Bugzilla – Full Text Bug Listing
| Summary: | [Webapp][Security] Setting sys prop -Dserver_host=127.0.0.1 does NOT force webserver to listen only on 127.0.0.1 interface | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Eclipse Project] Platform | Reporter: | rahulk | ||||
| Component: | User Assistance | Assignee: | Chris Goldthorpe <cgold> | ||||
| Status: | VERIFIED FIXED | QA Contact: | |||||
| Severity: | major | ||||||
| Priority: | P3 | CC: | cgold, kleind, mukund, raji, simon_kaegi | ||||
| Version: | 3.2 | Flags: | simon_kaegi:
review+
|
||||
| Target Milestone: | 3.6.1 | ||||||
| Hardware: | PC | ||||||
| OS: | All | ||||||
| Whiteboard: | |||||||
| Attachments: |
|
||||||
|
Description
rahulk
server_host only changes the URL which is used when opening help pages from the workbench. It is however a problem that the help server in workbench mode allows any client to connect to it. The default mode of starting the help server should only allow local connections. I checked with Simon Kaegi and it is possible to prevent access from remote clients by setting the Jetty configuration parameter "http.host" to "127.0.0.1". I tested this and it does work - I was only able to access the help system from 127.0.0.1 and from localhost after I set this parameter. If I used the ip address of my machine, www.xxx.yyy.zzz I was not able to open the help system using www.xxx.yyy.zzz:port/help/index.jsp either from a remote machine or from the machine on which the help system was hosted. Setting http.host to "localhost" has the same effect. The most obvious way to fix this for 3.6.1 would be for the help system to use the value of the server_host property as the value of http.host when configuring Jetty. The main advantage of this approach is that it only affects users who set the server_host property, thus reducing risk. The main disadvantage is that most users will get no benefit from this patch because they are not setting that property. Are there any other risks we need to be aware of? For 3.7 and beyond I am wondering if we want to make the default mode for workbench help to be to set http.host to localhost. Created attachment 176730 [details]
Patch
This patch checks to see if server_host has been defined and if so uses that as the http.host value when starting Jetty. I believe that this is unlikely to have negative side effects since it only affects users who have set the server_host. There was consideration of not setting http.host when in infocenter mode but I do not think that infocenter owners would ever set server_host, if they did the workaround would be to stop setting that value.
Simon, can you review this patch for inclusion in 3.6.1? Can you think of any risk associated with this fix? Looks good and I think it's fine for 3.6.1 so long as we do not change default behaviour. Patch committed to HEAD. Patch committed to 3.6 maintenance stream, Fixed The patch has also been applied to the 3.5 maintenance stream The patch has been backported and applied to the 3.4 maintenance stream. Verified in M20100901-0800 |