History | Log In     View a printable version of the current page.  
Issue Details (XML | Word | Printable)

Key: UP-2088
Type: Bug Bug
Status: Closed Closed
Resolution: Fixed
Priority: Critical Critical
Assignee: Eric Dalquist
Reporter: Dustin S.
Votes: 0
Watchers: 0
Operations

If you were logged in you would be able to see more operations.
uPortal

ProxyServlet fails to return when remote content-type check fails

Created: 17/Jun/08 11:10 AM   Updated: 15/Sep/08 06:47 PM
Component/s: None
Affects Version/s: 2.6.1, 2.6.0 GA, 3.0.0
Fix Version/s: 2.6.2, 3.0.1, 3.1.0-M1

Original Estimate: Unknown Remaining Estimate: Unknown Time Spent: Unknown
File Attachments: 1. Text File HttpProxyServlet.patch (3 kb)
2. Text File up_26_branch_patch.txt (3 kb)



 Description  « Hide
The third check for contentType of image has a serious bug, the current code is as follows:

if (!contentType.startsWith("image")){
    response.setStatus(404);
    log.info("httpProxyServlet returning response 404 after receiving element with contentType ="+contentType);
}

However, it should be:

if (!contentType.startsWith("image")){
    response.setStatus(404);
    log.info("httpProxyServlet returning response 404 after receiving element with contentType ="+contentType);
    return;
}

Without the return any content is still retrieved and displayed.

 All   Comments   Work Log   Change History      Sort Order:
Eric Dalquist [17/Jun/08 11:20 AM]
The patch for 3.0.0 fixes the vulnerability in the servlet and disables the servlet in the default configuration as it is not used unless the ProxyWriter is enabled.

Eric Dalquist [17/Jun/08 12:30 PM]
This has been applied to the trunk and the 3.0-patches branch

Andrew Petro [17/Jun/08 01:11 PM]
patch for uPortal 2.6 branch

Eric Dalquist [15/Sep/08 06:47 PM]
Closing issues that have been released