[
https://issues.apache.org/jira/browse/WW-5841?focusedWorklogId=1053300&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1053300
]
ASF GitHub Bot logged work on WW-5841:
--------------------------------------
Author: ASF GitHub Bot
Created on: 07/Nov/26 21:01
Start Date: 07/Nov/26 21:01
Worklog Time Spent: 10m
Work Description: lukaszlenart commented on code in PR #2117:
URL: https://github.com/apache/struts/pull/2117#discussion_r4503729880
##########
boot/src/main/java/org/apache/struts2/boot/StrutsBootServer.java:
##########
@@ -71,8 +74,17 @@ static StrutsBootServer start(ActionRegistry registry,
BootSettings settings) {
hideErrorReportDetails(tomcat);
Path docBase = Files.createDirectory(baseDir.resolve("webapp"));
Context context = tomcat.addContext(settings.contextPath(),
docBase.toString());
+ hardenSessionTracking(context);
context.addServletContainerInitializer(
- (classes, servletContext) ->
servletContext.setAttribute(ActionRegistry.SERVLET_CONTEXT_ATTRIBUTE, registry),
+ (classes, servletContext) -> {
+
servletContext.setAttribute(ActionRegistry.SERVLET_CONTEXT_ATTRIBUTE, registry);
+ // Without a web.xml, a bare embedded context defaults
to the servlet-spec
+ // tracking modes (COOKIE + URL): a session id
supplied as ";jsessionid="
+ // in the URL is accepted and kept alive with no
Set-Cookie, which is a
+ // session-fixation vector (the id can be planted via
a link/Referer
+ // before the victim authenticates). Restrict to
COOKIE only.
Review Comment:
Please reduce this to one line that says what the code does, e.g. `// Tomcat
defaults to COOKIE+URL when no web.xml sets <tracking-mode>; keep cookies
only.` The surrounding declarations carry one-line comments or none, and the
scenario narration belongs in the ticket, not in the file.
##########
boot/src/main/java/org/apache/struts2/boot/StrutsBootServer.java:
##########
@@ -177,6 +189,20 @@ private static void assertContextStarted(Context context,
CapturingStrutsFilter
}
}
+ /**
+ * The session id cookie (JSESSIONID) otherwise carries no SameSite
attribute at all under
+ * the embedded default, which is weaker than every modern browser's own
unset-cookie
+ * default (treated as Lax). Secure is deliberately not forced here: Boot
opens a plain
+ * HTTP listener by default (§5/§5a transport is the operator's), and a
Secure cookie would
+ * simply be refused by the browser on that default deployment
Issue Time Tracking
-------------------
Worklog Id: (was: 1053300)
Time Spent: 20m (was: 10m)
> Struts Boot accepts a session id via URL ;jsessionid= with no cookie and no
> SameSite
> ------------------------------------------------------------------------------------
>
> Key: WW-5841
> URL: https://issues.apache.org/jira/browse/WW-5841
> Project: Struts 2
> Issue Type: Improvement
> Components: Core
> Reporter: Gouri Sankar A
> Priority: Minor
> Fix For: 7.5.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> Without a web.xml, the embedded Tomcat context StrutsBootServer starts
> defaulted to the servlet-spec COOKIE+URL session tracking modes, so a session
> id supplied only via ";jsessionid=" in the URL (no cookie at all) was
> accepted and kept alive with no fresh Set-Cookie -- a session-fixation vector.
> Live-reproduced before this fix: a session established by cookie was resumed
> by replaying the id via the URL parameter with no Cookie header sent at all.
> Fix restricts session tracking to COOKIE only, and the session cookie now
> carries SameSite=Lax (previously unset). Secure is deliberately not forced:
> Boot opens a plain HTTP listener by default, and an operator terminating TLS
> in front of it sets Secure themselves, as with any other servlet container.
> Boot is part of 7.5.0 (unreleased, no production deployments yet), so this
> lands before anyone is exposed to it.
> Tests: StrutsBootTomcatTest gains testSessionCookieHasSameSiteLax and a
> URL-supplied-session-id-is-not-honoured test, with a
> cookie-based-session-still-works control. Full boot suite: 52/0 failures.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
