Fix CR 6991896 FORG server.log and other logging is vulnerable to log forgery. Encode characters and limit user input when logging into log file.

amyroh · amyroh · commit 2df82bb47467 · 2010-11-04T18:14:42.000Z
svn path=/trunk/; revision=1278
diff --git a/impl/src/main/java/org/apache/jasper/servlet/JspServlet.java b/impl/src/main/java/org/apache/jasper/servlet/JspServlet.java
@@ -66,6 +66,7 @@
 import java.util.Enumeration;
 // START GlassFish 750
 import java.net.URL;
+import java.net.URLEncoder;
 import java.util.concurrent.ConcurrentHashMap;
 // END GlassFish 750
 import java.util.concurrent.atomic.*;
@@ -120,6 +121,8 @@ public class JspServlet extends HttpServlet {
     // Logger
     private static Logger log = Logger.getLogger(JspServlet.class.getName());
 
+    private static final int CHAR_LIMIT = 256;
+
     private ServletContext context;
     private ServletConfig config;
     private Options options;
@@ -468,9 +471,13 @@ private void serviceJspFile(HttpServletRequest request,
                         */
                         // START PWC 6282167, 4878272
                         response.sendError(HttpServletResponse.SC_NOT_FOUND);
+                        String realPath = URLEncoder.encode(context.getRealPath(jspUri));
+                        if (realPath.length() > CHAR_LIMIT) {
+                            realPath = realPath.substring(0, CHAR_LIMIT);
+                        }
                         log.severe(Localizer.getMessage(
                             "jsp.error.file.not.found",
-                            context.getRealPath(jspUri)));
+                            realPath));
                         // END PWC 6282167, 4878272
                         return;
                     }
