CVE-2017-12616 Tomcat信息泄漏和远程代码执行漏洞¶

D:.
├─img
│      1.jpg
│
├─src
│      HelloWorld.java
│
├─target
└─web
    │  index.jsp
    │
    └─WEB-INF
            web.xml

<Context path='/site' docBase="D:\testtomcat2\web" reloadable="true">

    <Resources className="org.apache.naming.resources.VirtualDirContext" extraResourcePaths="/WEB-INF/classes=F:/testtomcat2/target/classes,/images=D:/testtomcat2/img,/tmp=D:/testtomcat2/web" />

    <Loader className="org.apache.catalina.loader.VirtualWebappLoader" virtualClasspath="/WEB-INF/classes=F:/testtomcat2/target/classes" />

    <JarScanner scanAllDirectories="true" />
</Context>

@Override
protected void doGet(HttpServletRequest request,HttpServletResponse response) throws IOException, ServletException {
    // Serve the requested resource, including the data content
    serveResource(request, response, true);
}

protected void serveResource(HttpServletRequest request,HttpServletResponse response,boolean content) throws IOException, ServletException {
    boolean serveContent = content;
    // Identify the requested resource path
    String path = getRelativePath(request, true);
    CacheEntry cacheEntry = resources.lookupCache(path);
    // If the resource is not a collection, and the resource path
    // ends with "/" or "\", return NOT FOUND
    if (cacheEntry.context == null) {
        if (path.endsWith("/") || (path.endsWith("\\"))) {
            // Check if we're included so we can return the appropriate
            // missing resource name in the error
            String requestUri = (String) request.getAttribute(
                    RequestDispatcher.INCLUDE_REQUEST_URI);
            if (requestUri == null) {
                requestUri = request.getRequestURI();
            }
            response.sendError(HttpServletResponse.SC_NOT_FOUND,
                                requestUri);
            return;
        }
    }
}