[] jspMappings = oldJspServlet.findMappings();
2018:             for (int i=0; jspMappings!=null &amp;&amp; i&lt;jspMappings.length; i++) {
2019:                 addServletMapping(jspMappings[i], child.getName());
2020:             }
2021:         }
2022:     }
2023: 
2024: 
2025:     /**
2026:      * Add a security constraint to the set for this web application.
2027:      */
2028:     public void addConstraint(SecurityConstraint constraint) {
2029: 
2030:         // Validate the proposed constraint
2031:         SecurityCollection collections[] = constraint.findCollections();
2032:         for (int i = 0; i &lt; collections.length; i++) {
2033:             String patterns[] = collections[i].findPatterns();
2034:             for (int j = 0; j &lt; patterns.length; j++) {
2035:                 patterns[j] = adjustURLPattern(patterns[j]);
2036:                 if (!validateURLPattern(patterns[j]))
2037:                     throw new IllegalArgumentException
2038:                         (sm.getString
2039:                          ("standardContext.securityConstraint.pattern",
2040:                           patterns[j]));
2041:             }
2042:         }
2043: 
2044:         // Add this constraint to the set for our web application
2045:         synchronized (constraints) {
2046:             SecurityConstraint results[] =
2047:                 new SecurityConstraint[constraints.length + 1];
2048:             for (int i = 0; i &lt; constraints.length; i++)
2049:                 results[i] = constraints[i];
2050:             results[constraints.length] = constraint;
2051:             constraints = results;
2052:         }
2053: 
2054:     }
2055: 
2056: 
2057: 
2058:     /**
2059:      * Add an error page for the specified error or Java exception.
2060:      *
2061:      * @param errorPage The error page definition to be added
2062:      */
2063:     public void addErrorPage(ErrorPage errorPage) {
2064:         // Validate the input parameters
2065:         if (errorPage == null)
2066:             throw new IllegalArgumentException
2067:                 (sm.getString("standardContext.errorPage.required"));
2068:         String location = errorPage.getLocation();
2069:         if ((location != null) &amp;&amp; !location.startsWith("/")) {
2070:             if (isServlet22()) {
2071:                 if(log.isDebugEnabled())
2072:                     log.debug(sm.getString("standardContext.errorPage.warning",
2073:                                  location));
2074:                 errorPage.setLocation("/" + location);
2075:             } else {
2076:                 throw new IllegalArgumentException
2077:                     (sm.getString("standardContext.errorPage.error",
2078:                                   location));
2079:             }
2080:         }
2081: 
2082:         // Add the specified error page to our internal collections
2083:         String exceptionType = errorPage.getExceptionType();
2084:         if (exceptionType != null) {
2085:             synchronized (exceptionPages) {
2086:                 exceptionPages.put(exceptionType, errorPage);
2087:             }
2088:         } else {
2089:             synchronized (statusPages) {
2090:                 if (errorPage.getErrorCode() == 200) {
2091:                     this.okErrorPage = errorPage;
2092:                 }
2093:                 statusPages.put(new Integer(errorPage.getErrorCode()),
2094:                                 errorPage);
2095:             }
2096:         }
2097:         fireContainerEvent("addErrorPage", errorPage);
2098: 
2099:     }
2100: 
2101: 
2102:     /**
2103:      * Add a filter definition to this Context.
2104:      *
2105:      * @param filterDef The filter definition to be added
2106:      */
2107:     public void addFilterDef(FilterDef filterDef) {
2108: 
2109:         synchronized (filterDefs) {
2110:             filterDefs.put(filterDef.getFilterName(), filterDef);
2111:         }
2112:         fireContainerEvent("addFilterDef", filterDef);
2113: 
2114:     }
2115: 
2116: 
2117:     /**
2118:      * Add a filter mapping to this Context.
2119:      *
2120:      * @param filterMap The filter mapping to be added
2121:      *
2122:      * @exception IllegalArgumentException if the specified filter name
2123:      *  does not match an existing filter definition, or the filter mapping
2124:      *  is malformed
2125:      */
2126:     public void addFilterMap(FilterMap filterMap) {
2127: 
2128:         // Validate the proposed filter mapping
2129:         String filterName = filterMap.getFilterName();
2130:         String servletName = filterMap.getServletName();
2131:         String urlPattern = filterMap.getURLPattern();
2132:         if (findFilterDef(filterName) == null)
2133:             throw new IllegalArgumentException
2134:                 (sm.getString("standardContext.filterMap.name", filterName));
2135:         if ((servletName == null) &amp;&amp; (urlPattern == null))
2136:             throw new IllegalArgumentException
2137:                 (sm.getString("standardContext.filterMap.either"));
2138:         if ((servletName != null) &amp;&amp; (urlPattern != null))
2139:             throw new IllegalArgumentException
2140:                 (sm.getString("standardContext.filterMap.either"));
2141:         // Because filter-pattern is new in 2.3, no need to adjust
2142:         // for 2.2 backwards compatibility
2143:         if ((urlPattern != null) &amp;&amp; !validateURLPattern(urlPattern))
2144:             throw new IllegalArgumentException
2145:                 (sm.getString("standardContext.filterMap.pattern",
2146:                               urlPattern));
2147: 
2148:         // Add this filter mapping to our registered set
2149:         synchronized (filterMaps) {
2150:             FilterMap results[] =new FilterMap[filterMaps.length + 1];
2151:             System.arraycopy(filterMaps, 0, results, 0, filterMaps.length);
2152:             results[filterMaps.length] = filterMap;
2153:             filterMaps = results;
2154:         }
2155:         fireContainerEvent("addFilterMap", filterMap);
2156: 
2157:     }
2158: 
2159: 
2160:     /**
2161:      * Add the classname of an InstanceListener to be added to each
2162:      * Wrapper appended to this Context.
2163:      *
2164:      * @param listener Java class name of an InstanceListener class
2165:      */
2166:     public void addInstanceListener(String listener) {
2167: 
2168:         synchronized (instanceListeners) {
2169:             String results[] =new String[instanceListeners.length + 1];
2170:             for (int i = 0; i &lt; instanceListeners.length; i++)
2171:                 results[i] = instanceListeners[i];
2172:             results[instanceListeners.length] = listener;
2173:             instanceListeners = results;
2174:         }
2175:         fireContainerEvent("addInstanceListener", listener);
2176: 
2177:     }
2178: 
2179:     /**
2180:      * Add the given URL pattern as a jsp-property-group.  This maps
2181:      * resources that match the given pattern so they will be passed
2182:      * to the JSP container.  Though there are other elements in the
2183:      * property group, we only care about the URL pattern here.  The
2184:      * JSP container will parse the rest.
2185:      *
2186:      * @param pattern URL pattern to be mapped
2187:      */
2188:     public void addJspMapping(String pattern) {
2189:         String servletName = findServletMapping("*.jsp");
2190:         if (servletName == null) {
2191:             servletName = "jsp";
2192:         }
2193: 
2194:         if( findChild(servletName) != null) {
2195:             addServletMapping(pattern, servletName, true);
2196:         } else {
2197:             if(log.isDebugEnabled())
2198:                 log.debug("Skiping " + pattern + " , no servlet " + servletName);
2199:         }
2200:     }
2201: 
2202: 
2203:     /**
2204:      * Add a Locale Encoding Mapping (see Sec 5.4 of Servlet spec 2.4)
2205:      *
2206:      * @param locale locale to map an encoding for
2207:      * @param encoding encoding to be used for a give locale
2208:      */
2209:     public void addLocaleEncodingMappingParameter(String locale, String encoding){
2210:         getCharsetMapper().addCharsetMappingFromDeploymentDescriptor(locale, encoding);
2211:     }
2212: 
2213: 
2214:     /**
2215:      * Add a message destination for this web application.
2216:      *
2217:      * @param md New message destination
2218:      */
2219:     public void addMessageDestination(MessageDestination md) {
2220: 
2221:         synchronized (messageDestinations) {
2222:             messageDestinations.put(md.getName(), md);
2223:         }
2224:         fireContainerEvent("addMessageDestination", md.getName());
2225: 
2226:     }
2227: 
2228: 
2229:     /**
2230:      * Add a message destination reference for this web application.
2231:      *
2232:      * @param mdr New message destination reference
2233:      */
2234:     public void addMessageDestinationRef
2235:         (MessageDestinationRef mdr) {
2236: 
2237:         namingResources.addMessageDestinationRef(mdr);
2238:         fireContainerEvent("addMessageDestinationRef", mdr.getName());
2239: 
2240:     }
2241: 
2242: 
2243:     /**
2244:      * Add a new MIME mapping, replacing any existing mapping for
2245:      * the specified extension.
2246:      *
2247:      * @param extension Filename extension being mapped
2248:      * @param mimeType Corresponding MIME type
2249:      */
2250:     public void addMimeMapping(String extension, String mimeType) {
2251: 
2252:         synchronized (mimeMappings) {
2253:             mimeMappings.put(extension, mimeType);
2254:         }
2255:         fireContainerEvent("addMimeMapping", extension);
2256: 
2257:     }
2258: 
2259: 
2260:     /**
2261:      * Add a new context initialization parameter.
2262:      *
2263:      * @param name Name of the new parameter
2264:      * @param value Value of the new  parameter
2265:      *
2266:      * @exception IllegalArgumentException if the name or value is missing,
2267:      *  or if this context initialization parameter has already been
2268:      *  registered
2269:      */
2270:     public void addParameter(String name, String value) {
2271:         // Validate the proposed context initialization parameter
2272:         if ((name == null) || (value == null))
2273:             throw new IllegalArgumentException
2274:                 (sm.getString("standardContext.parameter.required"));
2275:         if (parameters.get(name) != null)
2276:             throw new IllegalArgumentException
2277:                 (sm.getString("standardContext.parameter.duplicate", name));
2278: 
2279:         // Add this parameter to our defined set
2280:         synchronized (parameters) {
2281:             parameters.put(name, value);
2282:         }
2283:         fireContainerEvent("addParameter", name);
2284: 
2285:     }
2286: 
2287: 
2288:     /**
2289:      * Add a security role reference for this web application.
2290:      *
2291:      * @param role Security role used in the application
2292:      * @param link Actual security role to check for
2293:      */
2294:     public void addRoleMapping(String role, String link) {
2295: 
2296:         synchronized (roleMappings) {
2297:             roleMappings.put(role, link);
2298:         }
2299:         fireContainerEvent("addRoleMapping", role);
2300: 
2301:     }
2302: 
2303: 
2304:     /**
2305:      * Add a new security role for this web application.
2306:      *
2307:      * @param role New security role
2308:      */
2309:     public void addSecurityRole(String role) {
2310: 
2311:         synchronized (securityRoles) {
2312:             String results[] =new String[securityRoles.length + 1];
2313:             for (int i = 0; i &lt; securityRoles.length; i++)
2314:                 results[i] = securityRoles[i];
2315:             results[securityRoles.length] = role;
2316:             securityRoles = results;
2317:         }
2318:         fireContainerEvent("addSecurityRole", role);
2319: 
2320:     }
2321: 
2322: 
2323:     /**
2324:      * Add a new servlet mapping, replacing any existing mapping for
2325:      * the specified pattern.
2326:      *
2327:      * @param pattern URL pattern to be mapped
2328:      * @param name Name of the corresponding servlet to execute
2329:      *
2330:      * @exception IllegalArgumentException if the specified servlet name
2331:      *  is not known to this Context
2332:      */
2333:     public void addServletMapping(String pattern, String name) {
2334:         addServletMapping(pattern, name, false);
2335:     }
2336: 
2337: 
2338:     /**
2339:      * Add a new servlet mapping, replacing any existing mapping for
2340:      * the specified pattern.
2341:      *
2342:      * @param pattern URL pattern to be mapped
2343:      * @param name Name of the corresponding servlet to execute
2344:      * @param jspWildCard true if name identifies the JspServlet
2345:      * and pattern contains a wildcard; false otherwise
2346:      *
2347:      * @exception IllegalArgumentException if the specified servlet name
2348:      *  is not known to this Context
2349:      */
2350:     public void addServletMapping(String pattern, String name,
2351:                                   boolean jspWildCard) {
2352:         // Validate the proposed mapping
2353:         if (findChild(name) == null)
2354:             throw new IllegalArgumentException
2355:                 (sm.getString("standardContext.servletMap.name", name));
2356:         pattern = adjustURLPattern(RequestUtil.URLDecode(pattern));
2357:         if (!validateURLPattern(pattern))
2358:             throw new IllegalArgumentException
2359:                 (sm.getString("standardContext.servletMap.pattern", pattern));
2360: 
2361:         // Add this mapping to our registered set
2362:         synchronized (servletMappings) {
2363:             String name2 = (String) servletMappings.get(pattern);
2364:             if (name2 != null) {
2365:                 // Don't allow more than one servlet on the same pattern
2366:                 Wrapper wrapper = (Wrapper) findChild(name2);
2367:                 wrapper.removeMapping(pattern);
2368:                 mapper.removeWrapper(pattern);
2369:             }
2370:             servletMappings.put(pattern, name);
2371:         }
2372:         Wrapper wrapper = (Wrapper) findChild(name);
2373:         wrapper.addMapping(pattern);
2374: 
2375:         // Update context mapper
2376:         mapper.addWrapper(pattern, wrapper, jspWildCard);
2377: 
2378:         fireContainerEvent("addServletMapping", pattern);
2379: 
2380:     }
2381: 
2382: 
2383:     /**
2384:      * Add a JSP tag library for the specified URI.
2385:      *
2386:      * @param uri URI, relative to the web.xml file, of this tag library
2387:      * @param location Location of the tag library descriptor
2388:      */
2389:     public void addTaglib(String uri, String location) {
2390: 
2391:         synchronized (taglibs) {
2392:             taglibs.put(uri, location);
2393:         }
2394:         fireContainerEvent("addTaglib", uri);
2395: 
2396:     }
2397: 
2398: 
2399:     /**
2400:      * Add a new watched resource to the set recognized by this Context.
2401:      *
2402:      * @param name New watched resource file name
2403:      */
2404:     public void addWatchedResource(String name) {
2405: 
2406:         synchronized (watchedResources) {
2407:             String results[] = new String[watchedResources.length + 1];
2408:             for (int i = 0; i &lt; watchedResources.length; i++)
2409:                 results[i] = watchedResources[i];
2410:             results[watchedResources.length] = name;
2411:             watchedResources = results;
2412:         }
2413:         fireContainerEvent("addWatchedResource", name);
2414: 
2415:     }
2416: 
2417: 
2418:     /**
2419:      * Add a new welcome file to the set recognized by this Context.
2420:      *
2421:      * @param name New welcome file name
2422:      */
2423:     public void addWelcomeFile(String name) {
2424: 
2425:         synchronized (welcomeFiles) {
2426:             // Welcome files from the application deployment descriptor
2427:             // completely replace those from the default conf/web.xml file
2428:             if (replaceWelcomeFiles) {
2429:                 welcomeFiles = new String[0];
2430:                 setReplaceWelcomeFiles(false);
2431:             }
2432:             String results[] =new String[welcomeFiles.length + 1];
2433:             for (int i = 0; i &lt; welcomeFiles.length; i++)
2434:                 results[i] = welcomeFiles[i];
2435:             results[welcomeFiles.length] = name;
2436:             welcomeFiles = results;
2437:         }
2438:         postWelcomeFiles();
2439:         fireContainerEvent("addWelcomeFile", name);
2440: 
2441:     }
2442: 
2443: 
2444:     /**
2445:      * Add the classname of a LifecycleListener to be added to each
2446:      * Wrapper appended to this Context.
2447:      *
2448:      * @param listener Java class name of a LifecycleListener class
2449:      */
2450:     public void addWrapperLifecycle(String listener) {
2451: 
2452:         synchronized (wrapperLifecycles) {
2453:             String results[] =new String[wrapperLifecycles.length + 1];
2454:             for (int i = 0; i &lt; wrapperLifecycles.length; i++)
2455:                 results[i] = wrapperLifecycles[i];
2456:             results[wrapperLifecycles.length] = listener;
2457:             wrapperLifecycles = results;
2458:         }
2459:         fireContainerEvent("addWrapperLifecycle", listener);
2460: 
2461:     }
2462: 
2463: 
2464:     /**
2465:      * Add the classname of a ContainerListener to be added to each
2466:      * Wrapper appended to this Context.
2467:      *
2468:      * @param listener Java class name of a ContainerListener class
2469:      */
2470:     public void addWrapperListener(String listener) {
2471: 
2472:         synchronized (wrapperListeners) {
2473:             String results[] =new String[wrapperListeners.length + 1];
2474:             for (int i = 0; i &lt; wrapperListeners.length; i++)
2475:                 results[i] = wrapperListeners[i];
2476:             results[wrapperListeners.length] = listener;
2477:             wrapperListeners = results;
2478:         }
2479:         fireContainerEvent("addWrapperListener", listener);
2480: 
2481:     }
2482: 
2483: 
2484:     /**
2485:      * Factory method to create and return a new Wrapper instance, of
2486:      * the Java implementation class appropriate for this Context
2487:      * implementation.  The constructor of the instantiated Wrapper
2488:      * will have been called, but no properties will have been set.
2489:      */
2490:     public Wrapper createWrapper() {
2491: 
2492:         Wrapper wrapper = null;
2493:         if (wrapperClass != null) {
2494:             try {
2495:                 wrapper = (Wrapper) wrapperClass.newInstance();
2496:             } catch (Throwable t) {
2497:                 log.error("createWrapper", t);
2498:                 return (null);
2499:             }
2500:         } else {
2501:             wrapper = new StandardWrapper();
2502:         }
2503: 
2504:         synchronized (instanceListeners) {
2505:             for (int i = 0; i &lt; instanceListeners.length; i++) {
2506:                 try {
2507:                     Class clazz = Class.forName(instanceListeners[i]);
2508:                     InstanceListener listener =
2509:                       (InstanceListener) clazz.newInstance();
2510:                     wrapper.addInstanceListener(listener);
2511:                 } catch (Throwable t) {
2512:                     log.error("createWrapper", t);
2513:                     return (null);
2514:                 }
2515:             }
2516:         }
2517: 
2518:         synchronized (wrapperLifecycles) {
2519:             for (int i = 0; i &lt; wrapperLifecycles.length; i++) {
2520:                 try {
2521:                     Class clazz = Class.forName(wrapperLifecycles[i]);
2522:                     LifecycleListener listener =
2523:                       (LifecycleListener) clazz.newInstance();
2524:                     if (wrapper instanceof Lifecycle)
2525:                         ((Lifecycle) wrapper).addLifecycleListener(listener);
2526:                 } catch (Throwable t) {
2527:                     log.error("createWrapper", t);
2528:                     return (null);
2529:                 }
2530:             }
2531:         }
2532: 
2533:         synchronized (wrapperListeners) {
2534:             for (int i = 0; i &lt; wrapperListeners.length; i++) {
2535:                 try {
2536:                     Class clazz = Class.forName(wrapperListeners[i]);
2537:                     ContainerListener listener =
2538:                       (ContainerListener) clazz.newInstance();
2539:                     wrapper.addContainerListener(listener);
2540:                 } catch (Throwable t) {
2541:                     log.error("createWrapper", t);
2542:                     return (null);
2543:                 }
2544:             }
2545:         }
2546: 
2547:         return (wrapper);
2548: 
2549:     }
2550: 
2551: 
2552:     /**
2553:      * Return the set of application listener class names configured
2554:      * for this application.
2555:      */
2556:     public String[] findApplicationListeners() {
2557: 
2558:         return (applicationListeners);
2559: 
2560:     }
2561: 
2562: 
2563:     /**
2564:      * Return the set of application parameters for this application.
2565:      */
2566:     public ApplicationParameter[] findApplicationParameters() {
2567: 
2568:         return (applicationParameters);
2569: 
2570:     }
2571: 
2572: 
2573:     /**
2574:      * Return the security constraints for this web application.
2575:      * If there are none, a zero-length array is returned.
2576:      */
2577:     public SecurityConstraint[] findConstraints() {
2578: 
2579:         return (constraints);
2580: 
2581:     }
2582: 
2583: 
2584:     /**
2585:      * Return the error page entry for the specified HTTP error code,
2586:      * if any; otherwise return &lt;code&gt;null&lt;/code&gt;.
2587:      *
2588:      * @param errorCode Error code to look up
2589:      */
2590:     public ErrorPage findErrorPage(int errorCode) {
2591:         if (errorCode == 200) {
2592:             return (okErrorPage);
2593:         } else {
2594:             return ((ErrorPage) statusPages.get(new Integer(errorCode)));
2595:         }
2596: 
2597:     }
2598: 
2599: 
2600:     /**
2601:      * Return the error page entry for the specified Java exception type,
2602:      * if any; otherwise return &lt;code&gt;null&lt;/code&gt;.
2603:      *
2604:      * @param exceptionType Exception type to look up
2605:      */

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Similarity.CosineSimilarityMeasure
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.

CVE details: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-5461
Possible explanation material:
=====================================
Type: path
CxE: [CVE-2007-5461]
SATE: Absolute path traversal vulnerability under certain configurations, allows
remote authenticated users to read arbitrary files via a WebDAV write request that
specifies an entity with a SYSTEM tag.
=====================================

			</explanation>
		</location>
		<grade
			severity="2"
			probability="0.9990622448217085"
			tool_specific_rank="0.9990622448217085"
		/>
		<output>
			<textoutput>
			
                 File: apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/core/StandardContext.java
              Path ID: 380
               Config: -nopreprep -raw -fft -cos 
      Processing time: 0d:0h:0m:0s:20ms:20ms
         Subject's ID: 52
   Subject identified: CVE-2007-5461
ResultSet: Raw ResultSet data:
[[35:0.9922410817805519:ID=35, outcome=0.9922410817805519], [60:0.9938670436981145:ID=60, outcome=0.9938670436981145], [57:0.9965231125756515:ID=57, outcome=0.9965231125756515], [56:0.9965231125756515:ID=56, outcome=0.9965231125756515], [54:0.9965231125756515:ID=54, outcome=0.9965231125756515], [62:0.9968538327248958:ID=62, outcome=0.9968538327248958], [51:0.9935540145097492:ID=51, outcome=0.9935540145097492], [42:0.997579271655155:ID=42, outcome=0.997579271655155], [20067197:0.9988873377040571:ID=20067197, outcome=0.9988873377040571], [43:0.9988873377040571:ID=43, outcome=0.9988873377040571], [49:0.997367421852827:ID=49, outcome=0.997367421852827], [45:0.9889169574709437:ID=45, outcome=0.9889169574709437], [53:0.9973148312170929:ID=53, outcome=0.9973148312170929], [38:0.9985123363709342:ID=38, outcome=0.9985123363709342], [37:0.9983254586856825:ID=37, outcome=0.9983254586856825], [36:0.9983254586856825:ID=36, outcome=0.9983254586856825], [39:0.9995371027137787:ID=39, outcome=0.9995371027137787], [44:0.9991260948042534:ID=44, outcome=0.9991260948042534], [47:0.9977080744459789:ID=47, outcome=0.9977080744459789], [52:0.9990622448217085:ID=52, outcome=0.9990622448217085], [46:0.9967850079500062:ID=46, outcome=0.9967850079500062], [41:0.9957985752975154:ID=41, outcome=0.9957985752975154], [50:0.9980936675838705:ID=50, outcome=0.9980936675838705], [61:0.9030757478701361:ID=61, outcome=0.9030757478701361], [58:0.9957546246152906:ID=58, outcome=0.9957546246152906], [55:0.9957546246152906:ID=55, outcome=0.9957546246152906], [48:0.9957546246152906:ID=48, outcome=0.9957546246152906], [59:0.9875531752144578:ID=59, outcome=0.9875531752144578], [64:0.9876665829163663:ID=64, outcome=0.9876665829163663], [63:0.9500950895940975:ID=63, outcome=0.9500950895940975], [40:0.9500950895940975:ID=40, outcome=0.9500950895940975]]

Sorted data:
([39:0.9995371027137787:ID=39, outcome=0.9995371027137787],[44:0.9991260948042534:ID=44, outcome=0.9991260948042534],[52:0.9990622448217085:ID=52, outcome=0.9990622448217085],[20067197:0.9988873377040571:ID=20067197, outcome=0.9988873377040571],[43:0.9988873377040571:ID=43, outcome=0.9988873377040571],[38:0.9985123363709342:ID=38, outcome=0.9985123363709342],[37:0.9983254586856825:ID=37, outcome=0.9983254586856825],[36:0.9983254586856825:ID=36, outcome=0.9983254586856825],[50:0.9980936675838705:ID=50, outcome=0.9980936675838705],[47:0.9977080744459789:ID=47, outcome=0.9977080744459789],[42:0.997579271655155:ID=42, outcome=0.997579271655155],[49:0.997367421852827:ID=49, outcome=0.997367421852827],[53:0.9973148312170929:ID=53, outcome=0.9973148312170929],[62:0.9968538327248958:ID=62, outcome=0.9968538327248958],[46:0.9967850079500062:ID=46, outcome=0.9967850079500062],[57:0.9965231125756515:ID=57, outcome=0.9965231125756515],[56:0.9965231125756515:ID=56, outcome=0.9965231125756515],[54:0.9965231125756515:ID=54, outcome=0.9965231125756515],[41:0.9957985752975154:ID=41, outcome=0.9957985752975154],[58:0.9957546246152906:ID=58, outcome=0.9957546246152906],[55:0.9957546246152906:ID=55, outcome=0.9957546246152906],[48:0.9957546246152906:ID=48, outcome=0.9957546246152906],[60:0.9938670436981145:ID=60, outcome=0.9938670436981145],[51:0.9935540145097492:ID=51, outcome=0.9935540145097492],[35:0.9922410817805519:ID=35, outcome=0.9922410817805519],[45:0.9889169574709437:ID=45, outcome=0.9889169574709437],[64:0.9876665829163663:ID=64, outcome=0.9876665829163663],[59:0.9875531752144578:ID=59, outcome=0.9875531752144578],[63:0.9500950895940975:ID=63, outcome=0.9500950895940975],[40:0.9500950895940975:ID=40, outcome=0.9500950895940975],[61:0.9030757478701361:ID=61, outcome=0.9030757478701361])
FileItem: strFileID: [380]
strPath: [apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/core/StandardContext.java]
strFileType: [ASCII C program text]
bEmpty: [false]
oLocations: [[[]]]

       Second Best ID: 44
     Second Best Name: CVE-2008-5515
            Date/time: Tue Sep 14 23:33:21 EDT 2010
Outcome o (classifier-specific): 0.9990622448217085
     Similarity threshold (1-T): 0.999
             Computed raw P = o: 0.9990622448217085
         Warning to be reported: true
          Computed normalized P: 0.9990622448217085

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="5" tool_specific_id="5">
		<name cweid="200">Information Leak / Disclosure (CWE-200)</name>
		<location id="389" line="932" path="apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/core/StandardWrapper.java">
			<fragment>
922: 
923:     }
924: 
925: 
926:     /**
927:      * Return the set of security role reference names associated with
928:      * this servlet, if any; otherwise return a zero-length array.
929:      */
930:     public String[] findSecurityReferences() {
931: 
932:         synchronized (references) {
933:             String results[] = new String[references.size()];
934:             return ((String[]) references.keySet().toArray(results));
935:         }
936: 
937:     }
938: 
939: 
940:     /**
941:      * FIXME: Fooling introspection ...
942:      */

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Similarity.CosineSimilarityMeasure
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.

CVE details: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0783

			</explanation>
		</location>
		<grade
			severity="2"
			probability="0.9991292068802726"
			tool_specific_rank="0.9991292068802726"
		/>
		<output>
			<textoutput>
			
                 File: apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/core/StandardWrapper.java
              Path ID: 389
               Config: -nopreprep -raw -fft -cos 
      Processing time: 0d:0h:0m:0s:11ms:11ms
         Subject's ID: 39
   Subject identified: CVE-2009-0783
ResultSet: Raw ResultSet data:
[[35:0.9919198021420255:ID=35, outcome=0.9919198021420255], [60:0.9935299868680957:ID=60, outcome=0.9935299868680957], [57:0.9959610185147525:ID=57, outcome=0.9959610185147525], [56:0.9959610185147525:ID=56, outcome=0.9959610185147525], [54:0.9959610185147525:ID=54, outcome=0.9959610185147525], [62:0.9963418769162086:ID=62, outcome=0.9963418769162086], [51:0.9931427549290727:ID=51, outcome=0.9931427549290727], [42:0.9971282607730897:ID=42, outcome=0.9971282607730897], [20067197:0.9985708923256053:ID=20067197, outcome=0.9985708923256053], [43:0.9985708923256053:ID=43, outcome=0.9985708923256053], [49:0.9973241920055287:ID=49, outcome=0.9973241920055287], [45:0.9883164422073152:ID=45, outcome=0.9883164422073152], [53:0.9972004782670234:ID=53, outcome=0.9972004782670234], [38:0.9981318866356731:ID=38, outcome=0.9981318866356731], [37:0.9979734752686876:ID=37, outcome=0.9979734752686876], [36:0.9979734752686876:ID=36, outcome=0.9979734752686876], [39:0.9991292068802726:ID=39, outcome=0.9991292068802726], [44:0.9987986328408246:ID=44, outcome=0.9987986328408246], [47:0.9975974037344939:ID=47, outcome=0.9975974037344939], [52:0.9988131242092065:ID=52, outcome=0.9988131242092065], [46:0.9963310086907131:ID=46, outcome=0.9963310086907131], [41:0.9961064372621734:ID=41, outcome=0.9961064372621734], [50:0.9976862355889424:ID=50, outcome=0.9976862355889424], [61:0.9056330179463398:ID=61, outcome=0.9056330179463398], [58:0.9954367618790361:ID=58, outcome=0.9954367618790361], [55:0.9954367618790361:ID=55, outcome=0.9954367618790361], [48:0.9954367618790361:ID=48, outcome=0.9954367618790361], [59:0.9883004745981883:ID=59, outcome=0.9883004745981883], [64:0.9867181169748727:ID=64, outcome=0.9867181169748727], [63:0.9518357056135779:ID=63, outcome=0.9518357056135779], [40:0.9518357056135779:ID=40, outcome=0.9518357056135779]]

Sorted data:
([39:0.9991292068802726:ID=39, outcome=0.9991292068802726],[52:0.9988131242092065:ID=52, outcome=0.9988131242092065],[44:0.9987986328408246:ID=44, outcome=0.9987986328408246],[20067197:0.9985708923256053:ID=20067197, outcome=0.9985708923256053],[43:0.9985708923256053:ID=43, outcome=0.9985708923256053],[38:0.9981318866356731:ID=38, outcome=0.9981318866356731],[37:0.9979734752686876:ID=37, outcome=0.9979734752686876],[36:0.9979734752686876:ID=36, outcome=0.9979734752686876],[50:0.9976862355889424:ID=50, outcome=0.9976862355889424],[47:0.9975974037344939:ID=47, outcome=0.9975974037344939],[49:0.9973241920055287:ID=49, outcome=0.9973241920055287],[53:0.9972004782670234:ID=53, outcome=0.9972004782670234],[42:0.9971282607730897:ID=42, outcome=0.9971282607730897],[62:0.9963418769162086:ID=62, outcome=0.9963418769162086],[46:0.9963310086907131:ID=46, outcome=0.9963310086907131],[41:0.9961064372621734:ID=41, outcome=0.9961064372621734],[57:0.9959610185147525:ID=57, outcome=0.9959610185147525],[56:0.9959610185147525:ID=56, outcome=0.9959610185147525],[54:0.9959610185147525:ID=54, outcome=0.9959610185147525],[58:0.9954367618790361:ID=58, outcome=0.9954367618790361],[55:0.9954367618790361:ID=55, outcome=0.9954367618790361],[48:0.9954367618790361:ID=48, outcome=0.9954367618790361],[60:0.9935299868680957:ID=60, outcome=0.9935299868680957],[51:0.9931427549290727:ID=51, outcome=0.9931427549290727],[35:0.9919198021420255:ID=35, outcome=0.9919198021420255],[45:0.9883164422073152:ID=45, outcome=0.9883164422073152],[59:0.9883004745981883:ID=59, outcome=0.9883004745981883],[64:0.9867181169748727:ID=64, outcome=0.9867181169748727],[63:0.9518357056135779:ID=63, outcome=0.9518357056135779],[40:0.9518357056135779:ID=40, outcome=0.9518357056135779],[61:0.9056330179463398:ID=61, outcome=0.9056330179463398])
FileItem: strFileID: [389]
strPath: [apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/core/StandardWrapper.java]
strFileType: [ASCII C program text]
bEmpty: [false]
oLocations: [[[]]]

       Second Best ID: 52
     Second Best Name: CVE-2007-5461
            Date/time: Tue Sep 14 23:33:22 EDT 2010
Outcome o (classifier-specific): 0.9991292068802726
     Similarity threshold (1-T): 0.999
             Computed raw P = o: 0.9991292068802726
         Warning to be reported: true
          Computed normalized P: 0.9991292068802726

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="6" tool_specific_id="6">
		<name cweid="22">Path Traversal (CWE-22)</name>
		<location id="452" line="940" path="apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/realm/JNDIRealm.java">
			<fragment>
930:             // Check the user's credentials
931:             if (!checkCredentials(context, user, credentials))
932:                 return (null);
933: 
934:             // Search for additional roles
935:             List roles = getRoles(context, user);
936: 
937:             // Create and return a suitable Principal for this user
938:             return (new GenericPrincipal(this, username, credentials, roles));
939:         }
940:     }
941: 
942: 
943:     /**
944:      * Return a User object containing information about the user
945:      * with the specified username, if found in the directory;
946:      * otherwise return &lt;code&gt;null&lt;/code&gt;.
947:      *
948:      * If the &lt;code&gt;userPassword&lt;/code&gt; configuration attribute is
949:      * specified, the value of that attribute is retrieved from the
950:      * user's directory entry. If the &lt;code&gt;userRoleName&lt;/code&gt;

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Similarity.CosineSimilarityMeasure
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.

CVE details: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5515

			</explanation>
		</location>
		<grade
			severity="2"
			probability="0.9990231001178995"
			tool_specific_rank="0.9990231001178995"
		/>
		<output>
			<textoutput>
			
                 File: apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/realm/JNDIRealm.java
              Path ID: 452
               Config: -nopreprep -raw -fft -cos 
      Processing time: 0d:0h:0m:0s:11ms:11ms
         Subject's ID: 44
   Subject identified: CVE-2008-5515
ResultSet: Raw ResultSet data:
[[35:0.9939672034290081:ID=35, outcome=0.9939672034290081], [60:0.9937915988616611:ID=60, outcome=0.9937915988616611], [57:0.9967065360462403:ID=57, outcome=0.9967065360462403], [56:0.9967065360462403:ID=56, outcome=0.9967065360462403], [54:0.9967065360462403:ID=54, outcome=0.9967065360462403], [62:0.9971006328535549:ID=62, outcome=0.9971006328535549], [51:0.9944842938033961:ID=51, outcome=0.9944842938033961], [42:0.9974325444114339:ID=42, outcome=0.9974325444114339], [20067197:0.9985245073821378:ID=20067197, outcome=0.9985245073821378], [43:0.9985245073821378:ID=43, outcome=0.9985245073821378], [49:0.9973864460133892:ID=49, outcome=0.9973864460133892], [45:0.989261655557383:ID=45, outcome=0.989261655557383], [53:0.9970958695049589:ID=53, outcome=0.9970958695049589], [38:0.9982730703179634:ID=38, outcome=0.9982730703179634], [37:0.9980733022430525:ID=37, outcome=0.9980733022430525], [36:0.9980733022430525:ID=36, outcome=0.9980733022430525], [39:0.998863584633101:ID=39, outcome=0.998863584633101], [44:0.9990231001178995:ID=44, outcome=0.9990231001178995], [47:0.9975377940348398:ID=47, outcome=0.9975377940348398], [52:0.9984197965548148:ID=52, outcome=0.9984197965548148], [46:0.996951293604309:ID=46, outcome=0.996951293604309], [41:0.9959552423461174:ID=41, outcome=0.9959552423461174], [50:0.998044503879469:ID=50, outcome=0.998044503879469], [61:0.9021575159497055:ID=61, outcome=0.9021575159497055], [58:0.9962762368956547:ID=58, outcome=0.9962762368956547], [55:0.9962762368956547:ID=55, outcome=0.9962762368956547], [48:0.9962762368956547:ID=48, outcome=0.9962762368956547], [59:0.9882550240845124:ID=59, outcome=0.9882550240845124], [64:0.9897213704902771:ID=64, outcome=0.9897213704902771], [63:0.9508184819945021:ID=63, outcome=0.9508184819945021], [40:0.9508184819945021:ID=40, outcome=0.9508184819945021]]

Sorted data:
([44:0.9990231001178995:ID=44, outcome=0.9990231001178995],[39:0.998863584633101:ID=39, outcome=0.998863584633101],[20067197:0.9985245073821378:ID=20067197, outcome=0.9985245073821378],[43:0.9985245073821378:ID=43, outcome=0.9985245073821378],[52:0.9984197965548148:ID=52, outcome=0.9984197965548148],[38:0.9982730703179634:ID=38, outcome=0.9982730703179634],[37:0.9980733022430525:ID=37, outcome=0.9980733022430525],[36:0.9980733022430525:ID=36, outcome=0.9980733022430525],[50:0.998044503879469:ID=50, outcome=0.998044503879469],[47:0.9975377940348398:ID=47, outcome=0.9975377940348398],[42:0.9974325444114339:ID=42, outcome=0.9974325444114339],[49:0.9973864460133892:ID=49, outcome=0.9973864460133892],[62:0.9971006328535549:ID=62, outcome=0.9971006328535549],[53:0.9970958695049589:ID=53, outcome=0.9970958695049589],[46:0.996951293604309:ID=46, outcome=0.996951293604309],[57:0.9967065360462403:ID=57, outcome=0.9967065360462403],[56:0.9967065360462403:ID=56, outcome=0.9967065360462403],[54:0.9967065360462403:ID=54, outcome=0.9967065360462403],[58:0.9962762368956547:ID=58, outcome=0.9962762368956547],[55:0.9962762368956547:ID=55, outcome=0.9962762368956547],[48:0.9962762368956547:ID=48, outcome=0.9962762368956547],[41:0.9959552423461174:ID=41, outcome=0.9959552423461174],[51:0.9944842938033961:ID=51, outcome=0.9944842938033961],[35:0.9939672034290081:ID=35, outcome=0.9939672034290081],[60:0.9937915988616611:ID=60, outcome=0.9937915988616611],[64:0.9897213704902771:ID=64, outcome=0.9897213704902771],[45:0.989261655557383:ID=45, outcome=0.989261655557383],[59:0.9882550240845124:ID=59, outcome=0.9882550240845124],[63:0.9508184819945021:ID=63, outcome=0.9508184819945021],[40:0.9508184819945021:ID=40, outcome=0.9508184819945021],[61:0.9021575159497055:ID=61, outcome=0.9021575159497055])
FileItem: strFileID: [452]
strPath: [apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/realm/JNDIRealm.java]
strFileType: [ASCII C program text]
bEmpty: [false]
oLocations: [[[]]]

       Second Best ID: 39
     Second Best Name: CVE-2009-0783
            Date/time: Tue Sep 14 23:33:22 EDT 2010
Outcome o (classifier-specific): 0.9990231001178995
     Similarity threshold (1-T): 0.999
             Computed raw P = o: 0.9990231001178995
         Warning to be reported: true
          Computed normalized P: 0.9990231001178995

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="7" tool_specific_id="7">
		<name cweid="200">Information Leak / Disclosure (CWE-200)</name>
		<location id="462" line="991" path="apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/servlets/CGIServlet.java">
			<fragment>
981:          * Constructs the CGI environment to be supplied to the invoked CGI
982:          * script; relies heavliy on Servlet API methods and findCGI
983:          *
984:          * @param    req request associated with the CGI
985:          *           invokation
986:          *
987:          * @return   true if environment was set OK, false if there
988:          *           was a problem and no environment was set
989:          */
990:         protected boolean setCGIEnvironment(HttpServletRequest req) throws IOException {
991: 
992:             /*
993:              * This method is slightly ugly; c'est la vie.
994:              * "You cannot stop [ugliness], you can only hope to contain [it]"
995:              * (apologies to Marv Albert regarding MJ)
996:              */
997: 
998:             Hashtable envp = new Hashtable();
999: 
1000:             // Add the shell environment variables (if any)
1001:             envp.putAll(shellEnv);

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Similarity.CosineSimilarityMeasure
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.

CVE details: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0783

			</explanation>
		</location>
		<grade
			severity="2"
			probability="0.999049708963642"
			tool_specific_rank="0.999049708963642"
		/>
		<output>
			<textoutput>
			
                 File: apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/servlets/CGIServlet.java
              Path ID: 462
               Config: -nopreprep -raw -fft -cos 
      Processing time: 0d:0h:0m:0s:21ms:21ms
         Subject's ID: 39
   Subject identified: CVE-2009-0783
ResultSet: Raw ResultSet data:
[[35:0.9915350236744769:ID=35, outcome=0.9915350236744769], [60:0.9932812070305193:ID=60, outcome=0.9932812070305193], [57:0.9961595577263854:ID=57, outcome=0.9961595577263854], [56:0.9961595577263854:ID=56, outcome=0.9961595577263854], [54:0.9961595577263854:ID=54, outcome=0.9961595577263854], [62:0.9962177092958664:ID=62, outcome=0.9962177092958664], [51:0.9928551368806343:ID=51, outcome=0.9928551368806343], [42:0.996809025885373:ID=42, outcome=0.996809025885373], [20067197:0.9985584116695473:ID=20067197, outcome=0.9985584116695473], [43:0.9985584116695473:ID=43, outcome=0.9985584116695473], [49:0.9970607579512653:ID=49, outcome=0.9970607579512653], [45:0.9877787418105577:ID=45, outcome=0.9877787418105577], [53:0.9972132139947705:ID=53, outcome=0.9972132139947705], [38:0.9981714729042487:ID=38, outcome=0.9981714729042487], [37:0.9979501149289023:ID=37, outcome=0.9979501149289023], [36:0.9979501149289023:ID=36, outcome=0.9979501149289023], [39:0.999049708963642:ID=39, outcome=0.999049708963642], [44:0.9985904332423442:ID=44, outcome=0.9985904332423442], [47:0.9974285344516923:ID=47, outcome=0.9974285344516923], [52:0.9986096840991284:ID=52, outcome=0.9986096840991284], [46:0.99600419932602:ID=46, outcome=0.99600419932602], [41:0.9953785147807979:ID=41, outcome=0.9953785147807979], [50:0.9976088016105495:ID=50, outcome=0.9976088016105495], [61:0.9037863318889985:ID=61, outcome=0.9037863318889985], [58:0.9947350386218738:ID=58, outcome=0.9947350386218738], [55:0.9947350386218738:ID=55, outcome=0.9947350386218738], [48:0.9947350386218738:ID=48, outcome=0.9947350386218738], [59:0.9874370236826825:ID=59, outcome=0.9874370236826825], [64:0.9870422012103589:ID=64, outcome=0.9870422012103589], [63:0.9500499608280021:ID=63, outcome=0.9500499608280021], [40:0.9500499608280021:ID=40, outcome=0.9500499608280021]]

Sorted data:
([39:0.999049708963642:ID=39, outcome=0.999049708963642],[52:0.9986096840991284:ID=52, outcome=0.9986096840991284],[44:0.9985904332423442:ID=44, outcome=0.9985904332423442],[20067197:0.9985584116695473:ID=20067197, outcome=0.9985584116695473],[43:0.9985584116695473:ID=43, outcome=0.9985584116695473],[38:0.9981714729042487:ID=38, outcome=0.9981714729042487],[37:0.9979501149289023:ID=37, outcome=0.9979501149289023],[36:0.9979501149289023:ID=36, outcome=0.9979501149289023],[50:0.9976088016105495:ID=50, outcome=0.9976088016105495],[47:0.9974285344516923:ID=47, outcome=0.9974285344516923],[53:0.9972132139947705:ID=53, outcome=0.9972132139947705],[49:0.9970607579512653:ID=49, outcome=0.9970607579512653],[42:0.996809025885373:ID=42, outcome=0.996809025885373],[62:0.9962177092958664:ID=62, outcome=0.9962177092958664],[57:0.9961595577263854:ID=57, outcome=0.9961595577263854],[56:0.9961595577263854:ID=56, outcome=0.9961595577263854],[54:0.9961595577263854:ID=54, outcome=0.9961595577263854],[46:0.99600419932602:ID=46, outcome=0.99600419932602],[41:0.9953785147807979:ID=41, outcome=0.9953785147807979],[58:0.9947350386218738:ID=58, outcome=0.9947350386218738],[55:0.9947350386218738:ID=55, outcome=0.9947350386218738],[48:0.9947350386218738:ID=48, outcome=0.9947350386218738],[60:0.9932812070305193:ID=60, outcome=0.9932812070305193],[51:0.9928551368806343:ID=51, outcome=0.9928551368806343],[35:0.9915350236744769:ID=35, outcome=0.9915350236744769],[45:0.9877787418105577:ID=45, outcome=0.9877787418105577],[59:0.9874370236826825:ID=59, outcome=0.9874370236826825],[64:0.9870422012103589:ID=64, outcome=0.9870422012103589],[63:0.9500499608280021:ID=63, outcome=0.9500499608280021],[40:0.9500499608280021:ID=40, outcome=0.9500499608280021],[61:0.9037863318889985:ID=61, outcome=0.9037863318889985])
FileItem: strFileID: [462]
strPath: [apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/servlets/CGIServlet.java]
strFileType: [ASCII C program text]
bEmpty: [false]
oLocations: [[[]]]

       Second Best ID: 52
     Second Best Name: CVE-2007-5461
            Date/time: Tue Sep 14 23:33:23 EDT 2010
Outcome o (classifier-specific): 0.999049708963642
     Similarity threshold (1-T): 0.999
             Computed raw P = o: 0.999049708963642
         Warning to be reported: true
          Computed normalized P: 0.999049708963642

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="8" tool_specific_id="8">
		<name cweid="22">Path Traversal (CWE-22)</name>
		<location id="467" line="237" path="apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/servlets/WebdavServlet.java">
			<fragment>
227:         try {
228:             value = getServletConfig().getInitParameter("secret");
229:             if (value != null) {
230:                 secret = value;
231:             }
232:         } catch (Exception e) {
233:             log("WebdavServlet.init: error reading secret from " + value);
234:         }
235: 
236: 
237:         if (getServletConfig().getInitParameter("maxDepth") != null)
238:             maxDepth = Integer.parseInt(
239:                     getServletConfig().getInitParameter("maxDepth"));
240: 
241:         // Load the MD5 helper used to calculate signatures.
242:         try {
243:             md5Helper = MessageDigest.getInstance("MD5");
244:         } catch (NoSuchAlgorithmException e) {
245:             throw new UnavailableException("No MD5");
246:         }
247: 
248:     }
249: 
250: 
251:     // ------------------------------------------------------ Protected Methods
252: 
253: 
254:     /**
255:      * Return JAXP document builder instance.
256:      */
257:     protected DocumentBuilder getDocumentBuilder()
258:         throws ServletException {
259:         DocumentBuilder documentBuilder = null;
260:         DocumentBuilderFactory documentBuilderFactory = null;
261:         try {
262:             documentBuilderFactory = DocumentBuilderFactory.newInstance();
263:             documentBuilderFactory.setNamespaceAware(true);
264:             documentBuilderFactory.setExpandEntityReferences(false);
265:             documentBuilder = documentBuilderFactory.newDocumentBuilder();

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Similarity.CosineSimilarityMeasure
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.

CVE details: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-5461
Possible explanation material:
=====================================
Type: path
CxE: [CVE-2007-5461]
SATE: Absolute path traversal vulnerability under certain configurations, allows
remote authenticated users to read arbitrary files via a WebDAV write request that
specifies an entity with a SYSTEM tag.
=====================================

			</explanation>
		</location>
		<grade
			severity="2"
			probability="0.9992508423557752"
			tool_specific_rank="0.9992508423557752"
		/>
		<output>
			<textoutput>
			
                 File: apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/servlets/WebdavServlet.java
              Path ID: 467
               Config: -nopreprep -raw -fft -cos 
      Processing time: 0d:0h:0m:0s:15ms:15ms
         Subject's ID: 52
   Subject identified: CVE-2007-5461
ResultSet: Raw ResultSet data:
[[35:0.9907538008399308:ID=35, outcome=0.9907538008399308], [60:0.9923722248403617:ID=60, outcome=0.9923722248403617], [57:0.9956004825725525:ID=57, outcome=0.9956004825725525], [56:0.9956004825725525:ID=56, outcome=0.9956004825725525], [54:0.9956004825725525:ID=54, outcome=0.9956004825725525], [62:0.9962649733925147:ID=62, outcome=0.9962649733925147], [51:0.9927584590914272:ID=51, outcome=0.9927584590914272], [42:0.9963495858647025:ID=42, outcome=0.9963495858647025], [20067197:0.9986861277154255:ID=20067197, outcome=0.9986861277154255], [43:0.9986861277154255:ID=43, outcome=0.9986861277154255], [49:0.9966066239010233:ID=49, outcome=0.9966066239010233], [45:0.987321509461364:ID=45, outcome=0.987321509461364], [53:0.9969464342920044:ID=53, outcome=0.9969464342920044], [38:0.9979171438894129:ID=38, outcome=0.9979171438894129], [37:0.9976396380459626:ID=37, outcome=0.9976396380459626], [36:0.9976396380459626:ID=36, outcome=0.9976396380459626], [39:0.998853659023574:ID=39, outcome=0.998853659023574], [44:0.9984743918637379:ID=44, outcome=0.9984743918637379], [47:0.9971340199271364:ID=47, outcome=0.9971340199271364], [52:0.9992508423557752:ID=52, outcome=0.9992508423557752], [46:0.9958678957105609:ID=46, outcome=0.9958678957105609], [41:0.9952940055740359:ID=41, outcome=0.9952940055740359], [50:0.9973931732207625:ID=50, outcome=0.9973931732207625], [61:0.9053681039017116:ID=61, outcome=0.9053681039017116], [58:0.9946735234760744:ID=58, outcome=0.9946735234760744], [55:0.9946735234760744:ID=55, outcome=0.9946735234760744], [48:0.9946735234760744:ID=48, outcome=0.9946735234760744], [59:0.9866466476340809:ID=59, outcome=0.9866466476340809], [64:0.9856532791369453:ID=64, outcome=0.9856532791369453], [63:0.9503435932553211:ID=63, outcome=0.9503435932553211], [40:0.9503435932553211:ID=40, outcome=0.9503435932553211]]

Sorted data:
([52:0.9992508423557752:ID=52, outcome=0.9992508423557752],[39:0.998853659023574:ID=39, outcome=0.998853659023574],[20067197:0.9986861277154255:ID=20067197, outcome=0.9986861277154255],[43:0.9986861277154255:ID=43, outcome=0.9986861277154255],[44:0.9984743918637379:ID=44, outcome=0.9984743918637379],[38:0.9979171438894129:ID=38, outcome=0.9979171438894129],[37:0.9976396380459626:ID=37, outcome=0.9976396380459626],[36:0.9976396380459626:ID=36, outcome=0.9976396380459626],[50:0.9973931732207625:ID=50, outcome=0.9973931732207625],[47:0.9971340199271364:ID=47, outcome=0.9971340199271364],[53:0.9969464342920044:ID=53, outcome=0.9969464342920044],[49:0.9966066239010233:ID=49, outcome=0.9966066239010233],[42:0.9963495858647025:ID=42, outcome=0.9963495858647025],[62:0.9962649733925147:ID=62, outcome=0.9962649733925147],[46:0.9958678957105609:ID=46, outcome=0.9958678957105609],[57:0.9956004825725525:ID=57, outcome=0.9956004825725525],[56:0.9956004825725525:ID=56, outcome=0.9956004825725525],[54:0.9956004825725525:ID=54, outcome=0.9956004825725525],[41:0.9952940055740359:ID=41, outcome=0.9952940055740359],[58:0.9946735234760744:ID=58, outcome=0.9946735234760744],[55:0.9946735234760744:ID=55, outcome=0.9946735234760744],[48:0.9946735234760744:ID=48, outcome=0.9946735234760744],[51:0.9927584590914272:ID=51, outcome=0.9927584590914272],[60:0.9923722248403617:ID=60, outcome=0.9923722248403617],[35:0.9907538008399308:ID=35, outcome=0.9907538008399308],[45:0.987321509461364:ID=45, outcome=0.987321509461364],[59:0.9866466476340809:ID=59, outcome=0.9866466476340809],[64:0.9856532791369453:ID=64, outcome=0.9856532791369453],[63:0.9503435932553211:ID=63, outcome=0.9503435932553211],[40:0.9503435932553211:ID=40, outcome=0.9503435932553211],[61:0.9053681039017116:ID=61, outcome=0.9053681039017116])
FileItem: strFileID: [467]
strPath: [apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/servlets/WebdavServlet.java]
strFileType: [ASCII C program text]
bEmpty: [false]
oLocations: [[[]]]

       Second Best ID: 39
     Second Best Name: CVE-2009-0783
            Date/time: Tue Sep 14 23:33:23 EDT 2010
Outcome o (classifier-specific): 0.9992508423557752
     Similarity threshold (1-T): 0.999
             Computed raw P = o: 0.9992508423557752
         Warning to be reported: true
          Computed normalized P: 0.9992508423557752

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="9" tool_specific_id="9">
		<name cweid="200">Information Leak / Disclosure (CWE-200)</name>
		<location id="512" line="992" path="apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/startup/ContextConfig.java">
			<fragment>
982:             webDigester = createWebDigester();
983:             webDigester.getParser();
984:         }
985:         
986:         if (contextDigester == null){
987:             contextDigester = createContextDigester();
988:             contextDigester.getParser();
989:         }
990: 
991:         if (log.isDebugEnabled())
992:             log.debug(sm.getString("contextConfig.init"));
993:         context.setConfigured(false);
994:         ok = true;
995:         
996:         contextConfig();
997:         
998:         try {
999:             fixDocBase();
1000:         } catch (IOException e) {
1001:             log.error(sm.getString("contextConfig.fixDocBase"), e);
1002:         }
1003:         
1004:     }
1005:     
1006:     
1007:     /**
1008:      * Process a "before start" event for this Context.
1009:      */

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Similarity.CosineSimilarityMeasure
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.

CVE details: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0783
Possible explanation material:
=====================================
Type: fix
CxE: [CVE-2009-0783]
SATE: A flaw in a web application to replace an XML parser used for other web applications,
allows local users to read or modify the web.xml, context.xml, or tld files of arbitrary web
applications via a crafted application that is loaded earlier than the target application.
=====================================

			</explanation>
		</location>
		<location id="512" line="324" path="apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/startup/ContextConfig.java">
			<fragment>
314:             }
315:         }
316:         if (stream == null) {
317:             if (log.isDebugEnabled()) {
318:                 log.debug(sm.getString("contextConfig.applicationMissing") + " " + context);
319:             }
320:             return;
321:         }
322:         
323:         long t1=System.currentTimeMillis();
324: 
325:         URL url=null;
326:         // Process the application web.xml file
327:         synchronized (webDigester) {
328:             try {
329:                 if (altDDName != null) {
330:                     url = new File(altDDName).toURL();
331:                 } else {
332:                     url = servletContext.getResource(
333:                                                 Constants.ApplicationWebXml);
334:                 }

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Similarity.CosineSimilarityMeasure
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.

CVE details: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0783
Possible explanation material:
=====================================
Type: fix
CxE: [CVE-2009-0783]
SATE: A flaw in a web application to replace an XML parser used for other web applications,
allows local users to read or modify the web.xml, context.xml, or tld files of arbitrary web
applications via a crafted application that is loaded earlier than the target application.
=====================================
Possible explanation material:
=====================================
Type: path
CxE: [CVE-2009-0783]
SATE: Note: the tests are not done in the 5.5.13 version so the line # in vulnerable test case
corresponds to a blank line in the method.
=====================================

			</explanation>
		</location>
		<location id="512" line="630" path="apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/startup/ContextConfig.java">
			<fragment>
620:         try {
621:             if ( ! file.exists() ) {
622:                 // Use getResource and getResourceAsStream
623:                 stream = getClass().getClassLoader()
624:                     .getResourceAsStream(resourceName);
625:                 if( stream != null ) {
626:                     source = new InputSource
627:                             (getClass().getClassLoader()
628:                             .getResource(resourceName).toString());
629:                 }
630:             } else {
631:                 source =
632:                     new InputSource("file://" + file.getAbsolutePath());
633:                 stream = new FileInputStream(file);
634:             }
635:         } catch (Exception e) {
636:             log.error(sm.getString("contextConfig.defaultMissing") 
637:                       + " " + resourceName + " " + file , e);
638:         }
639: 
640:         if (stream != null) {

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Similarity.CosineSimilarityMeasure
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.

CVE details: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0783
Possible explanation material:
=====================================
Type: fix
CxE: [CVE-2009-0783]
SATE: A flaw in a web application to replace an XML parser used for other web applications,
allows local users to read or modify the web.xml, context.xml, or tld files of arbitrary web
applications via a crafted application that is loaded earlier than the target application.
=====================================
Possible explanation material:
=====================================
Type: path
CxE: [CVE-2009-0783]
SATE: Note: the tests are not done in the 5.5.13 version so the line # in vulnerable test case
corresponds to a blank line in the method.
=====================================
Possible explanation material:
=====================================
Type: path
CxE: [CVE-2009-0783]
SATE: The root cause of this issue is the ContextConfig class creating the parser for web.xml whilst
it is using the webapp's classloader. This causes a problem if the app being processed includes an xml parser.
=====================================

			</explanation>
		</location>
		<location id="512" line="792" path="apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/startup/ContextConfig.java">
			<fragment>
782:                                  "" + e.getLineNumber(),
783:                                  "" + e.getColumnNumber()));
784:                 ok = false;
785:             } catch (Exception e) {
786:                 log.error(sm.getString("contextConfig.contextParse",
787:                         context.getName()), e);
788:                 ok = false;
789:             } finally {
790:                 contextDigester.reset();
791:                 parseException = null;
792:                 try {
793:                     if (stream != null) {
794:                         stream.close();
795:                     }
796:                 } catch (IOException e) {
797:                     log.error(sm.getString("contextConfig.contextClose"), e);
798:                 }
799:             }
800:         }
801:     }
802: 

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Similarity.CosineSimilarityMeasure
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.

CVE details: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0783
Possible explanation material:
=====================================
Type: fix
CxE: [CVE-2009-0783]
SATE: A flaw in a web application to replace an XML parser used for other web applications,
allows local users to read or modify the web.xml, context.xml, or tld files of arbitrary web
applications via a crafted application that is loaded earlier than the target application.
=====================================
Possible explanation material:
=====================================
Type: path
CxE: [CVE-2009-0783]
SATE: Note: the tests are not done in the 5.5.13 version so the line # in vulnerable test case
corresponds to a blank line in the method.
=====================================
Possible explanation material:
=====================================
Type: path
CxE: [CVE-2009-0783]
SATE: The root cause of this issue is the ContextConfig class creating the parser for web.xml whilst
it is using the webapp's classloader. This causes a problem if the app being processed includes an xml parser.
=====================================
Possible explanation material:
=====================================
Type: path
CxE: [CVE-2009-0783]
SATE: The TldConfig's parser can be initialized with the webapp's XML parser, which causes a security problem,
since it has permission issues with reading files.
=====================================

			</explanation>
		</location>
		<grade
			severity="2"
			probability="0.9992097631851173"
			tool_specific_rank="0.9992097631851173"
		/>
		<output>
			<textoutput>
			
                 File: apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/startup/ContextConfig.java
              Path ID: 512
               Config: -nopreprep -raw -fft -cos 
      Processing time: 0d:0h:0m:0s:17ms:17ms
         Subject's ID: 39
   Subject identified: CVE-2009-0783
ResultSet: Raw ResultSet data:
[[35:0.9914936418999122:ID=35, outcome=0.9914936418999122], [60:0.9930349579965478:ID=60, outcome=0.9930349579965478], [57:0.996003095573852:ID=57, outcome=0.996003095573852], [56:0.996003095573852:ID=56, outcome=0.996003095573852], [54:0.996003095573852:ID=54, outcome=0.996003095573852], [62:0.9963880774740119:ID=62, outcome=0.9963880774740119], [51:0.9927712140586167:ID=51, outcome=0.9927712140586167], [42:0.9963588645732118:ID=42, outcome=0.9963588645732118], [20067197:0.9982298380967679:ID=20067197, outcome=0.9982298380967679], [43:0.9982298380967679:ID=43, outcome=0.9982298380967679], [49:0.9966344974233584:ID=49, outcome=0.9966344974233584], [45:0.9883992350218641:ID=45, outcome=0.9883992350218641], [53:0.9969684037583767:ID=53, outcome=0.9969684037583767], [38:0.9981357099799469:ID=38, outcome=0.9981357099799469], [37:0.9983440590641921:ID=37, outcome=0.9983440590641921], [36:0.9983440590641921:ID=36, outcome=0.9983440590641921], [39:0.9992097631851173:ID=39, outcome=0.9992097631851173], [44:0.9985507880203296:ID=44, outcome=0.9985507880203296], [47:0.997373905497565:ID=47, outcome=0.997373905497565], [52:0.9986061874932294:ID=52, outcome=0.9986061874932294], [46:0.995908586235226:ID=46, outcome=0.995908586235226], [41:0.9951758396027163:ID=41, outcome=0.9951758396027163], [50:0.9975345082764253:ID=50, outcome=0.9975345082764253], [61:0.903705977902553:ID=61, outcome=0.903705977902553], [58:0.9951872705994015:ID=58, outcome=0.9951872705994015], [55:0.9951872705994015:ID=55, outcome=0.9951872705994015], [48:0.9951872705994015:ID=48, outcome=0.9951872705994015], [59:0.9870892105625654:ID=59, outcome=0.9870892105625654], [64:0.9868320317630809:ID=64, outcome=0.9868320317630809], [63:0.949379350221081:ID=63, outcome=0.949379350221081], [40:0.949379350221081:ID=40, outcome=0.949379350221081]]

Sorted data:
([39:0.9992097631851173:ID=39, outcome=0.9992097631851173],[52:0.9986061874932294:ID=52, outcome=0.9986061874932294],[44:0.9985507880203296:ID=44, outcome=0.9985507880203296],[37:0.9983440590641921:ID=37, outcome=0.9983440590641921],[36:0.9983440590641921:ID=36, outcome=0.9983440590641921],[20067197:0.9982298380967679:ID=20067197, outcome=0.9982298380967679],[43:0.9982298380967679:ID=43, outcome=0.9982298380967679],[38:0.9981357099799469:ID=38, outcome=0.9981357099799469],[50:0.9975345082764253:ID=50, outcome=0.9975345082764253],[47:0.997373905497565:ID=47, outcome=0.997373905497565],[53:0.9969684037583767:ID=53, outcome=0.9969684037583767],[49:0.9966344974233584:ID=49, outcome=0.9966344974233584],[62:0.9963880774740119:ID=62, outcome=0.9963880774740119],[42:0.9963588645732118:ID=42, outcome=0.9963588645732118],[57:0.996003095573852:ID=57, outcome=0.996003095573852],[56:0.996003095573852:ID=56, outcome=0.996003095573852],[54:0.996003095573852:ID=54, outcome=0.996003095573852],[46:0.995908586235226:ID=46, outcome=0.995908586235226],[58:0.9951872705994015:ID=58, outcome=0.9951872705994015],[55:0.9951872705994015:ID=55, outcome=0.9951872705994015],[48:0.9951872705994015:ID=48, outcome=0.9951872705994015],[41:0.9951758396027163:ID=41, outcome=0.9951758396027163],[60:0.9930349579965478:ID=60, outcome=0.9930349579965478],[51:0.9927712140586167:ID=51, outcome=0.9927712140586167],[35:0.9914936418999122:ID=35, outcome=0.9914936418999122],[45:0.9883992350218641:ID=45, outcome=0.9883992350218641],[59:0.9870892105625654:ID=59, outcome=0.9870892105625654],[64:0.9868320317630809:ID=64, outcome=0.9868320317630809],[63:0.949379350221081:ID=63, outcome=0.949379350221081],[40:0.949379350221081:ID=40, outcome=0.949379350221081],[61:0.903705977902553:ID=61, outcome=0.903705977902553])
FileItem: strFileID: [512]
strPath: [apache-tomcat-5.5.29-src/container/catalina/src/share/org/apache/catalina/startup/ContextConfig.java]
strFileType: [ASCII C program text]
bEmpty: [false]
oLocations: [[[]]]

       Second Best ID: 52
     Second Best Name: CVE-2007-5461
            Date/time: Tue Sep 14 23:33:23 EDT 2010
Outcome o (classifier-specific): 0.9992097631851173
     Similarity threshold (1-T): 0.999
             Computed raw P = o: 0.9992097631851173
         Warning to be reported: true
          Computed normalized P: 0.9992097631851173

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="10" tool_specific_id="10">
		<name cweid="200">Information Leak / Disclosure (CWE-200)</name>
		<location id="1654" line="2032" path="apache-tomcat-5.5.29-src/jasper/src/share/org/apache/jasper/compiler/Generator.java">
			<fragment>
2022:                     visitBody(n);
2023:                 }
2024:             }
2025:         }
2026: 
2027:         public void visit(Node.InvokeAction n) throws JasperException {
2028: 
2029:             n.setBeginJavaLine(out.getJavaLine());
2030: 
2031:             // Copy virtual page scope of tag file to page scope of invoking
2032:             // page
2033:             out.printil(
2034:                 "((org.apache.jasper.runtime.JspContextWrapper) this.jspContext).syncBeforeInvoke();");
2035:             String varReaderAttr = n.getTextAttribute("varReader");
2036:             String varAttr = n.getTextAttribute("var");
2037:             if (varReaderAttr != null || varAttr != null) {
2038:                 out.printil("_jspx_sout = new java.io.StringWriter();");
2039:             } else {
2040:                 out.printil("_jspx_sout = null;");
2041:             }
2042: 

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Similarity.CosineSimilarityMeasure
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.

CVE details: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0783

			</explanation>
		</location>
		<grade
			severity="2"
			probability="0.9990359095906137"
			tool_specific_rank="0.9990359095906137"
		/>
		<output>
			<textoutput>
			
                 File: apache-tomcat-5.5.29-src/jasper/src/share/org/apache/jasper/compiler/Generator.java
              Path ID: 1654
               Config: -nopreprep -raw -fft -cos 
      Processing time: 0d:0h:0m:0s:19ms:19ms
         Subject's ID: 39
   Subject identified: CVE-2009-0783
ResultSet: Raw ResultSet data:
[[35:0.9895263956001465:ID=35, outcome=0.9895263956001465], [60:0.9925670072054071:ID=60, outcome=0.9925670072054071], [57:0.9959492299556526:ID=57, outcome=0.9959492299556526], [56:0.9959492299556526:ID=56, outcome=0.9959492299556526], [54:0.9959492299556526:ID=54, outcome=0.9959492299556526], [62:0.996357408995123:ID=62, outcome=0.996357408995123], [51:0.9919363619237652:ID=51, outcome=0.9919363619237652], [42:0.9971095979449547:ID=42, outcome=0.9971095979449547], [20067197:0.9985612930320293:ID=20067197, outcome=0.9985612930320293], [43:0.9985612930320293:ID=43, outcome=0.9985612930320293], [49:0.9969244462978862:ID=49, outcome=0.9969244462978862], [45:0.987379409094422:ID=45, outcome=0.987379409094422], [53:0.9967667982540295:ID=53, outcome=0.9967667982540295], [38:0.998295152450542:ID=38, outcome=0.998295152450542], [37:0.9979469445434639:ID=37, outcome=0.9979469445434639], [36:0.9979469445434639:ID=36, outcome=0.9979469445434639], [39:0.9990359095906137:ID=39, outcome=0.9990359095906137], [44:0.9982898147757605:ID=44, outcome=0.9982898147757605], [47:0.9970445038177315:ID=47, outcome=0.9970445038177315], [52:0.9987209506408171:ID=52, outcome=0.9987209506408171], [46:0.9963200592412936:ID=46, outcome=0.9963200592412936], [41:0.9950875205805763:ID=41, outcome=0.9950875205805763], [50:0.9970086911946013:ID=50, outcome=0.9970086911946013], [61:0.90372521214727:ID=61, outcome=0.90372521214727], [58:0.9942441244804353:ID=58, outcome=0.9942441244804353], [55:0.9942441244804353:ID=55, outcome=0.9942441244804353], [48:0.9942441244804353:ID=48, outcome=0.9942441244804353], [59:0.9865200637775302:ID=59, outcome=0.9865200637775302], [64:0.9857120714290779:ID=64, outcome=0.9857120714290779], [63:0.949133334785494:ID=63, outcome=0.949133334785494], [40:0.949133334785494:ID=40, outcome=0.949133334785494]]

Sorted data:
([39:0.9990359095906137:ID=39, outcome=0.9990359095906137],[52:0.9987209506408171:ID=52, outcome=0.9987209506408171],[20067197:0.9985612930320293:ID=20067197, outcome=0.9985612930320293],[43:0.9985612930320293:ID=43, outcome=0.9985612930320293],[38:0.998295152450542:ID=38, outcome=0.998295152450542],[44:0.9982898147757605:ID=44, outcome=0.9982898147757605],[37:0.9979469445434639:ID=37, outcome=0.9979469445434639],[36:0.9979469445434639:ID=36, outcome=0.9979469445434639],[42:0.9971095979449547:ID=42, outcome=0.9971095979449547],[47:0.9970445038177315:ID=47, outcome=0.9970445038177315],[50:0.9970086911946013:ID=50, outcome=0.9970086911946013],[49:0.9969244462978862:ID=49, outcome=0.9969244462978862],[53:0.9967667982540295:ID=53, outcome=0.9967667982540295],[62:0.996357408995123:ID=62, outcome=0.996357408995123],[46:0.9963200592412936:ID=46, outcome=0.9963200592412936],[57:0.9959492299556526:ID=57, outcome=0.9959492299556526],[56:0.9959492299556526:ID=56, outcome=0.9959492299556526],[54:0.9959492299556526:ID=54, outcome=0.9959492299556526],[41:0.9950875205805763:ID=41, outcome=0.9950875205805763],[58:0.9942441244804353:ID=58, outcome=0.9942441244804353],[55:0.9942441244804353:ID=55, outcome=0.9942441244804353],[48:0.9942441244804353:ID=48, outcome=0.9942441244804353],[60:0.9925670072054071:ID=60, outcome=0.9925670072054071],[51:0.9919363619237652:ID=51, outcome=0.9919363619237652],[35:0.9895263956001465:ID=35, outcome=0.9895263956001465],[45:0.987379409094422:ID=45, outcome=0.987379409094422],[59:0.9865200637775302:ID=59, outcome=0.9865200637775302],[64:0.9857120714290779:ID=64, outcome=0.9857120714290779],[63:0.949133334785494:ID=63, outcome=0.949133334785494],[40:0.949133334785494:ID=40, outcome=0.949133334785494],[61:0.90372521214727:ID=61, outcome=0.90372521214727])
FileItem: strFileID: [1654]
strPath: [apache-tomcat-5.5.29-src/jasper/src/share/org/apache/jasper/compiler/Generator.java]
strFileType: [ASCII C program text]
bEmpty: [false]
oLocations: [[[]]]

       Second Best ID: 52
     Second Best Name: CVE-2007-5461
            Date/time: Tue Sep 14 23:33:32 EDT 2010
Outcome o (classifier-specific): 0.9990359095906137
     Similarity threshold (1-T): 0.999
             Computed raw P = o: 0.9990359095906137
         Warning to be reported: true
          Computed normalized P: 0.9990359095906137

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
</report>
