[tomcat] branch 8.5.x updated: Escape timestamp output in AccessLog.

[rjung]

This is an automated email from the ASF dual-hosted git repository.

rjung pushed a commit to branch 8.5.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/8.5.x by this push:
     new 28253ccaf4 Escape timestamp output in AccessLog.
28253ccaf4 is described below

commit 28253ccaf4b607db168e64c4bf7c9f1179a98806
Author: Rainer Jung <rainer.j...@kippdata.de>
AuthorDate: Thu Apr 27 09:32:44 2023 +0200

    Escape timestamp output in AccessLog.
    
    It is needed if a SimpleDateFormat is used which contains
    verbatim characters that need escaping.
---
 .../apache/catalina/valves/AbstractAccessLogValve.java | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/java/org/apache/catalina/valves/AbstractAccessLogValve.java 
b/java/org/apache/catalina/valves/AbstractAccessLogValve.java
index 7d923cdb7a..cfe5b7000f 100644
--- a/java/org/apache/catalina/valves/AbstractAccessLogValve.java
+++ b/java/org/apache/catalina/valves/AbstractAccessLogValve.java
@@ -1047,6 +1047,8 @@ public abstract class AbstractAccessLogValve extends 
ValveBase implements Access
 
         /* Our format description string, null if CLF */
         private final String format;
+        /* Does the format string contain characters we need to escape */
+        private final boolean needsEscaping;
         /* Whether to use begin of request or end of response as the timestamp 
*/
         private final boolean usesBegin;
         /* The format type */
@@ -1085,6 +1087,16 @@ public abstract class AbstractAccessLogValve extends 
ValveBase implements Access
 
         protected DateAndTimeElement(String sdf) {
             String format = sdf;
+            boolean needsEscaping = false;
+            if (sdf != null) {
+                CharArrayWriter writer = new CharArrayWriter();
+                escapeAndAppend(sdf, writer);
+                String escaped = writer.toString();
+                if (!escaped.equals(sdf)) {
+                    needsEscaping = true;
+                }
+            }
+            this.needsEscaping = needsEscaping;
             boolean usesBegin = false;
             FormatType type = FormatType.CLF;
 
@@ -1169,7 +1181,11 @@ public abstract class AbstractAccessLogValve extends 
ValveBase implements Access
                     temp = temp.replace(tripleMsecPattern, tripleMsec);
                     temp = temp.replace(msecPattern, Long.toString(frac));
                 }
-                buf.append(temp);
+                if (needsEscaping) {
+                    escapeAndAppend(temp, buf);
+                } else {
+                    buf.append(temp);
+                }
             }
         }
     }


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org