https://bz.apache.org/bugzilla/show_bug.cgi?id=69998
Bug ID: 69998
Summary: Changelog incorrectly states that HTTP request header
names are stored in original case for Tomcat 9.x and
10.1.x
Product: Tomcat 10
Version: 10.1.47
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P2
Component: Catalina
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ------
The changelogs for Tomcat 9.x and 10.1.x include the following entry:
"Store HTTP request headers using the original case for the header name
rather than forcing it to lower case."
However, this change has NOT actually been implemented in these branches. The
implementation diverges from Tomcat 11 in the following way:
In Tomcat 11, Http11InputBuffer was refactored to implement
HttpHeaderParser.HeaderDataSource and delegates header parsing to the shared
HttpHeaderParser class, which preserves the original case of header names.
In contrast, Tomcat 9.x and 10.1.x still use their own internal parseHeader()
method in Http11InputBuffer. This method contains an explicit lowercase
conversion:
// Convert to lowercase
if (chr >= Constants.A && chr <= Constants.Z) {
byteBuffer.put(pos, (byte) (chr - Constants.LC_OFFSET));
}
This can be confirmed in the Tomcat 9.0.x code coverage report:
https://nightlies.apache.org/tomcat/tomcat-9.0.x/coverage/org.apache.coyote.http11/Http11InputBuffer.java.html
As a result, HTTP request header names in Tomcat 9.x and 10.1.x continue to be
converted to lowercase, contrary to what the changelog states.
---
Steps to Reproduce:
1. Send an HTTP request to Tomcat 9.x or 10.1.x with a mixed-case header name
(e.g., "X-Custom-Header").
2. Inspect the header name as received by the servlet (e.g., via
request.getHeaderNames()).
3. Observe that the header name is returned in lowercase (e.g.,
"x-custom-header"), not in the original case.
Expected Result:
Header names should be preserved in their original case, as described in the
changelog.
Actual Result:
Header names are converted to lowercase due to the LC_OFFSET conversion
remaining in Http11InputBuffer.parseHeader() in the 9.x and 10.1.x branches.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
