add-jdbc-connection-pool-to-survive-scanner-load

CSPF-Founder · CSPF-Founder · commit 645e8964a7ac · 2026-05-10T07:12:25.000+05:30
The lab was crashing when a vulnerability scanner hit it because every
servlet leaks its DB connection (no close), and DBConnect opens a fresh
DriverManager connection per request. Under load the JVM accumulated
leaked connections until it OOMed and MySQL hit max_connections=151.

Fix at the pool layer so no servlet/controller code changes (all
deliberate vulnerabilities preserved):

- Declare a tomcat-jdbc DataSource at jdbc/jvl in META-INF/context.xml
  with maxActive=50 and removeAbandoned=true (60s) so leaked connections
  are auto-reaped.
- Add resource-ref in web.xml.
- Make DBConnect.connect look up the pool via JNDI, with the original
  DriverManager path retained as a fallback.
- Copy mysql-connector-java into Tomcat's shared lib/ so the pool's
  container classloader can load the driver.
- Bump CATALINA_OPTS to -Xms256m -Xmx1024m.
- Set MySQL max_connections=500 and shorter wait_timeout/interactive_timeout.
- Add .dockerignore (mysql-data/, .git/, target/) and .gitignore.

Verified: 200 concurrent SQLi requests cap MySQL Threads_connected at
50 with Aborted_connects=0; SQLi auth bypass on /LoginValidator still
works.
diff --git a/.dockerignore b/.dockerignore
@@ -0,0 +1,3 @@
+mysql-data/
+.git/
+target/
diff --git a/.gitignore b/.gitignore
@@ -0,0 +1,8 @@
+mysql-data/
+target/
+*.war
+*.class
+.idea/
+*.iml
+.vscode/
+.DS_Store
diff --git a/Dockerfile b/Dockerfile
@@ -9,16 +9,23 @@ COPY . .
 # Install Maven and JDK, then build the project
 RUN apt-get update && \
     apt-get install -y maven && \
-    mvn clean package
+    mvn clean package && \
+    mvn dependency:copy-dependencies -DincludeArtifactIds=mysql-connector-java -DoutputDirectory=/app/shared-libs
 
 # Stage 2: Runtime Stage
 FROM tomcat:7.0.82
 
 # Copy the WAR file built in the previous stage
 COPY --from=build /app/target/*.war /usr/local/tomcat/webapps/
 
+# Copy the JDBC driver into Tomcat's shared lib so the pool DataSource (declared
+# in META-INF/context.xml and loaded by the container classloader) can find it.
+COPY --from=build /app/shared-libs/*.jar /usr/local/tomcat/lib/
+
 # Copy the pre-prepared tomcat-users.xml to set up user roles
 COPY default-tomcat.xml /usr/local/tomcat/conf/tomcat-users.xml
 
+ENV CATALINA_OPTS="-Xms256m -Xmx1024m"
+
 # CMD to start Tomcat
 CMD ["catalina.sh", "run"]
diff --git a/docker-compose.yml b/docker-compose.yml
@@ -18,3 +18,8 @@ services:
       MYSQL_DATABASE: abc
     command:
       - "--default-authentication-plugin=mysql_native_password"
+      - "--max_connections=500"
+      - "--wait_timeout=120"
+      - "--interactive_timeout=120"
+    volumes:
+      - ./mysql-data:/var/lib/mysql
diff --git a/src/main/java/org/cysecurity/cspf/jvl/model/DBConnect.java b/src/main/java/org/cysecurity/cspf/jvl/model/DBConnect.java
@@ -1,43 +1,59 @@
-/*
- * To change this license header, choose License Headers in Project Properties.
- * To change this template file, choose Tools | Templates
- * and open the template in the editor.
- */
-
 package org.cysecurity.cspf.jvl.model;
 
- 
 import java.io.FileInputStream;
 import java.io.IOException;
-import java.io.InputStream;
 import java.sql.Connection;
 import java.sql.DriverManager;
 import java.sql.SQLException;
 import java.util.Properties;
+import javax.naming.Context;
+import javax.naming.InitialContext;
+import javax.naming.NamingException;
+import javax.sql.DataSource;
 
-/**
- *
- * @author breakthesec
- */
 public class DBConnect {
-    public Connection connect(String path) throws IOException,ClassNotFoundException,SQLException
-    {
-        Properties properties=new Properties();
-        properties.load(new FileInputStream(path));
-        String dbuser=properties.getProperty("dbuser");
-         String dbpass = properties.getProperty("dbpass");
-       String dbfullurl = properties.getProperty("dburl")+properties.getProperty("dbname");
-       String jdbcdriver = properties.getProperty("jdbcdriver");
-            Connection con=null;
-          try
-                   {
-                    Class.forName(jdbcdriver);
-                    con= DriverManager.getConnection(dbfullurl,dbuser,dbpass);
-                    return con;
-                   }
-                   finally
-                    {
-                                 
-                    }      
+
+    private static volatile DataSource pooledDataSource;
+
+    public Connection connect(String path) throws IOException, ClassNotFoundException, SQLException {
+        DataSource ds = lookupPool();
+        if (ds != null) {
+            return ds.getConnection();
+        }
+        return legacyConnect(path);
+    }
+
+    private static DataSource lookupPool() {
+        DataSource ds = pooledDataSource;
+        if (ds != null) {
+            return ds;
+        }
+        synchronized (DBConnect.class) {
+            if (pooledDataSource == null) {
+                try {
+                    Context envCtx = (Context) new InitialContext().lookup("java:comp/env");
+                    pooledDataSource = (DataSource) envCtx.lookup("jdbc/jvl");
+                } catch (NamingException e) {
+                    return null;
+                }
+            }
+            return pooledDataSource;
+        }
+    }
+
+    private static Connection legacyConnect(String path) throws IOException, ClassNotFoundException, SQLException {
+        Properties properties = new Properties();
+        FileInputStream in = new FileInputStream(path);
+        try {
+            properties.load(in);
+        } finally {
+            in.close();
+        }
+        String dbuser = properties.getProperty("dbuser");
+        String dbpass = properties.getProperty("dbpass");
+        String dbfullurl = properties.getProperty("dburl") + properties.getProperty("dbname");
+        String jdbcdriver = properties.getProperty("jdbcdriver");
+        Class.forName(jdbcdriver);
+        return DriverManager.getConnection(dbfullurl, dbuser, dbpass);
     }
-}
+}
diff --git a/src/main/webapp/META-INF/context.xml b/src/main/webapp/META-INF/context.xml
@@ -1,2 +1,22 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<Context antiJARLocking="true" path="/JavaVulnerableLab" useHttpOnly="false"/>
+<Context antiJARLocking="true" path="/JavaVulnerableLab" useHttpOnly="false">
+    <Resource name="jdbc/jvl"
+              auth="Container"
+              type="javax.sql.DataSource"
+              factory="org.apache.tomcat.jdbc.pool.DataSourceFactory"
+              driverClassName="com.mysql.jdbc.Driver"
+              url="jdbc:mysql://mysql:3306/abc?useSSL=false&amp;autoReconnect=true"
+              username="root"
+              password="root"
+              initialSize="5"
+              minIdle="5"
+              maxIdle="20"
+              maxActive="50"
+              maxWait="10000"
+              removeAbandoned="true"
+              removeAbandonedTimeout="60"
+              logAbandoned="true"
+              testOnBorrow="true"
+              validationQuery="SELECT 1"
+              validationInterval="30000"/>
+</Context>
diff --git a/src/main/webapp/WEB-INF/web.xml b/src/main/webapp/WEB-INF/web.xml
@@ -101,5 +101,11 @@
         <servlet-name>xxe</servlet-name>
         <url-pattern>/xxe.do</url-pattern>
     </servlet-mapping>
-   
+
+    <resource-ref>
+        <res-ref-name>jdbc/jvl</res-ref-name>
+        <res-type>javax.sql.DataSource</res-type>
+        <res-auth>Container</res-auth>
+    </resource-ref>
+
 </web-app>
