CVE-2017-5664

@@ -423,6 +423,18 @@ protected String getPathPrefix(final HttpServletRequest request) {
     }
 
 
+    @Override
+    protected void service(HttpServletRequest req, HttpServletResponse resp)
+            throws ServletException, IOException {
+
+        if (req.getDispatcherType() == DispatcherType.ERROR) {
+            doGet(req, resp);
+        } else {
+            super.service(req, resp);
+        }
+    }
+
+
     /**
      * Process a GET request for the specified resource.
      *

@@ -40,6 +40,7 @@
 import javax.naming.NamingEnumeration;
 import javax.naming.NamingException;
 import javax.naming.directory.DirContext;
+import javax.servlet.DispatcherType;
 import javax.servlet.RequestDispatcher;
 import javax.servlet.ServletContext;
 import javax.servlet.ServletException;
@@ -354,6 +355,11 @@ protected void service(HttpServletRequest req, HttpServletResponse resp)
             return;
         }
 
+        if (req.getDispatcherType() == DispatcherType.ERROR) {
+            doGet(req, resp);
+            return;
+        }
+
         final String method = req.getMethod();
 
         if (debug > 0) {

@@ -140,6 +140,12 @@
         <bug>60911</bug>: Ensure NPE will not be thrown when looking for SSL
         session ID. Based on a patch by Didier Gutacker. (violetagg)
       </fix>
+      <fix>
+        Ensure that when the Default or WebDAV servlets process an error
+        dispatch that the error resource is processed via the
+        <code>doGet()</code> method irrespective of the method used for the
+        original request that triggered the error. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">

@@ -380,6 +380,18 @@ protected String getPathPrefix(final HttpServletRequest request) {
     }
 
 
+    @Override
+    protected void service(HttpServletRequest req, HttpServletResponse resp)
+            throws ServletException, IOException {
+
+        if (req.getDispatcherType() == DispatcherType.ERROR) {
+            doGet(req, resp);
+        } else {
+            super.service(req, resp);
+        }
+    }
+
+
     /**
      * Process a GET request for the specified resource.
      *

@@ -30,6 +30,7 @@
 import java.util.TimeZone;
 import java.util.Vector;
 
+import javax.servlet.DispatcherType;
 import javax.servlet.RequestDispatcher;
 import javax.servlet.ServletContext;
 import javax.servlet.ServletException;
@@ -312,6 +313,11 @@ protected void service(HttpServletRequest req, HttpServletResponse resp)
             return;
         }
 
+        if (req.getDispatcherType() == DispatcherType.ERROR) {
+            doGet(req, resp);
+            return;
+        }
+
         final String method = req.getMethod();
 
         if (debug > 0) {

@@ -78,6 +78,12 @@
         determining if the current request is for custom error page or not.
         (markt)
       </fix>
+      <fix>
+        Ensure that when the Default or WebDAV servlets process an error
+        dispatch that the error resource is processed via the
+        <code>doGet()</code> method irrespective of the method used for the
+        original request that triggered the error. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Jasper">

@@ -407,6 +407,18 @@ protected String getPathPrefix(final HttpServletRequest request) {
     }
 
 
+    @Override
+    protected void service(HttpServletRequest req, HttpServletResponse resp)
+            throws ServletException, IOException {
+
+        if (req.getDispatcherType() == DispatcherType.ERROR) {
+            doGet(req, resp);
+        } else {
+            super.service(req, resp);
+        }
+    }
+
+
     /**
      * Process a GET request for the specified resource.
      *

@@ -30,6 +30,7 @@
 import java.util.TimeZone;
 import java.util.Vector;
 
+import javax.servlet.DispatcherType;
 import javax.servlet.RequestDispatcher;
 import javax.servlet.ServletContext;
 import javax.servlet.ServletException;
@@ -315,6 +316,11 @@ protected void service(HttpServletRequest req, HttpServletResponse resp)
             return;
         }
 
+        if (req.getDispatcherType() == DispatcherType.ERROR) {
+            doGet(req, resp);
+            return;
+        }
+
         final String method = req.getMethod();
 
         if (debug > 0) {

@@ -83,6 +83,12 @@
         determining if the current request is for custom error page or not.
         (markt)
       </fix>
+      <fix>
+        Ensure that when the Default or WebDAV servlets process an error
+        dispatch that the error resource is processed via the
+        <code>doGet()</code> method irrespective of the method used for the
+        original request that triggered the error. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">

@@ -400,6 +400,18 @@ protected String getPathPrefix(final HttpServletRequest request) {
     }
 
 
+    @Override
+    protected void service(HttpServletRequest req, HttpServletResponse resp)
+            throws ServletException, IOException {
+
+        if (req.getDispatcherType() == DispatcherType.ERROR) {
+            doGet(req, resp);
+        } else {
+            super.service(req, resp);
+        }
+    }
+
+
     /**
      * Process a GET request for the specified resource.
      *

@@ -30,6 +30,7 @@
 import java.util.TimeZone;
 import java.util.Vector;
 
+import javax.servlet.DispatcherType;
 import javax.servlet.RequestDispatcher;
 import javax.servlet.ServletContext;
 import javax.servlet.ServletException;
@@ -315,6 +316,11 @@ protected void service(HttpServletRequest req, HttpServletResponse resp)
             return;
         }
 
+        if (req.getDispatcherType() == DispatcherType.ERROR) {
+            doGet(req, resp);
+            return;
+        }
+
         final String method = req.getMethod();
 
         if (debug > 0) {

@@ -88,6 +88,12 @@
         determining if the current request is for custom error page or not.
         (markt)
       </fix>
+      <fix>
+        Ensure that when the Default or WebDAV servlets process an error
+        dispatch that the error resource is processed via the
+        <code>doGet()</code> method irrespective of the method used for the
+        original request that triggered the error. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">

@@ -245,7 +245,7 @@ public class DefaultServlet
         urlEncoder.addSafeCharacter('.');
         urlEncoder.addSafeCharacter('*');
         urlEncoder.addSafeCharacter('/');
-        
+
         if (Globals.IS_SECURITY_ENABLED) {
             factory = DocumentBuilderFactory.newInstance();
             factory.setNamespaceAware(true);
@@ -860,8 +860,7 @@ protected void serveResource(HttpServletRequest request,
             }
         }
 
-        boolean isError =
-            response.getStatus() >= HttpServletResponse.SC_BAD_REQUEST;
+        boolean isError = DispatcherType.ERROR == request.getDispatcherType();
 
         // Check if the conditions specified in the optional If headers are
         // satisfied.
@@ -1326,7 +1325,7 @@ protected InputStream render(String contextPath, CacheEntry cacheEntry)
 
     }
 
-    
+
     /**
      * Return an InputStream to an HTML representation of the contents
      * of this directory.
@@ -1767,15 +1766,15 @@ protected Source findXsltInputStream(DirContext directory)
 
 
     private File validateGlobalXsltFile() {
-        
+
         File result = null;
         String base = System.getProperty(Globals.CATALINA_BASE_PROP);
-        
+
         if (base != null) {
             File baseConf = new File(base, "conf");
             result = validateGlobalXsltFile(baseConf);
         }
-        
+
         if (result == null) {
             String home = System.getProperty(Globals.CATALINA_HOME_PROP);
             if (home != null && !home.equals(base)) {
@@ -2364,6 +2363,8 @@ protected static class Range {
 
         /**
          * Validate range.
+         *
+         * @return true if the range is valid, otherwise false
          */
         public boolean validate() {
             if (end >= length)

@@ -74,6 +74,11 @@
         ensure that that correct encoding (path differs from query string) is
         applied and that the encoding is applied consistently. (markt)
       </fix>
+      <fix>
+        Use a more reliable mechanism for the <code>DefaultServlet</code> when
+        determining if the current request is for custom error page or not.
+        (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Jasper">

@@ -760,7 +760,7 @@ protected void serveResource(HttpServletRequest request,
             return;
         }
 
-        boolean isError = response.getStatus() >= HttpServletResponse.SC_BAD_REQUEST;
+        boolean isError = DispatcherType.ERROR == request.getDispatcherType();
 
         boolean included = false;
         // Check if the conditions specified in the optional If headers are

@@ -73,6 +73,11 @@
         ensure that that correct encoding (path differs from query string) is
         applied and that the encoding is applied consistently. (markt)
       </fix>
+      <fix>
+        Use a more reliable mechanism for the <code>DefaultServlet</code> when
+        determining if the current request is for custom error page or not.
+        (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Jasper">

@@ -794,7 +794,7 @@ protected void serveResource(HttpServletRequest request,
             return;
         }
 
-        boolean isError = response.getStatus() >= HttpServletResponse.SC_BAD_REQUEST;
+        boolean isError = DispatcherType.ERROR == request.getDispatcherType();
 
         boolean included = false;
         // Check if the conditions specified in the optional If headers are

@@ -78,6 +78,11 @@
         the number of places the associated <code>Charset</code> needs to be
         looked up. (markt)
       </scode>
+      <fix>
+        Use a more reliable mechanism for the <code>DefaultServlet</code> when
+        determining if the current request is for custom error page or not.
+        (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">

@@ -787,7 +787,7 @@ protected void serveResource(HttpServletRequest request,
             return;
         }
 
-        boolean isError = response.getStatus() >= HttpServletResponse.SC_BAD_REQUEST;
+        boolean isError = DispatcherType.ERROR == request.getDispatcherType();
 
         boolean included = false;
         // Check if the conditions specified in the optional If headers are

@@ -83,6 +83,11 @@
         the number of places the associated <code>Charset</code> needs to be
         looked up. (markt)
       </scode>
+      <fix>
+        Use a more reliable mechanism for the <code>DefaultServlet</code> when
+        determining if the current request is for custom error page or not.
+        (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">