CVE-2017-5648

@@ -406,9 +406,9 @@ protected void forwardToLoginPage(Request request,
         RequestDispatcher disp =
             context.getServletContext().getRequestDispatcher(loginPage);
         try {
-            if (context.fireRequestInitEvent(request)) {
+            if (context.fireRequestInitEvent(request.getRequest())) {
                 disp.forward(request.getRequest(), response);
-                context.fireRequestDestroyEvent(request);
+                context.fireRequestDestroyEvent(request.getRequest());
             }
         } catch (Throwable t) {
             ExceptionUtils.handleThrowable(t);
@@ -450,12 +450,11 @@ protected void forwardToErrorPage(Request request,
         }
 
         RequestDispatcher disp =
-            context.getServletContext().getRequestDispatcher
-            (config.getErrorPage());
+                context.getServletContext().getRequestDispatcher(config.getErrorPage());
         try {
-            if (context.fireRequestInitEvent(request)) {
+            if (context.fireRequestInitEvent(request.getRequest())) {
                 disp.forward(request.getRequest(), response);
-                context.fireRequestDestroyEvent(request);
+                context.fireRequestDestroyEvent(request.getRequest());
             }
         } catch (Throwable t) {
             ExceptionUtils.handleThrowable(t);

@@ -135,7 +135,7 @@ public void fireOnComplete() {
                 }
             }
         } finally {
-            context.fireRequestDestroyEvent(request);
+            context.fireRequestDestroyEvent(request.getRequest());
             clearServletRequestResponse();
             if (Globals.IS_SECURITY_ENABLED) {
                 PrivilegedAction<Void> pa = new PrivilegedSetTccl(oldCL);

@@ -66,7 +66,7 @@ final class StandardHostValve extends ValveBase {
 
     static {
         STRICT_SERVLET_COMPLIANCE = Globals.STRICT_SERVLET_COMPLIANCE;
-        
+
         String accessSession = System.getProperty(
                 "org.apache.catalina.core.StandardHostValve.ACCESS_SESSION");
         if (accessSession == null) {
@@ -146,7 +146,7 @@ public final void invoke(Request request, Response response)
             if (Globals.IS_SECURITY_ENABLED) {
                 PrivilegedAction<Void> pa = new PrivilegedSetTccl(
                         context.getLoader().getClassLoader());
-                AccessController.doPrivileged(pa);                
+                AccessController.doPrivileged(pa);
             } else {
                 Thread.currentThread().setContextClassLoader
                         (context.getLoader().getClassLoader());
@@ -156,9 +156,9 @@ public final void invoke(Request request, Response response)
             request.setAsyncSupported(context.getPipeline().isAsyncSupported());
         }
 
-        boolean asyncAtStart = request.isAsync(); 
+        boolean asyncAtStart = request.isAsync();
         boolean asyncDispatching = request.isAsyncDispatching();
-        if (asyncAtStart || context.fireRequestInitEvent(request)) {
+        if (asyncAtStart || context.fireRequestInitEvent(request.getRequest())) {
 
             // Ask this Context to process this request. Requests that are in
             // async mode and are not being dispatched to this resource must be
@@ -197,7 +197,7 @@ public final void invoke(Request request, Response response)
             if (!context.getState().isAvailable()) {
                 return;
             }
-    
+
             // Look for (and render if found) an application level error page
             if (response.isErrorReportRequired()) {
                 if (t != null) {
@@ -208,7 +208,7 @@ public final void invoke(Request request, Response response)
             }
 
             if (!request.isAsync() && !asyncAtStart) {
-                context.fireRequestDestroyEvent(request);
+                context.fireRequestDestroyEvent(request.getRequest());
             }
         }
 
@@ -222,7 +222,7 @@ public final void invoke(Request request, Response response)
         if (Globals.IS_SECURITY_ENABLED) {
             PrivilegedAction<Void> pa = new PrivilegedSetTccl(
                     StandardHostValve.class.getClassLoader());
-            AccessController.doPrivileged(pa);                
+            AccessController.doPrivileged(pa);
         } else {
             Thread.currentThread().setContextClassLoader
                     (StandardHostValve.class.getClassLoader());
@@ -258,7 +258,7 @@ public final void event(Request request, Response response, CometEvent event)
         // Ask this Context to process this request
         context.getPipeline().getFirst().event(request, response, event);
 
-        
+
         // Error page processing
         response.setSuspended(false);
 
@@ -469,7 +469,7 @@ private boolean custom(Request request, Response response,
 
             if (response.isCommitted()) {
                 // Response is committed - including the error page is the
-                // best we can do 
+                // best we can do
                 rd.include(request.getRequest(), response.getResponse());
             } else {
                 // Reset the response (keeping the real error code and message)

@@ -193,6 +193,10 @@
         session - if there is a session - when running under a
         <code>SecurityManager</code>. Patch provided by Jan Engehausen. (markt)
       </fix>
+      <fix>
+        Ensure request and response facades are used when firing application
+        listeners. (markt/remm)
+      </fix>
     </changelog>
   </subsection>
 </section>

@@ -394,9 +394,9 @@ protected void forwardToLoginPage(Request request,
         RequestDispatcher disp =
             context.getServletContext().getRequestDispatcher(loginPage);
         try {
-            if (context.fireRequestInitEvent(request)) {
+            if (context.fireRequestInitEvent(request.getRequest())) {
                 disp.forward(request.getRequest(), response);
-                context.fireRequestDestroyEvent(request);
+                context.fireRequestDestroyEvent(request.getRequest());
             }
         } catch (Throwable t) {
             ExceptionUtils.handleThrowable(t);
@@ -438,12 +438,11 @@ protected void forwardToErrorPage(Request request,
         }
 
         RequestDispatcher disp =
-            context.getServletContext().getRequestDispatcher
-            (config.getErrorPage());
+                context.getServletContext().getRequestDispatcher(config.getErrorPage());
         try {
-            if (context.fireRequestInitEvent(request)) {
+            if (context.fireRequestInitEvent(request.getRequest())) {
                 disp.forward(request.getRequest(), response);
-                context.fireRequestDestroyEvent(request);
+                context.fireRequestDestroyEvent(request.getRequest());
             }
         } catch (Throwable t) {
             ExceptionUtils.handleThrowable(t);

@@ -113,7 +113,7 @@ public void fireOnComplete() {
                 }
             }
         } finally {
-            context.fireRequestDestroyEvent(request);
+            context.fireRequestDestroyEvent(request.getRequest());
             clearServletRequestResponse();
             context.unbind(Globals.IS_SECURITY_ENABLED, oldCL);
         }

@@ -124,7 +124,7 @@ public final void invoke(Request request, Response response)
         try {
             context.bind(Globals.IS_SECURITY_ENABLED, MY_CLASSLOADER);
 
-            if (!asyncAtStart && !context.fireRequestInitEvent(request)) {
+            if (!asyncAtStart && !context.fireRequestInitEvent(request.getRequest())) {
                 // Don't fire listeners during async processing (the listener
                 // fired for the request that called startAsync()).
                 // If a request init listener throws an exception, the request
@@ -180,7 +180,7 @@ public final void invoke(Request request, Response response)
             }
 
             if (!request.isAsync() && !asyncAtStart) {
-                context.fireRequestDestroyEvent(request);
+                context.fireRequestDestroyEvent(request.getRequest());
             }
         } finally {
             // Access a session (if present) to update last accessed time, based

@@ -113,6 +113,10 @@
         session - if there is a session - when running under a
         <code>SecurityManager</code>. Patch provided by Jan Engehausen. (markt)
       </fix>
+      <fix>
+        Ensure request and response facades are used when firing application
+        listeners. (markt/remm)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">

@@ -427,9 +427,9 @@ protected void forwardToLoginPage(Request request,
         RequestDispatcher disp =
             context.getServletContext().getRequestDispatcher(loginPage);
         try {
-            if (context.fireRequestInitEvent(request)) {
+            if (context.fireRequestInitEvent(request.getRequest())) {
                 disp.forward(request.getRequest(), response);
-                context.fireRequestDestroyEvent(request);
+                context.fireRequestDestroyEvent(request.getRequest());
             }
         } catch (Throwable t) {
             ExceptionUtils.handleThrowable(t);
@@ -471,12 +471,11 @@ protected void forwardToErrorPage(Request request,
         }
 
         RequestDispatcher disp =
-            context.getServletContext().getRequestDispatcher
-            (config.getErrorPage());
+                context.getServletContext().getRequestDispatcher(config.getErrorPage());
         try {
-            if (context.fireRequestInitEvent(request)) {
+            if (context.fireRequestInitEvent(request.getRequest())) {
                 disp.forward(request.getRequest(), response);
-                context.fireRequestDestroyEvent(request);
+                context.fireRequestDestroyEvent(request.getRequest());
             }
         } catch (Throwable t) {
             ExceptionUtils.handleThrowable(t);

@@ -112,7 +112,7 @@ public void fireOnComplete() {
                 }
             }
         } finally {
-            context.fireRequestDestroyEvent(request);
+            context.fireRequestDestroyEvent(request.getRequest());
             clearServletRequestResponse();
             context.unbind(Globals.IS_SECURITY_ENABLED, oldCL);
         }

@@ -123,7 +123,7 @@ public final void invoke(Request request, Response response)
         try {
             context.bind(Globals.IS_SECURITY_ENABLED, MY_CLASSLOADER);
 
-            if (!asyncAtStart && !context.fireRequestInitEvent(request)) {
+            if (!asyncAtStart && !context.fireRequestInitEvent(request.getRequest())) {
                 // Don't fire listeners during async processing (the listener
                 // fired for the request that called startAsync()).
                 // If a request init listener throws an exception, the request
@@ -179,7 +179,7 @@ public final void invoke(Request request, Response response)
             }
 
             if (!request.isAsync() && !asyncAtStart) {
-                context.fireRequestDestroyEvent(request);
+                context.fireRequestDestroyEvent(request.getRequest());
             }
         } finally {
             // Access a session (if present) to update last accessed time, based

@@ -157,6 +157,10 @@
         session - if there is a session - when running under a
         <code>SecurityManager</code>. Patch provided by Jan Engehausen. (markt)
       </fix>
+      <fix>
+        Ensure request and response facades are used when firing application
+        listeners. (markt/remm)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">

@@ -427,9 +427,9 @@ protected void forwardToLoginPage(Request request,
         RequestDispatcher disp =
             context.getServletContext().getRequestDispatcher(loginPage);
         try {
-            if (context.fireRequestInitEvent(request)) {
+            if (context.fireRequestInitEvent(request.getRequest())) {
                 disp.forward(request.getRequest(), response);
-                context.fireRequestDestroyEvent(request);
+                context.fireRequestDestroyEvent(request.getRequest());
             }
         } catch (Throwable t) {
             ExceptionUtils.handleThrowable(t);
@@ -471,12 +471,11 @@ protected void forwardToErrorPage(Request request,
         }
 
         RequestDispatcher disp =
-            context.getServletContext().getRequestDispatcher
-            (config.getErrorPage());
+                context.getServletContext().getRequestDispatcher(config.getErrorPage());
         try {
-            if (context.fireRequestInitEvent(request)) {
+            if (context.fireRequestInitEvent(request.getRequest())) {
                 disp.forward(request.getRequest(), response);
-                context.fireRequestDestroyEvent(request);
+                context.fireRequestDestroyEvent(request.getRequest());
             }
         } catch (Throwable t) {
             ExceptionUtils.handleThrowable(t);

@@ -112,7 +112,7 @@ public void fireOnComplete() {
                 }
             }
         } finally {
-            context.fireRequestDestroyEvent(request);
+            context.fireRequestDestroyEvent(request.getRequest());
             clearServletRequestResponse();
             context.unbind(Globals.IS_SECURITY_ENABLED, oldCL);
         }

@@ -123,7 +123,7 @@ public final void invoke(Request request, Response response)
         try {
             context.bind(Globals.IS_SECURITY_ENABLED, MY_CLASSLOADER);
 
-            if (!asyncAtStart && !context.fireRequestInitEvent(request)) {
+            if (!asyncAtStart && !context.fireRequestInitEvent(request.getRequest())) {
                 // Don't fire listeners during async processing (the listener
                 // fired for the request that called startAsync()).
                 // If a request init listener throws an exception, the request
@@ -179,7 +179,7 @@ public final void invoke(Request request, Response response)
             }
 
             if (!request.isAsync() && !asyncAtStart) {
-                context.fireRequestDestroyEvent(request);
+                context.fireRequestDestroyEvent(request.getRequest());
             }
         } finally {
             // Access a session (if present) to update last accessed time, based

@@ -167,6 +167,10 @@
         session - if there is a session - when running under a
         <code>SecurityManager</code>. Patch provided by Jan Engehausen. (markt)
       </fix>
+      <fix>
+        Ensure request and response facades are used when firing application
+        listeners. (markt/remm)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">