fix(security): T2.7 hardening: enable Tomcat 9 SecurityListener + add allowedRequestAttributesPattern (issue #131)

deliverytiersuite/delivery-tier-suite/delivery-tier-distribution/src/main/conf/perc/perc-catalina.properties

@@ -47,6 +47,12 @@ http.useBodyEncodingForURI=false
 http.useIPVHosts=false
 http.useKeepAliveResponseHeader=true
 http.xpoweredBy=false
+# T2.7 hardening (issue #131): restrict the set of request attributes that may be forwarded
+# from one webapp to another in a cross-context dispatch. Without this, a webapp can set
+# arbitrary ServletRequest attributes that survive into another webapp's scope, breaking
+# Tomcat's attribute isolation. Pattern is anchored; covers the standard JavaEE attribute
+# namespaces plus com.percussion (the only project namespace observed in the codebase).
+http.allowedRequestAttributesPattern=^(java\.lang\.|javax\.servlet\.|javax\.faces\.|javax\.el\.|jakarta\.servlet\.|org\.apache\.catalina\.|org\.apache\.tomcat\.|com\.percussion\.).*$
 
 # HTTPS fields
 https.SSLEnabled=true
@@ -106,4 +112,8 @@ https.useBodyEncodingForURI=false
 https.useIPVHosts=false
 https.useKeepAliveResponseHeader=true
 https.xpoweredBy=false
+# T2.7 hardening (issue #131): mirror of the http.allowedRequestAttributesPattern setting
+# for the HTTPS connector. Same pattern; the cross-context attribute attack surface is
+# identical for both transports.
+https.allowedRequestAttributesPattern=^(java\.lang\.|javax\.servlet\.|javax\.faces\.|javax\.el\.|jakarta\.servlet\.|org\.apache\.catalina\.|org\.apache\.tomcat\.|com\.percussion\.).*$
 shutdown.port=8005

deliverytiersuite/delivery-tier-suite/delivery-tier-distribution/src/main/tomcat9/conf/server.xml

@@ -5,9 +5,17 @@
  -->
 <Server port="${shutdown.port}" shutdown="SHUTDOWN">
     <Listener className="org.apache.catalina.startup.VersionLoggerListener" />
-    <!-- Security listener. Documentation at /docs/config/listeners.html
+    <!-- T2.7 hardening (issue #131): the SecurityListener was previously commented out,
+         leaving the UMASK system property set in catalina.sh (line 300) without a listener
+         to consume it. Enabling it now:
+           * reads the -Dorg.apache.catalina.security.SecurityListener.UMASK property and
+             applies the resulting umask to every webapp before it starts (so a webapp that
+             creates a file as 0644 cannot accidentally be world-readable on a permissive box);
+           * writes a deny-all entry to catalina.policy if SecurityManager is enabled, so
+             the deprecated security manager code path is not silently absent;
+           * is the recommended hardening per the Apache Tomcat 9 security guide.
+         Documentation at /docs/config/listeners.html. -->
     <Listener className="org.apache.catalina.security.SecurityListener" />
-    -->
     <!-- Prevent memory leaks due to use of particular java/javax APIs-->
     <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
     <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
@@ -99,6 +107,7 @@
                     useIPVHosts="${http.useIPVHosts}"
                     useKeepAliveResponseHeader="${http.useKeepAliveResponseHeader}"
                     xpoweredBy="${http.xpoweredBy}"
+                    allowedRequestAttributesPattern="${http.allowedRequestAttributesPattern}"
         />
         <Connector  SSLEnabled="${https.SSLEnabled}"
                     URIEncoding="${https.URIEncoding}"
@@ -153,6 +162,7 @@
                     useIPVHosts="${https.useIPVHosts}"
                     useKeepAliveResponseHeader="${https.useKeepAliveResponseHeader}"
                     xpoweredBy="${https.xpoweredBy}"
+                    allowedRequestAttributesPattern="${https.allowedRequestAttributesPattern}"
                     sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation"
         >
         </Connector>

system/release/tomcat/conf/server.xml

@@ -101,8 +101,16 @@
     -->
 
     <!-- Define an AJP 1.3 Connector on port 8009 -->
-	<!-- Rx does not use this connector comment it -->
-    <!--Connector port="8009" 
+	<!-- Rx does not use this connector comment it. T2.7 hardening (issue #131): if this
+	     is ever uncommented, it MUST include a 'secret' attribute and secretRequired="true"
+	     to defend against CVE-2020-1938 (Ghostcat), per the Apache Tomcat 9 AJP guide.
+	     Example safe form:
+	       <Connector port="8009"
+	                  enableLookups="false" redirectPort="8443" protocol="AJP/1.3"
+	                  secret="$(/bin/awk 'BEGIN{srand();printf "%s",rand()}' | sha256sum | cut -c1-32)"
+	                  secretRequired="true" />
+	     PSUpgradeRemoveTomcatAJP (modules/perc-ant) further strips AJP at install time. -->
+    <!--Connector port="8009"
                enableLookups="false" redirectPort="8443" protocol="AJP/1.3" />
 	-->