This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 4dfae023d62f5223c1e7845e253b0e755788db36 Author: opencode <[email protected]> AuthorDate: Tue Sep 29 19:16:34 2026 +0200 Prevent oversized 'idle' values from expiring all sessions via integer overflow in the sessions/expire command --- java/org/apache/catalina/ant/SessionsTask.java | 7 ++++++- java/org/apache/catalina/manager/ManagerServlet.java | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/java/org/apache/catalina/ant/SessionsTask.java b/java/org/apache/catalina/ant/SessionsTask.java index a6bf92c602..94184c0eb4 100644 --- a/java/org/apache/catalina/ant/SessionsTask.java +++ b/java/org/apache/catalina/ant/SessionsTask.java @@ -65,7 +65,12 @@ public class SessionsTask extends AbstractCatalinaCommandTask { if (path != null && idle != null) { buffer.append("&idle="); try { - buffer.append(Integer.valueOf(idle)); + int idleMinutes = Integer.parseInt(idle); + if (idleMinutes < 0 || idleMinutes > Integer.MAX_VALUE / 60) { + throw new BuildException("Invalid 'idle' attribute (must be a non-negative integer no greater " + + "than " + (Integer.MAX_VALUE / 60) + "): [" + idle + "]"); + } + buffer.append(idleMinutes); } catch (NumberFormatException nfe) { throw new BuildException("Invalid 'idle' attribute (must be an integer): [" + idle + "]", nfe); } diff --git a/java/org/apache/catalina/manager/ManagerServlet.java b/java/org/apache/catalina/manager/ManagerServlet.java index d77a46ebe7..6c54a4b21e 100644 --- a/java/org/apache/catalina/manager/ManagerServlet.java +++ b/java/org/apache/catalina/manager/ManagerServlet.java @@ -1307,7 +1307,7 @@ public class ManagerServlet extends HttpServlet implements ContainerServlet { int expired = 0; for (Session session : sessions) { int time = (int) (session.getIdleTimeInternal() / 1000L); - if (idle >= 0 && time >= idle * 60) { + if (idle >= 0 && time >= (long) idle * 60) { session.expire(); expired++; } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
