[tomcat] branch 9.0.x updated: Security hardening. Deprecate getResources() and always return null.

[markt]

This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/9.0.x by this push:
     new 8a904f6  Security hardening. Deprecate getResources() and always 
return null.
8a904f6 is described below

commit 8a904f6065080409a1e00606cd7bceec6ad8918c
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Wed Mar 30 20:22:49 2022 +0100

    Security hardening. Deprecate getResources() and always return null.
    
    This method is never used by Tomcat. If something accidently exposes the
    class loader then this method can be used to gain access to Tomcat
    internals.
---
 java/org/apache/catalina/loader/WebappClassLoaderBase.java |  7 ++++++-
 webapps/docs/changelog.xml                                 | 10 ++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/java/org/apache/catalina/loader/WebappClassLoaderBase.java 
b/java/org/apache/catalina/loader/WebappClassLoaderBase.java
index 76a53b7..8746b6b 100644
--- a/java/org/apache/catalina/loader/WebappClassLoaderBase.java
+++ b/java/org/apache/catalina/loader/WebappClassLoaderBase.java
@@ -425,10 +425,15 @@ public abstract class WebappClassLoaderBase extends 
URLClassLoader
     // ------------------------------------------------------------- Properties
 
     /**
+     * Unused. Always returns {@code null}.
+     *
      * @return associated resources.
+     *
+     * @deprecated This will be removed in Tomcat 10.1.x onwards
      */
+    @Deprecated
     public WebResourceRoot getResources() {
-        return this.resources;
+        return null;
     }
 
 
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 6bdf4b6..f6b43e9 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -105,6 +105,16 @@
   issues do not "pop up" wrt. others).
 -->
 <section name="Tomcat 9.0.62 (remm)" rtext="in development">
+  <subsection name="Catalina">
+    <changelog>
+      <add>
+         Effectively disable the
+         <code>WebappClassLoaderBase.getResources()</code> method as it is not
+         used and if something accidently exposes the class loader this method
+         can be used to gain access to Tomcat internals. (markt)
+      </add>
+    </changelog>
+  </subsection>
 </section>
 <section name="Tomcat 9.0.61 (remm)" rtext="in progress">
   <subsection name="Catalina">

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org