This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 11.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 527314bd98c0fb11c8b98a85e29697e80275e271 Author: opencode <[email protected]> AuthorDate: Tue Sep 29 19:16:34 2026 +0200 Prevent oversized 'idle' values from expiring all sessions via integer overflow in the sessions/expire command --- java/org/apache/catalina/ant/SessionsTask.java | 7 ++++++- java/org/apache/catalina/manager/ManagerServlet.java | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/java/org/apache/catalina/ant/SessionsTask.java b/java/org/apache/catalina/ant/SessionsTask.java index a6bf92c602..94184c0eb4 100644 --- a/java/org/apache/catalina/ant/SessionsTask.java +++ b/java/org/apache/catalina/ant/SessionsTask.java @@ -65,7 +65,12 @@ public class SessionsTask extends AbstractCatalinaCommandTask { if (path != null && idle != null) { buffer.append("&idle="); try { - buffer.append(Integer.valueOf(idle)); + int idleMinutes = Integer.parseInt(idle); + if (idleMinutes < 0 || idleMinutes > Integer.MAX_VALUE / 60) { + throw new BuildException("Invalid 'idle' attribute (must be a non-negative integer no greater " + + "than " + (Integer.MAX_VALUE / 60) + "): [" + idle + "]"); + } + buffer.append(idleMinutes); } catch (NumberFormatException nfe) { throw new BuildException("Invalid 'idle' attribute (must be an integer): [" + idle + "]", nfe); } diff --git a/java/org/apache/catalina/manager/ManagerServlet.java b/java/org/apache/catalina/manager/ManagerServlet.java index 953b5f6a6c..0c55535fa4 100644 --- a/java/org/apache/catalina/manager/ManagerServlet.java +++ b/java/org/apache/catalina/manager/ManagerServlet.java @@ -1288,7 +1288,7 @@ public class ManagerServlet extends HttpServlet implements ContainerServlet { int expired = 0; for (Session session : sessions) { int time = (int) (session.getIdleTimeInternal() / 1000L); - if (idle >= 0 && time >= idle * 60) { + if (idle >= 0 && time >= (long) idle * 60) { session.expire(); expired++; } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
