This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new dec85eaf7f Harden CGI servlet against scripts with excessive output on
error status
dec85eaf7f is described below
commit dec85eaf7f1fc720f87380c13093104e20029f2b
Author: Mark Thomas <[email protected]>
AuthorDate: Fri Sep 4 16:11:26 2026 +0100
Harden CGI servlet against scripts with excessive output on error status
---
java/org/apache/catalina/servlets/CGIServlet.java | 10 ++++++----
webapps/docs/changelog.xml | 4 ++++
2 files changed, 10 insertions(+), 4 deletions(-)
diff --git a/java/org/apache/catalina/servlets/CGIServlet.java
b/java/org/apache/catalina/servlets/CGIServlet.java
index cf7bb776a2..76127c5e1d 100644
--- a/java/org/apache/catalina/servlets/CGIServlet.java
+++ b/java/org/apache/catalina/servlets/CGIServlet.java
@@ -1479,11 +1479,13 @@ public final class CGIServlet extends HttpServlet {
cgiOutput = proc.getInputStream();
try {
- while (!skipBody && (bufRead =
cgiOutput.read(bBuf)) != -1) {
- if (log.isTraceEnabled()) {
- log.trace("output " + bufRead + " bytes of
data");
+ while ((bufRead = cgiOutput.read(bBuf)) != -1) {
+ if (!skipBody) {
+ if (log.isTraceEnabled()) {
+ log.trace("output " + bufRead + "
bytes of data");
+ }
+ out.write(bBuf, 0, bufRead);
}
- out.write(bBuf, 0, bufRead);
}
} finally {
// Attempt to consume any leftover byte if
something bad happens,
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 0771cc01bf..d54476c095 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -320,6 +320,10 @@
<bug>70203</bug>: Fix <code>RegistrationListener</code> notifications
in
Jakarta Authentication implementation. (markt)
</fix>
+ <fix>
+ Handle CGI scripts that write excessively to stdout after setting an
+ HTTP error status code. (schultz)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
