<?xml version="1.0" encoding="UTF-8"?>
<report tool_name="SATE" tool_version="2010">
  <weakness id="1">
    <name>CVE-2009-3548</name>
    <location line="560" length="1" type="sink" path="apache-tomcat-5.5.13-src/build/tomcat.nsi">
      <fragment><![CDATA[
550	  IfSilent Silent 0
551	
552	  ; Escape XML
553	  Push $R1
554	  Call xmlEscape
555	  Pop $R1
556	  Push $R2
557	  Call xmlEscape
558	  Pop $R2
559	  
560 **	  StrCpy $R5 '<user name="$R1" password="$R2" roles="admin,manager" />'
561	
562	Silent:
563	  DetailPrint 'HTTP/1.1 Connector configured on port "$R0"'
564	  DetailPrint 'Admin user added: "$R1"'
565	
566	  SetOutPath $TEMP
567	  File /r confinstall
568	
569	  ; Build final server.xml
570	  Delete "$INSTDIR\conf\server.xml"
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>When a user/password is not entered during setup, an administrator is created with a blank username and password. Fix checks whether variables $R1 and $R2 are blank.</textoutput>
    </output>
  </weakness>
  <weakness id="2">
    <name>CVE-2009-2902</name>
    <location line="157" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ExpandWar.java">
      <fragment><![CDATA[
147	                    File parent = new File(docBase,
148	                                           name.substring(0, last));
149	                    parent.mkdirs();
150	                }
151	                if (name.endsWith("/")) {
152	                    continue;
153	                }
154	                input = jarFile.getInputStream(jarEntry);
155	
156	                // Bugzilla 33636
157 **	                File expandedFile = expand(input, docBase, name);
158	                long lastModified = jarEntry.getTime();
159	                if ((lastModified != -1) && (lastModified != 0) && (expandedFile != null)) {
160	                    expandedFile.setLastModified(lastModified);
161	                }
162	
163	                input.close();
164	                input = null;
165	            }
166	        } catch (IOException e) {
167	            // If something went wrong, delete expanded dir to keep things 
      ]]></fragment>
      <explanation>Expands the WAR without checking for directory traveral. The sink should be somewhere in the "expand()" or "delete()" methods.</explanation>
    </location>
    <location line="889" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ContextConfig.java">
      <fragment><![CDATA[
879	            docBase = file.getCanonicalPath();
880	        }
881	        file = new File(docBase);
882	
883	        if (docBase.toLowerCase().endsWith(".war") && !file.isDirectory() && unpackWARs) {
884	            URL war = new URL("jar:" + (new File(docBase)).toURL() + "!/");
885	            String contextPath = context.getPath();
886	            if (contextPath.equals("")) {
887	                contextPath = "ROOT";
888	            }
889 **	            docBase = ExpandWar.expand(host, war, contextPath);
890	            file = new File(docBase);
891	            docBase = file.getCanonicalPath();
892	        } else {
893	            File docDir = new File(docBase);
894	            if (!docDir.exists()) {
895	                File warFile = new File(docBase + ".war");
896	                if (warFile.exists()) {
897	                    if (unpackWARs) {
898	                        URL war = new URL("jar:" + warFile.toURL() + "!/");
899	                        docBase = ExpandWar.expand(host, war, context.getPath());
      ]]></fragment>
      <explanation>Potentially earlier in the execution path</explanation>
    </location>
    <location line="899" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ContextConfig.java">
      <fragment><![CDATA[
889	            docBase = ExpandWar.expand(host, war, contextPath);
890	            file = new File(docBase);
891	            docBase = file.getCanonicalPath();
892	        } else {
893	            File docDir = new File(docBase);
894	            if (!docDir.exists()) {
895	                File warFile = new File(docBase + ".war");
896	                if (warFile.exists()) {
897	                    if (unpackWARs) {
898	                        URL war = new URL("jar:" + warFile.toURL() + "!/");
899 **	                        docBase = ExpandWar.expand(host, war, context.getPath());
900	                        file = new File(docBase);
901	                        docBase = file.getCanonicalPath();
902	                    } else {
903	                        docBase = warFile.getCanonicalPath();
904	                    }
905	                }
906	            }
907	        }
908	
909	        if (docBase.startsWith(canonicalAppBase.getPath())) {
      ]]></fragment>
    </location>
    <location line="1252" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ContextConfig.java">
      <fragment><![CDATA[
1242	
1243	        // Remove (partially) folders and files created by antiLocking
1244	        Host host = (Host) context.getParent();
1245	        String appBase = host.getAppBase();
1246	        String docBase = context.getDocBase();
1247	        if ((docBase != null) && (originalDocBase != null)) {
1248	            File docBaseFile = new File(docBase);
1249	            if (!docBaseFile.isAbsolute()) {
1250	                docBaseFile = new File(appBase, docBase);
1251	            }
1252 **	            ExpandWar.delete(docBaseFile);
1253	        }
1254	        
1255	        ok = true;
1256	
1257	    }
1258	    
1259	    
1260	    /**
1261	     * Process a "destroy" event for this Context.
1262	     */
      ]]></fragment>
      <explanation>Usually, a file named "app.war" will be first extracted in a directory called "app/". I believe this location is where the application directory is removed. Now, if the WAR file is "...war", the directory would be "../", which would deleted the parent directory.</explanation>
    </location>
    <location line="264" length="1" type="sink" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ExpandWar.java">
      <fragment><![CDATA[
254	    /**
255	     * Delete the specified directory, including all of its contents and
256	     * subdirectories recursively.
257	     *
258	     * @param dir File object representing the directory to be deleted
259	     */
260	    public static boolean delete(File dir) {
261	        if (dir.isDirectory()) {
262	            return deleteDir(dir);
263	        } else {
264 **	            return dir.delete();
265	        }
266	    }
267	    
268	    
269	    /**
270	     * Delete the specified directory, including all of its contents and
271	     * subdirectories recursively.
272	     *
273	     * @param dir File object representing the directory to be deleted
274	     */
      ]]></fragment>
      <explanation>This and the following lines are possible sinks</explanation>
    </location>
    <location line="286" length="1" type="sink" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ExpandWar.java">
      <fragment><![CDATA[
276	
277	        String files[] = dir.list();
278	        if (files == null) {
279	            files = new String[0];
280	        }
281	        for (int i = 0; i < files.length; i++) {
282	            File file = new File(dir, files[i]);
283	            if (file.isDirectory()) {
284	                deleteDir(file);
285	            } else {
286 **	                file.delete();
287	            }
288	        }
289	        return dir.delete();
290	
291	    }
292	
293	
294	    /**
295	     * Expand the specified input stream into the specified directory, creating
296	     * a file named from the specified relative path.
      ]]></fragment>
    </location>
    <location line="289" length="1" type="sink" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ExpandWar.java">
      <fragment><![CDATA[
279	            files = new String[0];
280	        }
281	        for (int i = 0; i < files.length; i++) {
282	            File file = new File(dir, files[i]);
283	            if (file.isDirectory()) {
284	                deleteDir(file);
285	            } else {
286	                file.delete();
287	            }
288	        }
289 **	        return dir.delete();
290	
291	    }
292	
293	
294	    /**
295	     * Expand the specified input stream into the specified directory, creating
296	     * a file named from the specified relative path.
297	     *
298	     * @param input InputStream to be copied
299	     * @param docBase Document base directory into which we are expanding
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>Expands the WAR without checking for directory traveral. The sink should be somewhere in the "expand()" or "delete()" methods.</textoutput>
    </output>
  </weakness>
  <weakness id="3">
    <name>CVE-2009-2901</name>
    <location line="1252" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ContextConfig.java">
      <fragment><![CDATA[
1242	
1243	        // Remove (partially) folders and files created by antiLocking
1244	        Host host = (Host) context.getParent();
1245	        String appBase = host.getAppBase();
1246	        String docBase = context.getDocBase();
1247	        if ((docBase != null) && (originalDocBase != null)) {
1248	            File docBaseFile = new File(docBase);
1249	            if (!docBaseFile.isAbsolute()) {
1250	                docBaseFile = new File(appBase, docBase);
1251	            }
1252 **	            ExpandWar.delete(docBaseFile);
1253	        }
1254	        
1255	        ok = true;
1256	
1257	    }
1258	    
1259	    
1260	    /**
1261	     * Process a "destroy" event for this Context.
1262	     */
      ]]></fragment>
    </location>
    <location line="169" length="5" type="fix" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ExpandWar.java">
      <fragment><![CDATA[
159	                if ((lastModified != -1) && (lastModified != 0) && (expandedFile != null)) {
160	                    expandedFile.setLastModified(lastModified);
161	                }
162	
163	                input.close();
164	                input = null;
165	            }
166	        } catch (IOException e) {
167	            // If something went wrong, delete expanded dir to keep things 
168	            // clean
169 **	            deleteDir(docBase);
170 **	            throw e;
171 **	        } finally {
172 **	            if (input != null) {
173 **	                try {
174	                    input.close();
175	                } catch (Throwable t) {
176	                    ;
177	                }
178	                input = null;
179	            }
180	            if (jarFile != null) {
181	                try {
182	                    jarFile.close();
183	                } catch (Throwable t) {
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>Autodeploy leaves older (possibly vulnerable) files in place from a previous undeploy. This could allow an attacker to exploit vulnerabilities that existed in an older version. The fix improves handling of a failed undeploy by deleting leftover files</textoutput>
    </output>
  </weakness>
  <weakness id="4">
    <name>CVE-2009-2693</name>
    <location line="157" length="8" type="fix" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ExpandWar.java">
      <fragment><![CDATA[
147	                    File parent = new File(docBase,
148	                                           name.substring(0, last));
149	                    parent.mkdirs();
150	                }
151	                if (name.endsWith("/")) {
152	                    continue;
153	                }
154	                input = jarFile.getInputStream(jarEntry);
155	
156	                // Bugzilla 33636
157 **	                File expandedFile = expand(input, docBase, name);
158 **	                long lastModified = jarEntry.getTime();
159 **	                if ((lastModified != -1) && (lastModified != 0) && (expandedFile != null)) {
160 **	                    expandedFile.setLastModified(lastModified);
161 **	                }
162 **	
163 **	                input.close();
164 **	                input = null;
165	            }
166	        } catch (IOException e) {
167	            // If something went wrong, delete expanded dir to keep things 
168	            // clean
169	            deleteDir(docBase);
170	            throw e;
171	        } finally {
172	            if (input != null) {
173	                try {
174	                    input.close();
      ]]></fragment>
    </location>
    <location line="1961" length="6" type="fix" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/loader/WebappClassLoader.java">
      <fragment><![CDATA[
1951	                        File resourceFile = new File
1952	                            (loaderDir, jarEntry.getName());
1953	                        if (!resourceFile.exists()) {
1954	                            Enumeration entries = jarFiles[i].entries();
1955	                            while (entries.hasMoreElements()) {
1956	                                JarEntry jarEntry2 = 
1957	                                    (JarEntry) entries.nextElement();
1958	                                if (!(jarEntry2.isDirectory()) 
1959	                                    && (!jarEntry2.getName().endsWith
1960	                                        (".class"))) {
1961 **	                                    resourceFile = new File
1962 **	                                        (loaderDir, jarEntry2.getName());
1963 **	                                    resourceFile.getParentFile().mkdirs();
1964 **	                                    FileOutputStream os = null;
1965 **	                                    InputStream is = null;
1966 **	                                    try {
1967	                                        is = jarFiles[i].getInputStream
1968	                                            (jarEntry2);
1969	                                        os = new FileOutputStream
1970	                                            (resourceFile);
1971	                                        while (true) {
1972	                                            int n = is.read(buf);
1973	                                            if (n <= 0) {
1974	                                                break;
1975	                                            }
1976	                                            os.write(buf, 0, n);
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>Checks if the filename starts with the full path it is supposed to be extracted to.</textoutput>
      <textoutput>Note: the exception is not thrown in the 5.5.13 version, so there is not a real comparison between versions</textoutput>
    </output>
  </weakness>
  <weakness id="5">
    <name>CVE-2009-0783</name>
    <location line="992" length="8" type="fix" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ContextConfig.java">
      <fragment><![CDATA[
982	        }
983	        
984	    }
985	    
986	
987	    /**
988	     * Process a "init" event for this Context.
989	     */
990	    protected void init() {
991	        // Called from StandardContext.init()
992 **	
993 **	        if (log.isDebugEnabled())
994 **	            log.debug(sm.getString("contextConfig.init"));
995 **	        context.setConfigured(false);
996 **	        ok = true;
997 **	        
998 **	        contextConfig();
999 **	        
1000	        try {
1001	            fixDocBase();
1002	        } catch (IOException e) {
1003	            log.error(sm.getString("contextConfig.fixDocBase"), e);
1004	        }
1005	        
1006	    }
1007	    
1008	    
1009	    /**
      ]]></fragment>
    </location>
    <location line="324" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ContextConfig.java">
      <fragment><![CDATA[
314	            }
315	        }
316	        if (stream == null) {
317	            log.info(sm.getString("contextConfig.applicationMissing") + " " + context);
318	            return;
319	        }
320	        
321	        long t1=System.currentTimeMillis();
322	
323	        if (webDigester == null){
324 **	            webDigester = createWebDigester();
325	        }
326	        
327	        URL url=null;
328	        // Process the application web.xml file
329	        synchronized (webDigester) {
330	            try {
331	                if (altDDName != null) {
332	                    url = new File(altDDName).toURL();
333	                } else {
334	                    url = servletContext.getResource(
      ]]></fragment>
    </location>
    <location line="630" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ContextConfig.java">
      <fragment><![CDATA[
620	                source =
621	                    new InputSource("file://" + file.getAbsolutePath());
622	                stream = new FileInputStream(file);
623	            }
624	        } catch (Exception e) {
625	            log.error(sm.getString("contextConfig.defaultMissing") 
626	                      + " " + defaultWebXml + " " + file , e);
627	        }
628	
629	        if (webDigester == null){
630 **	            webDigester = createWebDigester();
631	        }
632	        
633	        if (stream != null) {
634	            processDefaultWebConfig(webDigester, stream, source);
635	            webRuleSet.recycle();
636	        }
637	
638	        long t2=System.currentTimeMillis();
639	        if( (t2-t1) > 200 )
640	            log.debug("Processed default web.xml " + file + " "  + ( t2-t1));
      ]]></fragment>
    </location>
    <location line="792" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ContextConfig.java">
      <fragment><![CDATA[
782	                context.addWatchedResource(file.getAbsolutePath());
783	            }
784	        } catch (Exception e) {
785	            log.error(sm.getString("contextConfig.defaultMissing") 
786	                      + " " + resourceName + " " + file , e);
787	        }
788	        
789	        if (source == null)
790	            return;
791	        if (contextDigester == null){
792 **	            contextDigester = createContextDigester();
793	        }
794	        synchronized (contextDigester) {
795	            try {
796	                source.setByteStream(stream);
797	                contextDigester.setClassLoader(this.getClass().getClassLoader());
798	                contextDigester.setUseContextClassLoader(false);
799	                contextDigester.push(context.getParent());
800	                contextDigester.push(context);
801	                contextDigester.setErrorHandler(new ContextErrorHandler());
802	                contextDigester.parse(source);
      ]]></fragment>
    </location>
    <location line="4107" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/core/StandardContext.java">
      <fragment><![CDATA[
4097	                        ((Lifecycle) children[i]).start();
4098	                }
4099	
4100	                // Start the Valves in our pipeline (including the basic),
4101	                // if any
4102	                if (pipeline instanceof Lifecycle) {
4103	                    ((Lifecycle) pipeline).start();
4104	                }
4105	                
4106	                if(getProcessTlds()) {
4107 **	                    processTlds();
4108	                }
4109	                
4110	                // Notify our interested LifecycleListeners
4111	                lifecycle.fireLifecycleEvent(START_EVENT, null);
4112	
4113	                // Start manager
4114	                if ((manager != null) && (manager instanceof Lifecycle)) {
4115	                    ((Lifecycle) getManager()).start();
4116	                }
4117	
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>A flaw in a web application to replace an XML parser used for other web applications, allows local users to read or modify the web.xml, context.xml, or tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.</textoutput>
      <textoutput>Note: the tests are not done in the 5.5.13 version so the line # in vulnerable test case corresponds to a blank line in the function</textoutput>
      <textoutput>The root cause of this issue is the ContextConfig class creating the parser for web.xml whilst it is using the webapp's classloader. This causes a problem if the app being processed includes an xml parser.</textoutput>
      <textoutput>The TldConfig's parser can be initialized with the webapp's XML parser, which causes a security problem, since it has permission issues with reading files.</textoutput>
    </output>
  </weakness>
  <weakness id="6">
    <name>CVE-2009-0580</name>
    <location line="162" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/realm/MemoryRealm.java">
      <fragment><![CDATA[
152	     * @param username Username of the Principal to look up
153	     * @param credentials Password or other credentials to use in
154	     *  authenticating this username
155	     */
156	    public Principal authenticate(String username, String credentials) {
157	
158	        GenericPrincipal principal =
159	            (GenericPrincipal) principals.get(username);
160	
161	        boolean validated = false;
162 **	        if (principal != null) {
163	            if (hasMessageDigest()) {
164	                // Hex hashes should be compared case-insensitive
165	                validated = (digest(credentials)
166	                             .equalsIgnoreCase(principal.getPassword()));
167	            } else {
168	                validated =
169	                    (digest(credentials).equals(principal.getPassword()));
170	            }
171	        }
172	
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>An improper error checking in the MemoryRealm, DataSourceRealm, and JDBCRealm authentication realms, when FORM authentication is used, allows a remote attacker to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, as demonstrated by a percent value for the j_password parameter. </textoutput>
    </output>
  </weakness>
  <weakness id="7">
    <name>CVE-2009-0033</name>
    <location line="270" length="7" type="fix" path="apache-tomcat-5.5.13-src/connectors/jk/java/org/apache/jk/common/HandlerRequest.java">
      <fragment><![CDATA[
260	                decodeRequest( msg, ep, tmpMB );
261	                if (twa != null) {
262	                    twa.setCurrentStage(control, "JkService");
263	                    twa.setParam(control,
264	                                 ((Request)ep.getRequest()).unparsedURI());
265	                }
266	            } catch( Exception ex ) {
267	                log.error( "Error decoding request ", ex );
268	                msg.dump( "Incomming message");
269	                return ERROR;
270 **	            }
271 **	
272 **	            if( requiredSecret != null ) {
273 **	                String epSecret=(String)ep.getNote( secretNote );
274 **	                if( epSecret==null || ! requiredSecret.equals( epSecret ) )
275 **	                    return ERROR;
276 **	            }
277	            /* XXX it should be computed from request, by workerEnv */
278	            if(log.isDebugEnabled() )
279	                log.debug("Calling next " + next.getName() + " " +
280	                  next.getClass().getName());
281	
282	            int err= next.invoke( msg, ep );
283	            if (twa != null) {
284	                twa.setCurrentStage(control, "JkDone");
285	            }
286	
      ]]></fragment>
    </location>
    <location line="266" length="4" type="path" path="apache-tomcat-5.5.13-src/connectors/jk/java/org/apache/jk/common/HandlerRequest.java">
      <fragment><![CDATA[
256	            try {
257	                if (twa != null) {
258	                    twa.setCurrentStage(control, "JkDecode");
259	                }
260	                decodeRequest( msg, ep, tmpMB );
261	                if (twa != null) {
262	                    twa.setCurrentStage(control, "JkService");
263	                    twa.setParam(control,
264	                                 ((Request)ep.getRequest()).unparsedURI());
265	                }
266 **	            } catch( Exception ex ) {
267 **	                log.error( "Error decoding request ", ex );
268 **	                msg.dump( "Incomming message");
269 **	                return ERROR;
270	            }
271	
272	            if( requiredSecret != null ) {
273	                String epSecret=(String)ep.getNote( secretNote );
274	                if( epSecret==null || ! requiredSecret.equals( epSecret ) )
275	                    return ERROR;
276	            }
277	            /* XXX it should be computed from request, by workerEnv */
278	            if(log.isDebugEnabled() )
279	                log.debug("Calling next " + next.getName() + " " +
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>A bug in load balancing code allows a denial of service attack through a crafted request with invalid headers. The fix adds code to properly return a 400 error (bad request) when this type of message is recieved</textoutput>
    </output>
  </weakness>
  <weakness id="8">
    <name>CVE-2008-5519</name>
    <location line="1326" length="6" type="path" path="apache-tomcat-5.5.13-src/connectors/jk/native/common/jk_ajp_common.c">
      <fragment><![CDATA[
1316	           Sending this data for chunked would break other ajp13 servers.
1317	
1318	           Note that chunking will continue to work - using the normal read.
1319	         */
1320	
1321	        if (ae->left_bytes_to_send > 0) {
1322	            int len = ae->left_bytes_to_send;
1323	            if (len > AJP13_MAX_SEND_BODY_SZ) {
1324	                len = AJP13_MAX_SEND_BODY_SZ;
1325	            }
1326 **	            if ((len = ajp_read_into_msg_buff(ae, s, op->post, len, l)) < 0) {
1327 **	                /* the browser stop sending data, no need to recover */
1328 **	                op->recoverable = JK_FALSE;
1329 **	                JK_TRACE_EXIT(l);
1330 **	                return len;
1331 **	            }
1332	
1333	            /* If a RECOVERY buffer is available in LB mode, fill it */
1334	            if (s->reco_status == RECO_INITED) {
1335	                jk_b_copy(op->post, s->reco_buf);
1336	                s->reco_status = RECO_FILLED;
1337	            }
1338	
1339	            s->content_read = len;
1340	            if (ajp_connection_tcp_send_message(ae, op->post, l) != JK_TRUE) {
1341	                jk_log(l, JK_LOG_ERROR, "Error sending request body");
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>C code only. Not applicable to the Java track.</textoutput>
      <textoutput>A faulty client setting content-length without providing data or a series of rapid repeated requests could allow a user to view the response intended for another user</textoutput>
      <textoutput>See http://tomcat.apache.org/security-jk.html Connector not included in Tomcat since version 5.5.28</textoutput>
    </output>
  </weakness>
  <weakness id="9">
    <name>CVE-2008-5515</name>
    <location line="380" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/core/ApplicationContext.java">
      <fragment><![CDATA[
370	     */
371	    public RequestDispatcher getRequestDispatcher(String path) {
372	
373	        // Validate the path argument
374	        if (path == null)
375	            return (null);
376	        if (!path.startsWith("/"))
377	            throw new IllegalArgumentException
378	                (sm.getString
379	                 ("applicationContext.requestDispatcher.iae", path));
380 **	        path = normalize(path);
381	        if (path == null)
382	            return (null);
383	
384	        // Retrieve the thread local URI
385	        MessageBytes uriMB = (MessageBytes) localUriMB.get();
386	        if (uriMB == null) {
387	            uriMB = MessageBytes.newInstance();
388	            CharChunk uriCC = uriMB.getCharChunk();
389	            uriCC.setLimit(-1);
390	            localUriMB.set(uriMB);
      ]]></fragment>
    </location>
    <location line="474" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/core/ApplicationContext.java">
      <fragment><![CDATA[
464	     * @exception MalformedURLException if the path is not given
465	     *  in the correct form
466	     */
467	    public URL getResource(String path)
468	        throws MalformedURLException {
469	
470	        if (path == null || !path.startsWith("/")) {
471	            throw new MalformedURLException(sm.getString("applicationContext.requestDispatcher.iae", path));
472	        }
473	        
474 **	        path = normalize(path);
475	        if (path == null)
476	            return (null);
477	
478	        String libPath = "/WEB-INF/lib/";
479	        if ((path.startsWith(libPath)) && (path.endsWith(".jar"))) {
480	            File jarFile = null;
481	            if (context.isFilesystemBased()) {
482	                jarFile = new File(basePath, path);
483	            } else {
484	                jarFile = new File(context.getWorkPath(), path);
      ]]></fragment>
    </location>
    <location line="523" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/core/ApplicationContext.java">
      <fragment><![CDATA[
513	    /**
514	     * Return the requested resource as an <code>InputStream</code>.  The
515	     * path must be specified according to the rules described under
516	     * <code>getResource</code>.  If no such resource can be identified,
517	     * return <code>null</code>.
518	     *
519	     * @param path The path to the desired resource.
520	     */
521	    public InputStream getResourceAsStream(String path) {
522	
523 **	        path = normalize(path);
524	        if (path == null)
525	            return (null);
526	
527	        DirContext resources = context.getResources();
528	        if (resources != null) {
529	            try {
530	                Object resource = resources.lookup(path);
531	                if (resource instanceof Resource)
532	                    return (((Resource) resource).streamContent());
533	            } catch (Exception e) {
      ]]></fragment>
    </location>
    <location line="559" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/core/ApplicationContext.java">
      <fragment><![CDATA[
549	
550	        // Validate the path argument
551	        if (path == null) {
552	            return null;
553	        }
554	        if (!path.startsWith("/")) {
555	            throw new IllegalArgumentException
556	                (sm.getString("applicationContext.resourcePaths.iae", path));
557	        }
558	
559 **	        path = normalize(path);
560	        if (path == null)
561	            return (null);
562	
563	        DirContext resources = context.getResources();
564	        if (resources != null) {
565	            return (getResourcePathsInternal(resources, path));
566	        }
567	        return (null);
568	
569	    }
      ]]></fragment>
    </location>
    <location line="1239" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/connector/Request.java">
      <fragment><![CDATA[
1229	
1230	        if (pathInfo == null) {
1231	            requestPath = servletPath;
1232	        } else {
1233	            requestPath = servletPath + pathInfo;
1234	        }
1235	
1236	        int pos = requestPath.lastIndexOf('/');
1237	        String relative = null;
1238	        if (pos >= 0) {
1239 **	            relative = RequestUtil.normalize
1240	                (requestPath.substring(0, pos + 1) + path);
1241	        } else {
1242	            relative = RequestUtil.normalize(requestPath + path);
1243	        }
1244	
1245	        return (context.getServletContext().getRequestDispatcher(relative));
1246	
1247	    }
1248	
1249	
      ]]></fragment>
    </location>
    <location line="1242" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/connector/Request.java">
      <fragment><![CDATA[
1232	        } else {
1233	            requestPath = servletPath + pathInfo;
1234	        }
1235	
1236	        int pos = requestPath.lastIndexOf('/');
1237	        String relative = null;
1238	        if (pos >= 0) {
1239	            relative = RequestUtil.normalize
1240	                (requestPath.substring(0, pos + 1) + path);
1241	        } else {
1242 **	            relative = RequestUtil.normalize(requestPath + path);
1243	        }
1244	
1245	        return (context.getServletContext().getRequestDispatcher(relative));
1246	
1247	    }
1248	
1249	
1250	    /**
1251	     * Return the scheme used to make this Request.
1252	     */
      ]]></fragment>
    </location>
    <location line="320" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/core/ApplicationHttpRequest.java">
      <fragment><![CDATA[
310	
311	        if (pathInfo == null) {
312	            requestPath = servletPath;
313	        } else {
314	            requestPath = servletPath + pathInfo;
315	        }
316	
317	        int pos = requestPath.lastIndexOf('/');
318	        String relative = null;
319	        if (pos >= 0) {
320 **	            relative = RequestUtil.normalize
321	                (requestPath.substring(0, pos + 1) + path);
322	        } else {
323	            relative = RequestUtil.normalize(requestPath + path);
324	        }
325	
326	        return (context.getServletContext().getRequestDispatcher(relative));
327	
328	    }
329	
330	
      ]]></fragment>
    </location>
    <location line="323" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/core/ApplicationHttpRequest.java">
      <fragment><![CDATA[
313	        } else {
314	            requestPath = servletPath + pathInfo;
315	        }
316	
317	        int pos = requestPath.lastIndexOf('/');
318	        String relative = null;
319	        if (pos >= 0) {
320	            relative = RequestUtil.normalize
321	                (requestPath.substring(0, pos + 1) + path);
322	        } else {
323 **	            relative = RequestUtil.normalize(requestPath + path);
324	        }
325	
326	        return (context.getServletContext().getRequestDispatcher(relative));
327	
328	    }
329	
330	
331	    // --------------------------------------------- HttpServletRequest Methods
332	
333	
      ]]></fragment>
    </location>
    <location line="1557" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/servlets/WebdavServlet.java">
      <fragment><![CDATA[
1547	                if (firstSeparator < 0) {
1548	                    destinationPath = "/";
1549	                } else {
1550	                    destinationPath =
1551	                        destinationPath.substring(firstSeparator);
1552	                }
1553	            }
1554	        }
1555	
1556	        // Normalise destination path (remove '.' and '..')
1557 **	        destinationPath = normalize(destinationPath);
1558	
1559	        String contextPath = req.getContextPath();
1560	        if ((contextPath != null) &&
1561	            (destinationPath.startsWith(contextPath))) {
1562	            destinationPath = destinationPath.substring(contextPath.length());
1563	        }
1564	
1565	        String pathInfo = req.getPathInfo();
1566	        if (pathInfo != null) {
1567	            String servletPath = req.getServletPath();
      ]]></fragment>
    </location>
    <location line="2304" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/servlets/WebdavServlet.java">
      <fragment><![CDATA[
2294	
2295	        // Generating href element
2296	        generatedXML.writeElement(null, "href", XMLWriter.OPENING);
2297	
2298	        String absoluteUri = req.getRequestURI();
2299	        String relativePath = getRelativePath(req);
2300	        String toAppend = path.substring(relativePath.length());
2301	        if (!toAppend.startsWith("/"))
2302	            toAppend = "/" + toAppend;
2303	
2304 **	        generatedXML.writeText(rewriteUrl(normalize(absoluteUri + toAppend)));
2305	
2306	        generatedXML.writeElement(null, "href", XMLWriter.CLOSING);
2307	
2308	        String resourceName = path;
2309	        int lastSlash = path.lastIndexOf('/');
2310	        if (lastSlash != -1)
2311	            resourceName = resourceName.substring(lastSlash + 1);
2312	
2313	        switch (type) {
2314	
      ]]></fragment>
    </location>
    <location line="369" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/ssi/SSIServletExternalResolver.java">
      <fragment><![CDATA[
359	
360	
361	    protected String getAbsolutePath(String path) throws IOException {
362	        String pathWithoutContext = SSIServletRequestUtil.getRelativePath(req);
363	        String prefix = getPathWithoutFileName(pathWithoutContext);
364	        if (prefix == null) {
365	            throw new IOException("Couldn't remove filename from path: "
366	                    + pathWithoutContext);
367	        }
368	        String fullPath = prefix + path;
369 **	        String retVal = SSIServletRequestUtil.normalize(fullPath);
370	        if (retVal == null) {
371	            throw new IOException("Normalization yielded null on path: "
372	                    + fullPath);
373	        }
374	        return retVal;
375	    }
376	
377	
378	    protected ServletContextAndPath getServletContextAndPathFromNonVirtualPath(
379	            String nonVirtualPath) throws IOException {
      ]]></fragment>
    </location>
    <location line="402" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/ssi/SSIServletExternalResolver.java">
      <fragment><![CDATA[
392	    }
393	
394	
395	    protected ServletContextAndPath getServletContextAndPathFromVirtualPath(
396	            String virtualPath) throws IOException {
397	
398	        if (!virtualPath.startsWith("/") && !virtualPath.startsWith("\\")) {
399	            return new ServletContextAndPath(context,
400	                    getAbsolutePath(virtualPath));
401	        } else {
402 **	            String normalized = SSIServletRequestUtil.normalize(virtualPath);
403	            if (isVirtualWebappRelative) {
404	                return new ServletContextAndPath(context, normalized);
405	            } else {
406	                ServletContext normContext = context.getContext(normalized);
407	                if (normContext == null) {
408	                    throw new IOException("Couldn't get context for path: "
409	                            + normalized);
410	                }
411	                //If it's the root context, then there is no context element
412	                // to remove,
      ]]></fragment>
    </location>
    <location line="44" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/ssi/SSIServletRequestUtil.java">
      <fragment><![CDATA[
34	            return (result);
35	        }
36	        // No, extract the desired path directly from the request
37	        String result = request.getPathInfo();
38	        if (result == null) {
39	            result = request.getServletPath();
40	        }
41	        if ((result == null) || (result.equals(""))) {
42	            result = "/";
43	        }
44 **	        return normalize(result);
45	    }
46	
47	
48	    /**
49	     * Return a context-relative path, beginning with a "/", that represents
50	     * the canonical version of the specified path after ".." and "." elements
51	     * are resolved out. If the specified path attempts to go outside the
52	     * boundaries of the current context (i.e. too many ".." path elements are
53	     * present), return <code>null</code> instead. This normalize should be
54	     * the same as DefaultServlet.normalize, which is almost the same ( see
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>Validation is performed before normalization.</textoutput>
    </output>
  </weakness>
  <weakness id="10">
    <name>CVE-2008-4308</name>
    <location line="48" length="1" type="path" path="apache-tomcat-5.5.13-src/connectors/http11/src/java/org/apache/coyote/http11/filters/SavedRequestInputFilter.java">
      <fragment><![CDATA[
38	     * 
39	     * @param input The saved request body to be replayed.
40	     */
41	    public SavedRequestInputFilter(ByteChunk input) {
42	        this.input = input;
43	    }
44	
45	    /**
46	     * Read bytes.
47	     */
48 **	    public int doRead(ByteChunk chunk, org.apache.coyote.Request request)
49	            throws IOException {
50	        int writeLength = 0;
51	        
52	        if (chunk.getLimit() > 0 && chunk.getLimit() < input.getLength()) {
53	            writeLength = chunk.getLimit();
54	        } else {
55	        	writeLength = input.getLength();
56	        }
57	        
58	        input.substract(chunk.getBuffer(), 0, writeLength);
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>The doRead method does not return a -1 indicate when a certain error condition has occurred, which can cause Tomcat to send POST content form one request to a different request.</textoutput>
    </output>
  </weakness>
  <weakness id="11">
    <name>CVE-2008-2938</name>
    <location line="228" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/connector/CoyoteAdapter.java">
      <fragment><![CDATA[
218	                res.setMessage("Invalid URI");
219	                throw ioe;
220	            }
221	            // Normalization
222	            if (!normalize(req.decodedURI())) {
223	                res.setStatus(400);
224	                res.setMessage("Invalid URI");
225	                return false;
226	            }
227	            // Character decoding
228 **	            convertURI(decodedURI, request);
229	        } else {
230	            // The URL is chars or String, and has been sent using an in-memory
231	            // protocol handler, we have to assume the URL has been properly
232	            // decoded already
233	            decodedURI.toChars();
234	        }
235	
236	        // Set the remote principal
237	        String principal = req.getRemoteUser().toString();
238	        if (principal != null) {
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>The JVM does not properly decode UTF-8 encoded URLs. This allows directory traversals from an external source to the docBase of the web application. If configured incorrectly, this vulnerability could extend to the entire filesystem of the server</textoutput>
      <textoutput>Note: this fix is actually a workaround introduced in order to compensate for the JVM vulnerability. The underlying bug has not yet been fixed.</textoutput>
    </output>
  </weakness>
  <weakness id="12">
    <name>CVE-2008-2370</name>
    <location line="380" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/core/ApplicationContext.java">
      <fragment><![CDATA[
370	     */
371	    public RequestDispatcher getRequestDispatcher(String path) {
372	
373	        // Validate the path argument
374	        if (path == null)
375	            return (null);
376	        if (!path.startsWith("/"))
377	            throw new IllegalArgumentException
378	                (sm.getString
379	                 ("applicationContext.requestDispatcher.iae", path));
380 **	        path = normalize(path);
381	        if (path == null)
382	            return (null);
383	
384	        // Retrieve the thread local URI
385	        MessageBytes uriMB = (MessageBytes) localUriMB.get();
386	        if (uriMB == null) {
387	            uriMB = MessageBytes.newInstance();
388	            CharChunk uriCC = uriMB.getCharChunk();
389	            uriCC.setLimit(-1);
390	            localUriMB.set(uriMB);
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>When using a RequestDispatcher, the query was not removed before URL normalization. This could allow access to private content through a crafted query</textoutput>
    </output>
  </weakness>
  <weakness id="13">
    <name>CVE-2008-1947</name>
    <location line="264" length="3" type="path" path="apache-tomcat-5.5.13-src/container/webapps/host-manager/WEB-INF/classes/org/apache/catalina/hostmanager/HTMLHostManagerServlet.java">
      <fragment><![CDATA[
254	                    buf.append(aliases[0]);
255	                    for (int j = 1; j < aliases.length; j++) {
256	                        buf.append(", ").append(aliases[j]);
257	                    }
258	                }
259	                args[1] = buf.toString();
260	                writer.print
261	                    (MessageFormat.format(HOSTS_ROW_DETAILS_SECTION, args));
262	
263	                args = new Object[6];
264 **	                args[0] = response.encodeURL
265 **	                    (request.getContextPath() +
266 **	                     "/html/start?name=" + hostName);
267	                args[1] = hostsStart;
268	                args[2] = response.encodeURL
269	                    (request.getContextPath() +
270	                     "/html/stop?name=" + hostName);
271	                args[3] = hostsStop;
272	                args[4] = response.encodeURL
273	                    (request.getContextPath() +
274	                     "/html/remove?name=" + hostName);
275	                args[5] = hostsRemove;
276	                if (host == this.host) {
      ]]></fragment>
    </location>
    <location line="268" length="3" type="path" path="apache-tomcat-5.5.13-src/container/webapps/host-manager/WEB-INF/classes/org/apache/catalina/hostmanager/HTMLHostManagerServlet.java">
      <fragment><![CDATA[
258	                }
259	                args[1] = buf.toString();
260	                writer.print
261	                    (MessageFormat.format(HOSTS_ROW_DETAILS_SECTION, args));
262	
263	                args = new Object[6];
264	                args[0] = response.encodeURL
265	                    (request.getContextPath() +
266	                     "/html/start?name=" + hostName);
267	                args[1] = hostsStart;
268 **	                args[2] = response.encodeURL
269 **	                    (request.getContextPath() +
270 **	                     "/html/stop?name=" + hostName);
271	                args[3] = hostsStop;
272	                args[4] = response.encodeURL
273	                    (request.getContextPath() +
274	                     "/html/remove?name=" + hostName);
275	                args[5] = hostsRemove;
276	                if (host == this.host) {
277	                    writer.print(MessageFormat.format(
278	                        MANAGER_HOST_ROW_BUTTON_SECTION, args));
279	                } else {
280	                    writer.print(MessageFormat.format(
      ]]></fragment>
    </location>
    <location line="272" length="3" type="path" path="apache-tomcat-5.5.13-src/container/webapps/host-manager/WEB-INF/classes/org/apache/catalina/hostmanager/HTMLHostManagerServlet.java">
      <fragment><![CDATA[
262	
263	                args = new Object[6];
264	                args[0] = response.encodeURL
265	                    (request.getContextPath() +
266	                     "/html/start?name=" + hostName);
267	                args[1] = hostsStart;
268	                args[2] = response.encodeURL
269	                    (request.getContextPath() +
270	                     "/html/stop?name=" + hostName);
271	                args[3] = hostsStop;
272 **	                args[4] = response.encodeURL
273 **	                    (request.getContextPath() +
274 **	                     "/html/remove?name=" + hostName);
275	                args[5] = hostsRemove;
276	                if (host == this.host) {
277	                    writer.print(MessageFormat.format(
278	                        MANAGER_HOST_ROW_BUTTON_SECTION, args));
279	                } else {
280	                    writer.print(MessageFormat.format(
281	                        HOSTS_ROW_BUTTON_SECTION, args));
282	                }
283	
284	            }
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>The Host Manager did not escape user-provided data before including it in output. This enables a XSS attack. The fix involves the filtration of data before use.</textoutput>
      <textoutput>Note: The issue can also be mitigated by a logout or closing of the browser.</textoutput>
    </output>
  </weakness>
  <weakness id="14">
    <name>CVE-2008-1232</name>
    <location line="127" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/core/StandardContextValve.java">
      <fragment><![CDATA[
117	    public final void invoke(Request request, Response response)
118	        throws IOException, ServletException {
119	
120	        // Disallow any direct access to resources under WEB-INF or META-INF
121	        MessageBytes requestPathMB = request.getRequestPathMB();
122	        if ((requestPathMB.startsWithIgnoreCase("/META-INF/", 0))
123	            || (requestPathMB.equalsIgnoreCase("/META-INF"))
124	            || (requestPathMB.startsWithIgnoreCase("/WEB-INF/", 0))
125	            || (requestPathMB.equalsIgnoreCase("/WEB-INF"))) {
126	            String requestURI = request.getDecodedRequestURI();
127 **	            notFound(requestURI, response);
128	            return;
129	        }
130	
131	        // Wait if we are reloading
132	        while (context.getPaused()) {
133	            try {
134	                Thread.sleep(1000);
135	            } catch (InterruptedException e) {
136	                ;
137	            }
      ]]></fragment>
    </location>
    <location line="144" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/core/StandardContextValve.java">
      <fragment><![CDATA[
134	                Thread.sleep(1000);
135	            } catch (InterruptedException e) {
136	                ;
137	            }
138	        }
139	
140	        // Select the Wrapper to be used for this Request
141	        Wrapper wrapper = request.getWrapper();
142	        if (wrapper == null) {
143	            String requestURI = request.getDecodedRequestURI();
144 **	            notFound(requestURI, response);
145	            return;
146	        }
147	
148	        // Normal request processing
149	        Object instances[] = context.getApplicationEventListeners();
150	
151	        ServletRequestEvent event = null;
152	
153	        if ((instances != null) 
154	                && (instances.length > 0)) {
      ]]></fragment>
    </location>
    <location line="260" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/core/StandardContextValve.java">
      <fragment><![CDATA[
250	     * should really be using the error reporting settings for this web
251	     * application, but currently that code runs at the wrapper level rather
252	     * than the context level.
253	     *
254	     * @param requestURI The request URI for the requested resource
255	     * @param response The response we are creating
256	     */
257	    private void notFound(String requestURI, HttpServletResponse response) {
258	
259	        try {
260 **	            response.sendError(HttpServletResponse.SC_NOT_FOUND, requestURI);
261	        } catch (IllegalStateException e) {
262	            ;
263	        } catch (IOException e) {
264	            ;
265	        }
266	
267	    }
268	
269	
270	}
      ]]></fragment>
    </location>
    <location line="435" length="1" type="sink" path="apache-tomcat-5.5.13-src/connectors/http11/src/java/org/apache/coyote/http11/InternalAprOutputBuffer.java">
      <fragment><![CDATA[
425	            write(status);
426	        }
427	
428	        buf[pos++] = Constants.SP;
429	
430	        // Write message
431	        String message = response.getMessage();
432	        if (message == null) {
433	            write(HttpMessages.getMessage(status));
434	        } else {
435 **	            write(message);
436	        }
437	
438	        // End the response status line
439	        buf[pos++] = Constants.CR;
440	        buf[pos++] = Constants.LF;
441	
442	    }
443	
444	
445	    /**
      ]]></fragment>
    </location>
    <location line="454" length="1" type="sink" path="apache-tomcat-5.5.13-src/connectors/http11/src/java/org/apache/coyote/http11/InternalOutputBuffer.java">
      <fragment><![CDATA[
444	            write(status);
445	        }
446	
447	        buf[pos++] = Constants.SP;
448	
449	        // Write message
450	        String message = response.getMessage();
451	        if (message == null) {
452	            write(getMessage(status));
453	        } else {
454 **	            write(message);
455	        }
456	
457	        // End the response status line
458	        if (System.getSecurityManager() != null){
459	           AccessController.doPrivileged(
460	                new PrivilegedAction(){
461	                    public Object run(){
462	                        buf[pos++] = Constants.CR;
463	                        buf[pos++] = Constants.LF;
464	                        return null;
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>The message argument of a sendError() call is displayed on the error page, and is used for the HTTP-Response. This allows the inclusion of characters that are illegal in HTTP headers. It is possible for a crafted request to result in arbitrary content being injected into the HTTP response. For this attack to be successful, unfiltered user data must be included in the message</textoutput>
    </output>
  </weakness>
  <weakness id="15">
    <name>CVE-2008-0128</name>
    <location line="746" length="1" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/authenticator/AuthenticatorBase.java">
      <fragment><![CDATA[
736	            Cookie cookie = new Cookie(Constants.SINGLE_SIGN_ON_COOKIE, ssoId);
737	            cookie.setMaxAge(-1);
738	            cookie.setPath("/");
739	            
740	            // Bugzilla 34724
741	            String ssoDomain = sso.getCookieDomain();
742	            if(ssoDomain != null) {
743	                cookie.setDomain(ssoDomain);
744	            }
745	
746 **	            response.addCookie(cookie);
747	
748	            // Register this principal with our SSO valve
749	            sso.register(ssoId, principal, authType, username, password);
750	            request.setNote(Constants.REQ_SSOID_NOTE, ssoId);
751	
752	        } else {
753	            // Update the SSO session with the latest authentication data
754	            sso.update(ssoId, principal, authType, username, password);
755	        }
756	
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>The SingleSignOn Valve does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie. </textoutput>
    </output>
  </weakness>
  <weakness id="16">
    <name>CVE-2007-6286</name>
    <location line="336" length="1" type="path" path="apache-tomcat-5.5.13-src/connectors/jni/native/src/sslnetwork.c">
      <fragment><![CDATA[
326	
327	        /*
328	         * Remember the peer certificate
329	         */
330	        if ((peer = SSL_get_peer_certificate(con->ssl)) != NULL) {
331	            if (con->peer)
332	                X509_free(con->peer);
333	            con->peer = peer;
334	        }
335	    }
336 **	    return APR_SUCCESS;
337	}
338	
339	static apr_status_t APR_THREAD_FUNC
340	ssl_socket_recv(apr_socket_t *sock, char *buf, apr_size_t *len)
341	{
342	    tcn_ssl_conn_t *con = (tcn_ssl_conn_t *)sock;
343	    int s, wr = (int)(*len);
344	    apr_status_t rv = APR_SUCCESS;
345	
346	    for (;;) {
      ]]></fragment>
    </location>
    <location line="410" length="1" type="path" path="apache-tomcat-5.5.13-src/connectors/jni/native/src/sslnetwork.c">
      <fragment><![CDATA[
400	                    *len = 0;
401	                    return APR_EOF;
402	                break;
403	                case SSL_ERROR_WANT_READ:
404	                case SSL_ERROR_WANT_WRITE:
405	                    if ((rv = wait_for_io_or_timeout(con, i)) != APR_SUCCESS) {
406	                        return rv;
407	                    }
408	                break;
409	                case SSL_ERROR_SYSCALL:
410 **	                    if (!APR_STATUS_IS_EAGAIN(os) &&
411	                        !APR_STATUS_IS_EINTR(os)) {
412	                        con->shutdown_type = SSL_SHUTDOWN_TYPE_STANDARD;
413	                        return os;
414	                    }
415	                break;
416	                default:
417	                    return os;
418	                break;
419	            }
420	        }
      ]]></fragment>
    </location>
    <location line="461" length="1" type="path" path="apache-tomcat-5.5.13-src/connectors/jni/native/src/sslnetwork.c">
      <fragment><![CDATA[
451	
452	static tcn_nlayer_t ssl_socket_layer = {
453	    TCN_SOCKET_SSL,
454	    ssl_cleanup,
455	    ssl_socket_close,
456	    ssl_socket_shutdown,
457	    ssl_socket_opt_get,
458	    ssl_socket_opt_set,
459	    ssl_socket_timeout_get,
460	    ssl_socket_timeout_set,
461 **	    ssl_socket_send,
462	    ssl_socket_sendv,
463	    ssl_socket_recv
464	};
465	
466	
467	TCN_IMPLEMENT_CALL(jint, SSLSocket, attach)(TCN_STDARGS, jlong ctx,
468	                                            jlong sock)
469	{
470	    tcn_ssl_ctxt_t *c = J2P(ctx, tcn_ssl_ctxt_t *);
471	    tcn_socket_t *s   = J2P(sock, tcn_socket_t *);
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>C code only. Not applicable to the Java track.</textoutput>
      <textoutput>When the native APR connector is used, a flaw does not properly handle an empty request to the SSL port, which allows a remote attacker to trigger handling of "a duplicate copy of one of the recent requests", as demonstrated by using netcat to send the empty request. </textoutput>
    </output>
  </weakness>
  <weakness id="17">
    <name>CVE-2007-5461</name>
    <location line="242" length="14" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/servlets/WebdavServlet.java">
      <fragment><![CDATA[
232	
233	    }
234	
235	
236	    // ------------------------------------------------------ Protected Methods
237	
238	
239	    /**
240	     * Return JAXP document builder instance.
241	     */
242 **	    protected DocumentBuilder getDocumentBuilder()
243 **	        throws ServletException {
244 **	        DocumentBuilder documentBuilder = null;
245 **	        DocumentBuilderFactory documentBuilderFactory = null;
246 **	        try {
247 **	            documentBuilderFactory = DocumentBuilderFactory.newInstance();
248 **	            documentBuilderFactory.setNamespaceAware(true);
249 **	            documentBuilder = documentBuilderFactory.newDocumentBuilder();
250 **	        } catch(ParserConfigurationException e) {
251 **	            throw new ServletException
252 **	                (sm.getString("webdavservlet.jaxpfailed"));
253 **	        }
254 **	        return documentBuilder;
255 **	    }
256	
257	
258	    /**
259	     * Handles the special WebDAV methods.
260	     */
261	    protected void service(HttpServletRequest req, HttpServletResponse resp)
262	        throws ServletException, IOException {
263	
264	        String method = req.getMethod();
265	
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>Absolute path traversal vulnerability under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag. </textoutput>
    </output>
  </weakness>
  <weakness id="18">
    <name>CVE-2007-5342</name>
    <location line="453" length="14" type="path" path="apache-tomcat-5.5.13-src/connectors/juli/src/java/org/apache/juli/ClassLoaderLogManager.java">
      <fragment><![CDATA[
443	        });
444	    }
445	
446	    
447	    /**
448	     * System property replacement in the given string.
449	     * 
450	     * @param str The original string
451	     * @return the modified string
452	     */
453 **	    protected String replace(String str) {
454 **	        String result = str.trim();
455 **	        if (result.startsWith("${")) {
456 **	            int pos = result.indexOf('}');
457 **	            if (pos != -1) {
458 **	                String propName = result.substring(2, pos);
459 **	                String replacement = System.getProperty(propName);
460 **	                if (replacement != null) {
461 **	                    result = replacement + result.substring(pos + 1);
462 **	                }
463 **	            }
464 **	        }
465 **	        return result;
466 **	    }
467	    
468	
469	    // ---------------------------------------------------- LogNode Inner Class
470	
471	
472	    protected static final class LogNode {
473	        Logger logger;
474	
475	        protected final Map children = new HashMap();
476	
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>The default catalina.policy in the JULI logging component does not restrict certain permissions for web applications, which allows an attacker to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the level, directory, and prefix attributes in the org.apache.juli.FileHandler handler.</textoutput>
    </output>
  </weakness>
  <weakness id="19">
    <name>CVE-2007-5333</name>
    <location line="309" length="8" type="path" path="apache-tomcat-5.5.13-src/connectors/util/java/org/apache/tomcat/util/http/Cookies.java">
      <fragment><![CDATA[
299	                // sc.getPort().setBytes( bytes,
300	                //                        startValue,
301	                //                        endValue-startValue );
302	            }
303	        }
304	    }
305	
306	    // -------------------- Utils --------------------
307	    public static int skipSpaces(  byte bytes[], int off, int end ) {
308	        while( off < end ) {
309 **	            byte b=bytes[off];
310 **	            if( b!= ' ' ) return off;
311 **	            off ++;
312 **	        }
313 **	        return off;
314 **	    }
315 **	
316 **	    public static int findDelim1( byte bytes[], int off, int end )
317	    {
318	        while( off < end ) {
319	            byte b=bytes[off];
320	            if( b==' ' || b=='=' || b==';' || b==',' )
321	                return off;
322	            off++;
323	        }
324	        return off;
325	    }
326	
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>Handling (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value not properly, might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.</textoutput>
    </output>
  </weakness>
  <weakness id="20">
    <name>CVE-2007-3385</name>
    <location line="338" length="10" type="path" path="apache-tomcat-5.5.13-src/connectors/util/java/org/apache/tomcat/util/http/Cookies.java">
      <fragment><![CDATA[
328	    {
329	        while( off < end ) {
330	            byte b=bytes[off];
331	            if( b==';' || b==',' )
332	                return off;
333	            off++;
334	        }
335	        return off;
336	    }
337	
338 **	    public static int indexOf( byte bytes[], int off, int end, byte qq )
339 **	    {
340 **	        while( off < end ) {
341 **	            byte b=bytes[off];
342 **	            if( b==qq )
343 **	                return off;
344 **	            off++;
345 **	        }
346 **	        return off;
347 **	    }
348	
349	    public static int indexOf( byte bytes[], int off, int end, char qq )
350	    {
351	        while( off < end ) {
352	            byte b=bytes[off];
353	            if( b==qq )
354	                return off;
355	            off++;
356	        }
357	        return off;
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>Handling not properly the \" character sequence in a cookie value, might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.</textoutput>
    </output>
  </weakness>
  <weakness id="21">
    <name>CVE-2007-3382</name>
    <location line="252" length="1" type="path" path="apache-tomcat-5.5.13-src/connectors/util/java/org/apache/tomcat/util/http/Cookies.java">
      <fragment><![CDATA[
242	                }
243	                continue;
244	            }
245	            
246	            // we should have "=" ( tested all other alternatives )
247	            int startValue=skipSpaces( bytes, pos, end);
248	            int endValue=startValue;
249	            
250	            // quote is valid only in version=1 cookies
251	            cc=bytes[pos];
252 **	            if( ( version == 1 || isSpecial ) && ( cc== '\'' || cc=='"' ) ) {
253	                startValue++;
254	                endValue=indexOf( bytes, startValue, end, cc );
255	                pos=endValue+1; // to skip to next cookie
256	             } else {
257	                endValue=findDelim2( bytes, startValue, end );
258	                pos=endValue+1;
259	            }
260	            
261	            // if not $Version, etc
262	            if( ! isSpecial ) {
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>Treating single quotes ("'") as delimiters in cookies, might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks. </textoutput>
    </output>
  </weakness>
  <weakness id="22">
    <name>CVE-2007-2450 and CVE-2007-3386</name>
    <location line="198" length="1" type="sink" path="apache-tomcat-5.5.13-src/container/webapps/host-manager/WEB-INF/classes/org/apache/catalina/hostmanager/HTMLHostManagerServlet.java">
      <fragment><![CDATA[
188	        Object[] args = new Object[2];
189	        args[0] = request.getContextPath();
190	        args[1] = sm.getString("htmlHostManagerServlet.title");
191	        writer.print(MessageFormat.format
192	                     (Constants.BODY_HEADER_SECTION, args));
193	
194	        // Message Section
195	        args = new Object[3];
196	        args[0] = sm.getString("htmlHostManagerServlet.messageLabel");
197	        args[1] = (message == null || message.length() == 0) ? "OK" : message;
198 **	        writer.print(MessageFormat.format(Constants.MESSAGE_SECTION, args));
199	
200	        // Manager Section
201	        args = new Object[9];
202	        args[0] = sm.getString("htmlHostManagerServlet.manager");
203	        args[1] = response.encodeURL(request.getContextPath() + "/html/list");
204	        args[2] = sm.getString("htmlHostManagerServlet.list");
205	        args[3] = response.encodeURL
206	            (request.getContextPath() + "/" +
207	             sm.getString("htmlHostManagerServlet.helpHtmlManagerFile"));
208	        args[4] = sm.getString("htmlHostManagerServlet.helpHtmlManager");
      ]]></fragment>
    </location>
    <location line="260" length="1" type="sink" path="apache-tomcat-5.5.13-src/container/webapps/host-manager/WEB-INF/classes/org/apache/catalina/hostmanager/HTMLHostManagerServlet.java">
      <fragment><![CDATA[
250	                args[0] = hostName;
251	                String[] aliases = host.findAliases();
252	                StringBuffer buf = new StringBuffer();
253	                if (aliases.length > 0) {
254	                    buf.append(aliases[0]);
255	                    for (int j = 1; j < aliases.length; j++) {
256	                        buf.append(", ").append(aliases[j]);
257	                    }
258	                }
259	                args[1] = buf.toString();
260 **	                writer.print
261	                    (MessageFormat.format(HOSTS_ROW_DETAILS_SECTION, args));
262	
263	                args = new Object[6];
264	                args[0] = response.encodeURL
265	                    (request.getContextPath() +
266	                     "/html/start?name=" + hostName);
267	                args[1] = hostsStart;
268	                args[2] = response.encodeURL
269	                    (request.getContextPath() +
270	                     "/html/stop?name=" + hostName);
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>The Manager and Host Manager web applications did not escape user provided data before including it in the output.</textoutput>
      <textoutput>The sink is the following writer.print().</textoutput>
      <textoutput>The sink is the following writer.print().</textoutput>
    </output>
  </weakness>
  <weakness id="23">
    <name>CVE-2007-2449</name>
    <location line="23" length="5" type="sink" path="apache-tomcat-5.5.13-src/servletapi/jsr152/examples/snp/snoop.jsp">
      <fragment><![CDATA[
13	  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14	  See the License for the specific language governing permissions and
15	  limitations under the License.
16	-->
17	
18	<body bgcolor="white">
19	<h1> Request Information </h1>
20	<font size="4">
21	JSP Request Method: <% out.print(util.HTMLFilter.filter(request.getMethod())); %>
22	<br>
23 **	Request URI: <%= request.getRequestURI() %>
24 **	<br>
25 **	Request Protocol: <%= request.getProtocol() %>
26 **	<br>
27 **	Servlet path: <%= request.getServletPath() %>
28	<br>
29	Path info: <% out.print(util.HTMLFilter.filter(request.getPathInfo())); %>
30	<br>
31	Query string: <% out.print(util.HTMLFilter.filter(request.getQueryString())); %>
32	<br>
33	Content length: <%= request.getContentLength() %>
34	<br>
35	Content type: <% out.print(util.HTMLFilter.filter(request.getContentType())); %>
36	<br>
37	Server name: <%= request.getServerName() %>
      ]]></fragment>
      <explanation>3 sinks/fixes in this block</explanation>
    </location>
    <location line="37" length="11" type="sink" path="apache-tomcat-5.5.13-src/servletapi/jsr152/examples/snp/snoop.jsp">
      <fragment><![CDATA[
27	Servlet path: <%= request.getServletPath() %>
28	<br>
29	Path info: <% out.print(util.HTMLFilter.filter(request.getPathInfo())); %>
30	<br>
31	Query string: <% out.print(util.HTMLFilter.filter(request.getQueryString())); %>
32	<br>
33	Content length: <%= request.getContentLength() %>
34	<br>
35	Content type: <% out.print(util.HTMLFilter.filter(request.getContentType())); %>
36	<br>
37 **	Server name: <%= request.getServerName() %>
38 **	<br>
39 **	Server port: <%= request.getServerPort() %>
40 **	<br>
41 **	Remote user: <%= request.getRemoteUser() %>
42 **	<br>
43 **	Remote address: <%= request.getRemoteAddr() %>
44 **	<br>
45 **	Remote host: <%= request.getRemoteHost() %>
46 **	<br>
47 **	Authorization scheme: <%= request.getAuthType() %> 
48	<br>
49	Locale: <%= request.getLocale() %>
50	<hr>
51	The browser you are using is <% out.print(util.HTMLFilter.filter(request.getHeader("User-Agent"))); %>
52	<hr>
53	</font>
54	</body>
55	</html>
      ]]></fragment>
      <explanation>6 sinks/fixes in this block</explanation>
    </location>
    <location line="19" length="1" type="sink" path="apache-tomcat-5.5.13-src/servletapi/jsr152/examples/source.jsp">
      <fragment><![CDATA[
9	
10	  Unless required by applicable law or agreed to in writing, software
11	  distributed under the License is distributed on an "AS IS" BASIS,
12	  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13	  See the License for the specific language governing permissions and
14	  limitations under the License.
15	-->
16	<%@ taglib uri="http://jakarta.apache.org/tomcat/examples-taglib"
17	        prefix="eg" %>
18	
19 **	<eg:ShowSource jspFile="<%= request.getQueryString() %>"/>
      ]]></fragment>
    </location>
    <location line="29" length="1" type="sink" path="apache-tomcat-5.5.13-src/servletapi/jsr152/examples/security/protected/index.jsp">
      <fragment><![CDATA[
19	    response.sendRedirect("index.jsp");
20	    return;
21	  }
22	%>
23	<html>
24	<head>
25	<title>Protected Page for Examples</title>
26	</head>
27	<body bgcolor="white">
28	
29 **	You are logged in as remote user <b><%= request.getRemoteUser() %></b>
30	in session <b><%= session.getId() %></b><br><br>
31	
32	<%
33	  if (request.getUserPrincipal() != null) {
34	%>
35	    Your user principal name is
36	    <b><%= request.getUserPrincipal().getName() %></b><br><br>
37	<%
38	  } else {
39	%>
      ]]></fragment>
    </location>
    <location line="36" length="1" type="sink" path="apache-tomcat-5.5.13-src/servletapi/jsr152/examples/security/protected/index.jsp">
      <fragment><![CDATA[
26	</head>
27	<body bgcolor="white">
28	
29	You are logged in as remote user <b><%= request.getRemoteUser() %></b>
30	in session <b><%= session.getId() %></b><br><br>
31	
32	<%
33	  if (request.getUserPrincipal() != null) {
34	%>
35	    Your user principal name is
36 **	    <b><%= request.getUserPrincipal().getName() %></b><br><br>
37	<%
38	  } else {
39	%>
40	    No user principal could be identified.<br><br>
41	<%
42	  }
43	%>
44	
45	<%
46	  String role = request.getParameter("role");
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>JSPs within the examples web application did not escape user provided data before including it in the output. Note that it is recommended that the examples web application is not installed on a production system.</textoutput>
    </output>
  </weakness>
  <weakness id="24">
    <name>CVE-2007-1858</name>
    <location line="128" length="8" type="fix" path="apache-tomcat-5.5.13-src/connectors/util/java/org/apache/tomcat/util/net/jsse/JSSE13SocketFactory.java">
      <fragment><![CDATA[
118	            // Create and init SSLContext
119	            com.sun.net.ssl.SSLContext context = 
120	                com.sun.net.ssl.SSLContext.getInstance(protocol); 
121	            context.init(kmf.getKeyManagers(), tm, new SecureRandom());
122	
123	            // Create proxy
124	            sslProxy = context.getServerSocketFactory();
125	
126	            // Determine which cipher suites to enable
127	            String requestedCiphers = (String)attributes.get("ciphers");
128 **	            enabledCiphers = getEnabledCiphers(requestedCiphers,
129 **	                     sslProxy.getSupportedCipherSuites());
130 **	
131 **	        } catch(Exception e) {
132 **	            if( e instanceof IOException )
133 **	                throw (IOException)e;
134 **	            throw new IOException(e.getMessage());
135 **	        }
136	    }
137	    protected String[] getEnabledProtocols(SSLServerSocket socket,
138	                                           String requestedProtocols){
139	        return null;
140	    }
141	    protected void setEnabledProtocols(SSLServerSocket socket, 
142	                                             String [] protocols){
143	    }
144	
145	    protected void configureClientAuth(SSLServerSocket socket){
      ]]></fragment>
    </location>
    <location line="119" length="8" type="fix" path="apache-tomcat-5.5.13-src/connectors/util/java/org/apache/tomcat/util/net/jsse/JSSE14SocketFactory.java">
      <fragment><![CDATA[
109	            context.init(getKeyManagers(keystoreType, algorithm,
110	                                        (String) attributes.get("keyAlias")),
111	                         getTrustManagers(keystoreType, trustAlgorithm),
112	                         new SecureRandom());
113	
114	            // create proxy
115	            sslProxy = context.getServerSocketFactory();
116	
117	            // Determine which cipher suites to enable
118	            String requestedCiphers = (String)attributes.get("ciphers");
119 **	            enabledCiphers = getEnabledCiphers(requestedCiphers,
120 **	                                               sslProxy.getSupportedCipherSuites());
121 **	
122 **	        } catch(Exception e) {
123 **	            if( e instanceof IOException )
124 **	                throw (IOException)e;
125 **	            throw new IOException(e.getMessage());
126 **	        }
127	    }
128	
129	    /**
130	     * Gets the initialized key managers.
131	     */
132	    protected KeyManager[] getKeyManagers(String keystoreType,
133	                                          String algorithm,
134	                                          String keyAlias)
135	                throws Exception {
136	
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>Not sure whether this was really fixed. The default SSL cipher configuration uses certain insecure ciphers, including the anonymous cipher, which allows a remote attacker to obtain sensitive information or have other, unspecified impacts. </textoutput>
      <textoutput>These lines relate to function checkConfig()</textoutput>
    </output>
  </weakness>
  <weakness id="25">
    <name>CVE-2007-1355</name>
    <location line="32" length="1" type="sink" path="apache-tomcat-5.5.13-src/container/webapps/docs/appdev/sample/web/hello.jsp">
      <fragment><![CDATA[
22	<tr>
23	  <th align="right">Context Path:</th>
24	  <td align="left"><%= request.getContextPath() %></td>
25	</tr>
26	<tr>
27	  <th align="right">Path Information:</th>
28	  <td align="left"><%= request.getPathInfo() %></td>
29	</tr>
30	<tr>
31	  <th align="right">Query String:</th>
32 **	  <td align="left"><%= request.getQueryString() %></td>
33	</tr>
34	<tr>
35	  <th align="right">Request Method:</th>
36	  <td align="left"><%= request.getMethod() %></td>
37	</tr>
38	<tr>
39	  <th align="right">Servlet Path:</th>
40	  <td align="left"><%= request.getServletPath() %></td>
41	</tr>
42	</table>
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>Multiple cross-site scripting (XSS) vulnerabilities in the application allow a remote attacker to inject arbitrary web script or HTML via the test parameter and unspecified vectors. </textoutput>
    </output>
  </weakness>
  <weakness id="26">
    <name>CVE-2007-0450</name>
    <location line="527" length="2" type="path" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/connector/CoyoteAdapter.java">
      <fragment><![CDATA[
517	        // URL * is acceptable
518	        if ((end - start == 1) && b[start] == (byte) '*')
519	          return true;
520	
521	        int pos = 0;
522	        int index = 0;
523	
524	        // Replace '\' with '/'
525	        // Check for null byte
526	        for (pos = start; pos < end; pos++) {
527 **	            if (b[pos] == (byte) '\\')
528 **	                b[pos] = (byte) '/';
529	            if (b[pos] == (byte) 0)
530	                return false;
531	        }
532	
533	        // The URL must start with '/'
534	        if (b[start] != (byte) '/') {
535	            return false;
536	        }
537	
538	        // Replace "//" with "/"
      ]]></fragment>
    </location>
    <location line="85" length="2" type="path" path="apache-tomcat-5.5.13-src/connectors/util/java/org/apache/tomcat/util/buf/UDecoder.java">
      <fragment><![CDATA[
75			// read next 2 digits
76			if( j+2 >= end ) {
77			    throw new CharConversionException("EOF");
78			}
79			byte b1= buff[j+1];
80			byte b2=buff[j+2];
81			if( !isHexDigit( b1 ) || ! isHexDigit(b2 ))
82			    throw new CharConversionException( "isHexDigit");
83			
84			j+=2;
85 **			int res=x2c( b1, b2 );
86 **			buff[idx]=(byte)res;
87		    }
88		}
89	
90		mb.setEnd( idx );
91		
92		return;
93	    }
94	
95	    // -------------------- Additional methods --------------------
96	    // XXX What do we do about charset ????
      ]]></fragment>
    </location>
    <location line="145" length="2" type="path" path="apache-tomcat-5.5.13-src/connectors/util/java/org/apache/tomcat/util/buf/UDecoder.java">
      <fragment><![CDATA[
135			if( j+2 >= cend ) {
136			    // invalid
137			    throw new CharConversionException("EOF");
138			}
139			char b1= buff[j+1];
140			char b2=buff[j+2];
141			if( !isHexDigit( b1 ) || ! isHexDigit(b2 ))
142			    throw new CharConversionException("isHexDigit");
143			
144			j+=2;
145 **			int res=x2c( b1, b2 );
146 **			buff[idx]=(char)res;
147		    }
148		}
149		mb.setEnd( idx );
150	    }
151	
152	    /** URLDecode, will modify the source
153	     *  Includes converting  '+' to ' '.
154	     */
155	    public void convert(MessageBytes mb)
156		throws IOException
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>A directory traversal vulnerability, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows a remote attacker to read arbitrary files via a .. (dot dot) sequence with combinations of "/" (slash), "\" (backslash), and URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache. </textoutput>
      <textoutput>See this revision for details: http://svn.apache.org/viewvc?view=revision&amp;revision=507117. Also, the fix was insufficient: additional fixed for CVE-2007-1860, however, that fix concerned the C code</textoutput>
    </output>
  </weakness>
  <weakness id="27">
    <name>CVE-2006-7197</name>
    <location line="1382" length="16" type="fix" path="apache-tomcat-5.5.13-src/connectors/jk/native/common/jk_ajp_common.c">
      <fragment><![CDATA[
1372	            }
1373	            r->start_response(r, res.status, res.msg,
1374	                              (const char *const *)res.header_names,
1375	                              (const char *const *)res.header_values,
1376	                              res.num_headers);
1377	        }
1378	        return JK_AJP13_SEND_HEADERS;
1379	
1380	    case JK_AJP13_SEND_BODY_CHUNK:
1381	        {
1382 **	            unsigned int len = (unsigned int)jk_b_get_int(msg);
1383 **	            if (!r->write(r, msg->buf + msg->pos, len)) {
1384 **	                jk_log(l, JK_LOG_INFO,
1385 **	                       "Connection aborted or network problems");
1386 **	                JK_TRACE_EXIT(l);
1387 **	                return JK_CLIENT_ERROR;
1388 **	            }
1389 **	            if (r->flush && r->flush_packets)
1390 **	                r->flush(r);
1391 **	        }
1392 **	        break;
1393 **	
1394 **	    case JK_AJP13_GET_BODY_CHUNK:
1395 **	        {
1396 **	            int len = (int)jk_b_get_int(msg);
1397 **	
1398	            if (len < 0) {
1399	                len = 0;
1400	            }
1401	            if (len > AJP13_MAX_SEND_BODY_SZ) {
1402	                len = AJP13_MAX_SEND_BODY_SZ;
1403	            }
1404	            if ((unsigned int)len > ae->left_bytes_to_send) {
1405	                len = ae->left_bytes_to_send;
1406	            }
1407	
      ]]></fragment>
    </location>
    <location line="1383" length="1" type="sink" path="apache-tomcat-5.5.13-src/connectors/jk/native/common/jk_ajp_common.c">
      <fragment><![CDATA[
1373	            r->start_response(r, res.status, res.msg,
1374	                              (const char *const *)res.header_names,
1375	                              (const char *const *)res.header_values,
1376	                              res.num_headers);
1377	        }
1378	        return JK_AJP13_SEND_HEADERS;
1379	
1380	    case JK_AJP13_SEND_BODY_CHUNK:
1381	        {
1382	            unsigned int len = (unsigned int)jk_b_get_int(msg);
1383 **	            if (!r->write(r, msg->buf + msg->pos, len)) {
1384	                jk_log(l, JK_LOG_INFO,
1385	                       "Connection aborted or network problems");
1386	                JK_TRACE_EXIT(l);
1387	                return JK_CLIENT_ERROR;
1388	            }
1389	            if (r->flush && r->flush_packets)
1390	                r->flush(r);
1391	        }
1392	        break;
1393	
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>C code only. Not applicable to the Java track.</textoutput>
      <textoutput>The AJP connector uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callback in mod_jk, which allows remote attackers to read portions of sensitive memory. </textoutput>
      <textoutput>Fix is not useful, because it applies to ver. 5.5.17 where it was fixed, but not to the fixed test case, because it does not exist there.</textoutput>
      <textoutput>Patch: https://issues.apache.org/bugzilla/attachment.cgi?id=17837</textoutput>
    </output>
  </weakness>
  <weakness id="28">
    <name>CVE-2006-7196 and CVE-2009-0781</name>
    <location line="37" length="1" type="fix" path="apache-tomcat-5.5.13-src/servletapi/jsr152/examples/cal/cal2.jsp">
      <fragment><![CDATA[
27		String time = request.getParameter ("time");
28	%>
29	
30	<FONT SIZE=5> Please add the following event:
31	<BR> <h3> Date <%= table.getDate() %>
32	<BR> Time <%= time %> </h3>
33	</FONT>
34	<FORM METHOD=POST ACTION=cal1.jsp>
35	<BR> 
36	<BR> <INPUT NAME="date" TYPE=HIDDEN VALUE="current">
37 **	<BR> <INPUT NAME="time" TYPE=HIDDEN VALUE=<%= time %>
38	<BR> <h2> Description of the event <INPUT NAME="description" TYPE=TEXT SIZE=20> </h2>
39	<BR> <INPUT TYPE=SUBMIT VALUE="submit">
40	</FORM>
41	
42	</BODY>
43	</HTML>
44	
      ]]></fragment>
    </location>
    <location line="32" length="1" type="fix" path="apache-tomcat-5.5.13-src/servletapi/jsr152/examples/cal/cal2.jsp">
      <fragment><![CDATA[
22	
23	<BODY BGCOLOR="white">
24	<jsp:useBean id="table" scope="session" class="cal.TableBean" />
25	
26	<% 
27		String time = request.getParameter ("time");
28	%>
29	
30	<FONT SIZE=5> Please add the following event:
31	<BR> <h3> Date <%= table.getDate() %>
32 **	<BR> Time <%= time %> </h3>
33	</FONT>
34	<FORM METHOD=POST ACTION=cal1.jsp>
35	<BR> 
36	<BR> <INPUT NAME="date" TYPE=HIDDEN VALUE="current">
37	<BR> <INPUT NAME="time" TYPE=HIDDEN VALUE=<%= time %>
38	<BR> <h2> Description of the event <INPUT NAME="description" TYPE=TEXT SIZE=20> </h2>
39	<BR> <INPUT TYPE=SUBMIT VALUE="submit">
40	</FORM>
41	
42	</BODY>
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>A cross-site scripting (XSS) vulnerability in the calendar application allows a remote attacker to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. </textoutput>
      <textoutput>Note: the same as CVE-2009-0781? Yes, it is the same, there fixed one line first, then another line a few years later. These are also sinks</textoutput>
    </output>
  </weakness>
  <weakness id="29">
    <name>CVE-2006-7195</name>
    <location line="74" length="1" type="fix" path="apache-tomcat-5.5.13-src/servletapi/jsr152/examples/jsp2/el/implicit-objects.jsp">
      <fragment><![CDATA[
64		  <tr>
65		    <td>\${param.foo}</td>
66		    <td>${fn:escapeXml(param["foo"])}&nbsp;</td>
67		  </tr>
68		  <tr>
69		    <td>\${param["foo"]}</td>
70		    <td>${fn:escapeXml(param["foo"])}&nbsp;</td>
71		  </tr>
72		  <tr>
73		    <td>\${header["host"]}</td>
74 **		    <td>${header["host"]}</td>
75		  </tr>
76		  <tr>
77		    <td>\${header["accept"]}</td>
78		    <td>${header["accept"]}</td>
79		  </tr>
80		  <tr>
81		    <td>\${header["user-agent"]}</td>
82		    <td>${header["user-agent"]}</td>
83		  </tr>
84		</table>
      ]]></fragment>
    </location>
    <location line="78" length="1" type="fix" path="apache-tomcat-5.5.13-src/servletapi/jsr152/examples/jsp2/el/implicit-objects.jsp">
      <fragment><![CDATA[
68		  <tr>
69		    <td>\${param["foo"]}</td>
70		    <td>${fn:escapeXml(param["foo"])}&nbsp;</td>
71		  </tr>
72		  <tr>
73		    <td>\${header["host"]}</td>
74		    <td>${header["host"]}</td>
75		  </tr>
76		  <tr>
77		    <td>\${header["accept"]}</td>
78 **		    <td>${header["accept"]}</td>
79		  </tr>
80		  <tr>
81		    <td>\${header["user-agent"]}</td>
82		    <td>${header["user-agent"]}</td>
83		  </tr>
84		</table>
85	      </code>
86	    </blockquote>
87	  </body>
88	</html>
      ]]></fragment>
    </location>
    <location line="82" length="1" type="fix" path="apache-tomcat-5.5.13-src/servletapi/jsr152/examples/jsp2/el/implicit-objects.jsp">
      <fragment><![CDATA[
72		  <tr>
73		    <td>\${header["host"]}</td>
74		    <td>${header["host"]}</td>
75		  </tr>
76		  <tr>
77		    <td>\${header["accept"]}</td>
78		    <td>${header["accept"]}</td>
79		  </tr>
80		  <tr>
81		    <td>\${header["user-agent"]}</td>
82 **		    <td>${header["user-agent"]}</td>
83		  </tr>
84		</table>
85	      </code>
86	    </blockquote>
87	  </body>
88	</html>
      ]]></fragment>
    </location>
    <grade severity="1"/>
    <output>
      <textoutput>A cross-site scripting (XSS) vulnerability in implicit-objects.jsp allows a remote attacker to inject arbitrary web script or HTML via certain header values. </textoutput>
      <textoutput>This is also sink</textoutput>
    </output>
  </weakness>
</report>
