This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 8.5.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/8.5.x by this push: new 64c2524 Once a URI is identified as invalid don't attempt to process it further. 64c2524 is described below commit 64c25246996fd974953156113d990c2b4b92421e Author: Mark Thomas <ma...@apache.org> AuthorDate: Tue Jul 2 17:27:20 2019 +0100 Once a URI is identified as invalid don't attempt to process it further. Based on a PR by Alex Repert. --- java/org/apache/catalina/connector/CoyoteAdapter.java | 15 ++++++++------- webapps/docs/changelog.xml | 4 ++++ 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/java/org/apache/catalina/connector/CoyoteAdapter.java b/java/org/apache/catalina/connector/CoyoteAdapter.java index e94a3d7..ef7bfb9 100644 --- a/java/org/apache/catalina/connector/CoyoteAdapter.java +++ b/java/org/apache/catalina/connector/CoyoteAdapter.java @@ -637,13 +637,14 @@ public class CoyoteAdapter implements Adapter { response.sendError(400, "Invalid URI: " + ioe.getMessage()); } // Normalization - if (!normalize(req.decodedURI())) { - response.sendError(400, "Invalid URI"); - } - // Character decoding - convertURI(decodedURI, request); - // Check that the URI is still normalized - if (!checkNormalize(req.decodedURI())) { + if (normalize(req.decodedURI())) { + // Character decoding + convertURI(decodedURI, request); + // Check that the URI is still normalized + if (!checkNormalize(req.decodedURI())) { + response.sendError(400, "Invalid URI"); + } + } else { response.sendError(400, "Invalid URI"); } } else { diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml index c0fcc2a..cc15118 100644 --- a/webapps/docs/changelog.xml +++ b/webapps/docs/changelog.xml @@ -89,6 +89,10 @@ HTTPS connector configured to use NIO or NIO with OpenSSL 1.1.1 or later. (markt) </fix> + <fix> + Once a URI is identified as invalid don't attempt to process it further. + Based on a PR by Alex Repert. (markt) + </fix> </changelog> </subsection> <subsection name="Jasper"> --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org