2007-05-14 Igor Zelmanovich <igorz@mainsoft.com>

	* WebConfigurationManager.cs:
	make configurations synchronized.
	added new internal method RemoveConfigurationFromCache.

	* HttpApplication.cs:
	prevent DOS attack: remove configuration from the cache in case
	of invalid resource not exists

svn path=/trunk/mcs/; revision=77336

diff --git a/mcs/class/System.Web/System.Web.Configuration_2.0/ChangeLog b/mcs/class/System.Web/System.Web.Configuration_2.0/ChangeLog
index 808041420e81696a626e2cffd62a1453515de439..5e2b397556b7948a6c8795edd79e71e223916b2c 100644 (file)
--- a/mcs/class/System.Web/System.Web.Configuration_2.0/ChangeLog
+++ b/mcs/class/System.Web/System.Web.Configuration_2.0/ChangeLog
@@ -1,3 +1,9 @@
+2007-05-14  Igor Zelmanovich <igorz@mainsoft.com>
+
+       * WebConfigurationManager.cs: 
+       make configurations synchronized.
+       added new internal method RemoveConfigurationFromCache.
+

 2007-05-07  Marek Habersack  <mhabersack@novell.com>
 
        * PagesSection.cs: buffering is on by default.
 2007-05-07  Marek Habersack  <mhabersack@novell.com>
 
        * PagesSection.cs: buffering is on by default.

diff --git a/mcs/class/System.Web/System.Web.Configuration_2.0/WebConfigurationManager.cs b/mcs/class/System.Web/System.Web.Configuration_2.0/WebConfigurationManager.cs
index 05f8a0fdd6cb6d69dda11d479d6b02bb10570ac9..edab01d8d8d9d6ecab691069061dc481a47372c4 100644 (file)
--- a/mcs/class/System.Web/System.Web.Configuration_2.0/WebConfigurationManager.cs
+++ b/mcs/class/System.Web/System.Web.Configuration_2.0/WebConfigurationManager.cs
@@ -45,7 +45,7 @@ namespace System.Web.Configuration {
        {
 #if !TARGET_J2EE
                static IInternalConfigConfigurationFactory configFactory;
        {
 #if !TARGET_J2EE
                static IInternalConfigConfigurationFactory configFactory;

-               static Hashtable configurations = new Hashtable ();
+               static Hashtable configurations = Hashtable.Synchronized (new Hashtable ());

 #else
                static internal IInternalConfigConfigurationFactory configFactory
                {
 #else
                static internal IInternalConfigConfigurationFactory configFactory
                {


@@ -79,7 +79,7 @@ namespace System.Web.Configuration {
                                        lock (AppDomain.CurrentDomain){
                                                object initialized = AppDomain.CurrentDomain.GetData("WebConfigurationManager.configurations.initialized");
                                                if (initialized == null){
                                        lock (AppDomain.CurrentDomain){
                                                object initialized = AppDomain.CurrentDomain.GetData("WebConfigurationManager.configurations.initialized");
                                                if (initialized == null){

-                                                       table = new Hashtable();
+                                                       table = Hashtable.Synchronized (new Hashtable ());

                                                        configurations = table;
                                                }
                                        }
                                                        configurations = table;
                                                }
                                        }


@@ -186,13 +186,8 @@ namespace System.Web.Configuration {
 
                        conf = (_Configuration) configurations [path];
                        if (conf == null) {
 
                        conf = (_Configuration) configurations [path];
                        if (conf == null) {

-                               lock (configurations) {
-                                       conf = (_Configuration) configurations [path];
-                                       if (conf == null) {

                                                conf = ConfigurationFactory.Create (typeof (WebConfigurationHost), null, path, site, locationSubPath, server, userName, password);
                                                configurations [path] = conf;
                                                conf = ConfigurationFactory.Create (typeof (WebConfigurationHost), null, path, site, locationSubPath, server, userName, password);
                                                configurations [path] = conf;

-                                       }
-                               }

                        }
                        return conf;
                }
                        }
                        return conf;
                }


@@ -247,11 +242,7 @@ namespace System.Web.Configuration {
                
                public static object GetSection (string sectionName)
                {
                
                public static object GetSection (string sectionName)
                {

-                       string path = (HttpContext.Current != null
-                           && HttpContext.Current.Request != null) ?
-                               HttpContext.Current.Request.Path : HttpRuntime.AppDomainAppVirtualPath;
-
-                       return GetSection (sectionName, path);
+                       return GetSection (sectionName, GetCurrentPath (HttpContext.Current));

                }
 
                public static object GetSection (string sectionName, string path)
                }
 
                public static object GetSection (string sectionName, string path)


@@ -265,6 +256,16 @@ namespace System.Web.Configuration {
                        return get_runtime_object.Invoke (section, new object [0]);
                }
 
                        return get_runtime_object.Invoke (section, new object [0]);
                }
 

+               static string GetCurrentPath (HttpContext ctx)
+               {
+                       return (ctx != null && ctx.Request != null) ? ctx.Request.Path : HttpRuntime.AppDomainAppVirtualPath;
+               }
+
+               internal static void RemoveConfigurationFromCache (HttpContext ctx)
+               {
+                       configurations.Remove (GetCurrentPath (ctx));
+               }
+

                readonly static MethodInfo get_runtime_object = typeof (ConfigurationSection).GetMethod ("GetRuntimeObject", BindingFlags.NonPublic | BindingFlags.Instance);
 
                public static object GetWebApplicationSection (string sectionName)
                readonly static MethodInfo get_runtime_object = typeof (ConfigurationSection).GetMethod ("GetRuntimeObject", BindingFlags.NonPublic | BindingFlags.Instance);
 
                public static object GetWebApplicationSection (string sectionName)

diff --git a/mcs/class/System.Web/System.Web/ChangeLog b/mcs/class/System.Web/System.Web/ChangeLog
index 8925b40b189b0711ac24a69d643d1bc0c210a98c..436066d4fceca80d0f00690d4670211bfee16314 100644 (file)
--- a/mcs/class/System.Web/System.Web/ChangeLog
+++ b/mcs/class/System.Web/System.Web/ChangeLog
@@ -1,3 +1,9 @@
+2007-05-14 Igor Zelmanovich <igorz@mainsoft.com>
+
+       * HttpApplication.cs:
+       prevent DOS attack: remove configuration from the cache in case 
+       of invalid resource not exists  
+

 2007-05-14  Vladimir Krasnov  <vladimirk@mainsoft.com>
 
        * TraceContext.cs: refactoring, cached TraceManager
 2007-05-14  Vladimir Krasnov  <vladimirk@mainsoft.com>
 
        * TraceContext.cs: refactoring, cached TraceManager

diff --git a/mcs/class/System.Web/System.Web/HttpApplication.cs b/mcs/class/System.Web/System.Web/HttpApplication.cs
index 2e50ba9dbe34925b5e44c29bec616e6de4ed67a6..7e34fc4e465478d4bead7c1fce58208cf4f09e4d 100644 (file)
--- a/mcs/class/System.Web/System.Web/HttpApplication.cs
+++ b/mcs/class/System.Web/System.Web/HttpApplication.cs
@@ -145,6 +145,7 @@ namespace System.Web {
 #else
                static Exception initialization_exception;
 #endif
 #else
                static Exception initialization_exception;
 #endif

+               bool removeConfigurationFromCache;

 #endif
 
                //
 #endif
 
                //


@@ -635,6 +636,14 @@ namespace System.Web {
                                }
                        }
                        stop_processing = true;
                                }
                        }
                        stop_processing = true;

+#if NET_2_0
+                       // we want to remove configuration from the cache in case of 
+                       // invalid resource not exists to prevent DOS attack.
+                       HttpException httpEx = e as HttpException;
+                       if (httpEx != null && httpEx.GetHttpCode () == 404) {
+                               removeConfigurationFromCache = true;
+                       }
+#endif

                }
                
                //
                }
                
                //


@@ -1090,6 +1099,12 @@ namespace System.Web {
 
                void PostDone ()
                {
 
                void PostDone ()
                {

+#if NET_2_0
+                       if (removeConfigurationFromCache) {
+                               WebConfigurationManager.RemoveConfigurationFromCache (context);
+                               removeConfigurationFromCache = false;
+                       }
+#endif

                        Thread th = Thread.CurrentThread;
 #if !TARGET_JVM
                        if (Thread.CurrentPrincipal != prev_user)
                        Thread th = Thread.CurrentThread;
 #if !TARGET_JVM
                        if (Thread.CurrentPrincipal != prev_user)