Bug 378979 - [Webapp] Possible security issue with JSP code exposure. backport for 3.4.2+
Summary: [Webapp] Possible security issue with JSP code exposure. backport for 3.4.2+
Status: RESOLVED FIXED
Alias: None
Product: Equinox
Classification: Eclipse Project
Component: Framework (show other bugs)
Version: 3.4.2   Edit
Hardware: PC Linux
: P3 major (vote)
Target Milestone: 3.4.2+   Edit
Assignee: Thomas Watson CLA
QA Contact:
URL:
Whiteboard:
Keywords: security
Depends on: 328795 328975 329193 390491
Blocks: 375751 378977
  Show dependency tree
 
Reported: 2012-05-09 09:18 EDT by Steve Francisco CLA
Modified: 2012-09-26 17:17 EDT (History)
11 users (show)

See Also:

Attachments
backport to 3.4.2+ (13.57 KB, patch)
2012-05-09 14:10 EDT, Thomas Watson CLA 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Steve Francisco CLA 2012-05-09 09:18:08 EDT 
+++ This bug was initially created as a clone of Bug #328975 +++

This is probably an upstream issue, but I will raise it here as it is reproducible in the IDE.

If a ( or \ character is appended to a URL to the help system, then the source of the JSP page is rendered instead of the page itself.

For the IDE, this is not a big issue (the code is opensource anyway), but if the issue is in the HttpServer or Jetty itself, then this is a significant security issue.

We have check jetty 6.1.23, 6.1.26 and jetty-7 out of the box, and none of them are vulnerable to this issue.   So it is something about the configuration of Jetty in eclipse IDE, the HttpService, or the JSP library used.

So I've opened this issue here in the expectation that we can work upstream to identify which component/configuration is the cause.

I will continue to evaluation jetty's handling of such requests and work out what mechanism is catching these URLs and thus work out what could be potentially be disabled in the IDE or RT.
Comment 1 Thomas Watson CLA 2012-05-09 14:10:03 EDT 
Created attachment 215355 [details]
backport to 3.4.2+
Comment 2 Thomas Watson CLA 2012-05-09 14:15:38 EDT 
Released to R3_4_maintenance branch and map files updated with tag
R34x_v20120509

The following bundles changed:

org.eclipse.osgi
org.eclipse.osgi.tests