tomcat/CVE-2024-54677-7.patch

From 4d5cc6538d91386f950373ac8120e98c2c78ed3a Mon Sep 17 00:00:00 2001
From: Mark Thomas <markt@apache.org>
Date: Wed, 4 Dec 2024 15:14:17 +0000
Subject: [PATCH] Limit shopping cart to pre-defined items

Origin: https://github.com/apache/tomcat/commit/4d5cc6538d91386f950373ac8120e98c2c78ed3a
---
 webapps/docs/changelog.xml                    |  4 ++
 .../WEB-INF/classes/sessions/DummyCart.java   | 42 +++++++++++--------
 .../WEB-INF/classes/sessions/Item.java        | 37 ++++++++++++++++
 webapps/examples/jsp/index.html               |  2 +-
 webapps/examples/jsp/sessions/carts.jsp       |  8 ++--
 webapps/examples/jsp/sessions/crt.html        |  7 +++-
 .../jsp/sessions/{carts.html => shopping.jsp} | 41 +++++++++---------
 7 files changed, 95 insertions(+), 46 deletions(-)
 create mode 100644 webapps/examples/WEB-INF/classes/sessions/Item.java
 rename webapps/examples/jsp/sessions/{carts.html => shopping.jsp} (75%)

diff --git a/webapps/examples/WEB-INF/classes/sessions/DummyCart.java b/webapps/examples/WEB-INF/classes/sessions/DummyCart.java
index 44decc98a9a2..7088557b9595 100644
--- a/webapps/examples/WEB-INF/classes/sessions/DummyCart.java
+++ b/webapps/examples/WEB-INF/classes/sessions/DummyCart.java
@@ -16,42 +16,50 @@
  */
 package sessions;
 
-import java.util.ArrayList;
 import java.util.Collections;
-import java.util.List;
+import java.util.HashSet;
+import java.util.Set;
 
 public class DummyCart {
-    final List<String> items = Collections.synchronizedList(new ArrayList<>());
+    final Set<Item> items = Collections.synchronizedSet(new HashSet<>());
+    int itemId = -1;
     String submit = null;
-    String item = null;
 
-    private void addItem(String name) {
-        items.add(name);
+    public void setItemId(int itemId) {
+        this.itemId = itemId;
     }
 
-    private void removeItem(String name) {
-        items.remove(name);
+    public void setSubmit(String s) {
+        submit = s;
     }
 
-    public void setItem(String name) {
-        item = name;
+    private void addItem(int itemId) {
+        try {
+            items.add(Item.values()[itemId]);
+        } catch (ArrayIndexOutOfBoundsException e) {
+            // Ignore. Can only happen if user edits URL directly.
+        }
     }
 
-    public void setSubmit(String s) {
-        submit = s;
+    private void removeItem(int itemId) {
+        try {
+            items.remove(Item.values()[itemId]);
+        } catch (ArrayIndexOutOfBoundsException e) {
+            // Ignore. Can only happen if user edits URL directly.
+        }
     }
 
-    public String[] getItems() {
-        return items.toArray(new String[0]);
+    public Item[] getItems() {
+        return items.toArray(new Item[0]);
     }
 
     public void processRequest() {
         // null value for submit - user hit enter instead of clicking on
         // "add" or "remove"
         if (submit == null || submit.equals("add")) {
-            addItem(item);
+            addItem(itemId);
         } else if (submit.equals("remove")) {
-            removeItem(item);
+            removeItem(itemId);
         }
 
         // reset at the end of the request
@@ -61,6 +69,6 @@ public void processRequest() {
     // reset
     private void reset() {
         submit = null;
-        item = null;
+        itemId = -1;
     }
 }
diff --git a/webapps/examples/WEB-INF/classes/sessions/Item.java b/webapps/examples/WEB-INF/classes/sessions/Item.java
new file mode 100644
index 000000000000..447d04443744
--- /dev/null
+++ b/webapps/examples/WEB-INF/classes/sessions/Item.java
@@ -0,0 +1,37 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sessions;
+
+public enum Item {
+
+    VIDEO("Beavis & Butt-head Video collection"),
+    MOVIE("X-files movie"),
+    TAPES("Twin peaks tapes"),
+    CD("NIN CD"),
+    BOOK("JSP Book"),
+    TICKETS("Concert tickets");
+
+    private final String title;
+
+    Item(String title) {
+        this.title = title;
+    }
+
+    public String getTitle() {
+        return title;
+    }
+}
diff --git a/webapps/examples/jsp/index.html b/webapps/examples/jsp/index.html
index b2371207cfe7..dc25005b2710 100644
--- a/webapps/examples/jsp/index.html
+++ b/webapps/examples/jsp/index.html
@@ -228,7 +228,7 @@ <h2>JSP 1.2 Examples</h2>
 <tr>
 <td>Carts</td>
 
-<td style="width: 30%;"><a href="sessions/carts.html"><img src="images/execute.gif" alt=""></a><a href="sessions/carts.html">Execute</a></td>
+<td style="width: 30%;"><a href="sessions/shopping.jsp"><img src="images/execute.gif" alt=""></a><a href="sessions/shopping.jsp">Execute</a></td>
 
 <td style="width: 30%;"><a href="sessions/crt.html"><img src="images/code.gif" alt=""></a><a href="sessions/crt.html">Source</a></td>
 </tr>
diff --git a/webapps/examples/jsp/sessions/carts.jsp b/webapps/examples/jsp/sessions/carts.jsp
index dc51495c4bec..fa5624dee6bd 100644
--- a/webapps/examples/jsp/sessions/carts.jsp
+++ b/webapps/examples/jsp/sessions/carts.jsp
@@ -27,10 +27,10 @@
 <br> You have the following items in your cart:
 <ol>
 <%
-    String[] items = cart.getItems();
-    for (String item : items) {
+    Item[] items = cart.getItems();
+    for (Item item : items) {
 %>
-<li> <% out.print(util.HTMLFilter.filter(item)); %>
+<li> <% out.print(util.HTMLFilter.filter(item.getTitle())); %>
 <%
     }
 %>
@@ -39,5 +39,5 @@
 </FONT>
 
 <hr>
-<%@ include file ="carts.html" %>
+<%@ include file ="shopping.jsp" %>
 </html>
diff --git a/webapps/examples/jsp/sessions/crt.html b/webapps/examples/jsp/sessions/crt.html
index 11e6edafe0e9..28ace66012c7 100644
--- a/webapps/examples/jsp/sessions/crt.html
+++ b/webapps/examples/jsp/sessions/crt.html
@@ -22,9 +22,12 @@
 </head>
 
 <body bgcolor="#FFFFFF">
-<p><font color="#0000FF"><a href="carts.html"><img src="../images/execute.gif" align="right" border="0"></a><a href="../index.html"><img src="../images/return.gif" width="24" height="24" align="right" border="0"></a></font></p>
+<p><font color="#0000FF"><a href="shopping.jsp"><img src="../images/execute.gif" align="right" border="0"></a><a href="../index.html"><img src="../images/return.gif" width="24" height="24" align="right" border="0"></a></font></p>
 
-<h3><a href="carts.jsp.html">Source Code for Cart Example<font color="#0000FF"></a>
+<h3><a href="shopping.jsp.html">Source Code for Cart Example Shopping Page<font color="#0000FF"></a>
+  </font> </h3>
+
+<h3><a href="carts.jsp.html">Source Code for Cart Example Cart Page<font color="#0000FF"></a>
   </font> </h3>
 
 <h3><a href="DummyCart.html">Property Sheet for DummyCart
diff --git a/webapps/examples/jsp/sessions/carts.html b/webapps/examples/jsp/sessions/shopping.jsp
similarity index 75%
rename from webapps/examples/jsp/sessions/carts.html
rename to webapps/examples/jsp/sessions/shopping.jsp
index 834ee0a594fd..3487b1029547 100644
--- a/webapps/examples/jsp/sessions/carts.html
+++ b/webapps/examples/jsp/sessions/shopping.jsp
@@ -1,5 +1,4 @@
-<html>
-<!--
+<%--
  Licensed to the Apache Software Foundation (ASF) under one or more
   contributor license agreements.  See the NOTICE file distributed with
   this work for additional information regarding copyright ownership.
@@ -14,33 +13,31 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
--->
-
+--%>
+<%@ page import="sessions.Item" %>
+<html>
 <head>
-    <title>carts</title>
+<title>Shopping Cart Example</title>
 </head>
 
- <body bgcolor="white">
+<body bgcolor="white">
 <font size = 5 color="#CC0000">
 
 <form type=POST action=carts.jsp>
-<BR>
+<br>
 Please enter item to add or remove:
 <br>
-Add Item:
-
-<SELECT NAME="item">
-<OPTION>Beavis & Butt-head Video collection
-<OPTION>X-files movie
-<OPTION>Twin peaks tapes
-<OPTION>NIN CD
-<OPTION>JSP Book
-<OPTION>Concert tickets
-<OPTION>Love life
-<OPTION>Switch blade
-<OPTION>Rex, Rugs & Rock n' Roll
-</SELECT>
-
+Select Item:
+
+<select name="itemId">
+<%
+  for (Item item : Item.values()) {
+%>
+  <option value="<%= item.ordinal() %>"><%= item.getTitle() %></option>
+<%
+  }
+%>
+</select>
 
 <br> <br>
 <INPUT TYPE=submit name="submit" value="add">
@@ -48,6 +45,6 @@
 
 </form>
 
-</FONT>
+</font>
 </body>
 </html>