APAR status
Closed as program error.
Error description
Request in this case has more reference to the parents/upper directory (i.e path traversal ). For example: /abcWeb/..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C ..%5C..%5C..%5C..%5C..%5Cwindows%5Cwin.ini/js/jquery-migrate-3. 3.0.js (/abcWeb is the context root). With application security enabled, 500 is returned. Without application security enabled, 404 is returned. There is no functional issue here. It is mainly about 500 VS 404 status code. 500 should be used when there has had problem in the server. Snippet of the 500 stack: [12/21/20 14:53:59:305 HKT] 000000bb webapp E com.ibm.ws.webcontainer.webapp.WebApp logServletError SRVE0293E: [Servlet Error]-[ServletNameNotFound]: java.lang.IllegalArgumentException: /../../../../../../../../.. /../../../../../../../windows/win.ini/js/jquery-migrate-3.3.0.js at com.ibm.ws.util.WSUtil.resolveURI(WSUtil.java:142) at com.ibm.ws.security.web.URLHandler.getServletURI(URLHandl er.java:203) at com.ibm.ws.security.web.WebCollaborator.authorize(WebColl aborator.java:631) at com.ibm.ws.security.web.EJSWebCollaborator.preInvoke(EJSW ebCollaborator.java:447) at com.ibm.ws.webcontainer.collaborator.WebAppSecurityCollab oratorImpl.preInvoke(WebAppSecurityCollaboratorImpl.java:230) at com.ibm.wsspi.webcontainer.collaborator.CollaboratorHelpe r.preInvokeCollaborators(CollaboratorHelper.java:436) at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invoke Filters(WebAppFilterManager.java:1101) at com.ibm.ws.webcontainer.webapp.WebApp.handleRequest(WebAp p.java:4219) Security preInvoke() catches an exception from util com.ibm.ws.util.WSUtil.resolveURI() and re-throws it with a 500 request attribute for the error status code. It should change to 404 attribute in this case, so that our sendError() can set it accordingly on your behalf.
Local fix
Problem summary
**************************************************************** * USERS AFFECTED: All users of IBM WebSphere Application * * Server * **************************************************************** * PROBLEM DESCRIPTION: When the custom property * * ´com.ibm.ws.webcontainer.set400scontoom * * anyparentdirs´ is enabled, and * * application security is also enabled * * the following error is seen * * ´SRVE0293E´ with a status 500 * * ´´´[3/18/21 16:27:18:740 HKT] * * 000000ac webapp E * * com.ibm.ws.webcontainer.webapp.WebApp * * logServletError SRVE0293E: [Servlet * * Error]-[ServletNameNotFound]: * * java.lang.IllegalArgumentException: * * /../../../../../../../../../../../../.. * * /../../../windows/win.ini/PChgPin.actio * * n´´´ * **************************************************************** * RECOMMENDATION: * **************************************************************** When the custom property ´com.ibm.ws.webcontainer.set400scontoom anyparentdirs´ is enabled, and application security is also enabled the following error is seen ´SRVE0293E´ with a status 500 ´´´[3/18/21 16:27:18:740 HKT] 000000ac webapp E com.ibm.ws.webcontainer.webapp.WebApp logServletError SRVE0293E: [Servlet Error]-[ServletNameNotFound]: java.lang.IllegalArgumentException: /../../../../../../../../../../../../.. /../../../windows/win.ini/PChgPin.actio n´´
Problem conclusion
The code was reviewed and improved to throw the correct status code when the com.ibm.ws.webcontainer.set400scontoomanyparentdirs is enabled. The fix for this APAR is targeted for inclusion in fix pack 8.5.5.21, 9.5.5.10. For more information, see 'Recommended Updates for WebSphere Application Server': https://www.ibm.com/support/pages/node/715553
Temporary fix
Comments
APAR Information
APAR number
PH37483
Reported component name
WEBS APP SERV N
Reported component ID
5724H8800
Reported release
900
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2021-05-24
Closed date
2021-08-04
Last modified date
2021-08-04
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fix information
Fixed component name
WEBS APP SERV N
Fixed component ID
5724H8800
Applicable component levels
R850 PSY
UP
R900 PSY
UP
[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"9.0","Line of Business":{"code":"LOB45","label":"Automation"}}]
Document Information
Modified date:
02 November 2021