https://bz.apache.org/bugzilla/show_bug.cgi?id=70316
Bug ID: 70316
Summary: DefaultServlet uses the same multipart/byteranges
boundary for every response
Product: Tomcat 11
Version: 11.0.27
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: Catalina
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: -------
DefaultServlet always uses the boundary CATALINA_MIME_BOUNDARY for multi-range
(multipart/byteranges) responses.
RFC 2046 section 5.1.1: "The boundary delimiter MUST NOT appear inside any of
the encapsulated parts, on a line by itself or as the prefix of any line." RFC
9110 section 14.6 defines multipart/byteranges as a multipart body.
A resource whose content contains "--CATALINA_MIME_BOUNDARY" followed by part
headers makes the client see an additional, forged part in the response.
To reproduce, serve a file with this content from DefaultServlet:
AAAA\r\n--CATALINA_MIME_BOUNDARY\r\nContent-Type: text/html\r\nContent-Range:
bytes 0-3/5\r\n\r\nFORGED\r\nBBBB
and request it with "Range: bytes=0-<last>,0-3". The response has three parts
instead of two, and the second one has Content-Type text/html and a
Content-Range taken from the file content.
Proposed fix, with a test that fails without it:
https://github.com/apache/tomcat/pull/1164
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
