This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 7.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/7.0.x by this push: new 809d6a9 Fix https://bz.apache.org/bugzilla/show_bug.cgi?id=63737 809d6a9 is described below commit 809d6a99e004320af8685a36d32ed32b22ecfb05 Author: Mark Thomas <ma...@apache.org> AuthorDate: Tue Sep 10 20:33:14 2019 +0100 Fix https://bz.apache.org/bugzilla/show_bug.cgi?id=63737 Correct various issues with parsing the accept-encoding header when looking to see if gzip is supported. - only the first header was examined - xxgzip was treated as indicating support for gzip --- .../coyote/http11/AbstractHttp11Processor.java | 31 +++++++-- .../tomcat/util/http/parser/AcceptEncoding.java | 76 ++++++++++++++++++++++ .../apache/tomcat/util/http/parser/HttpParser.java | 74 +++++++++++++++++++++ webapps/docs/changelog.xml | 5 ++ 4 files changed, 181 insertions(+), 5 deletions(-) diff --git a/java/org/apache/coyote/http11/AbstractHttp11Processor.java b/java/org/apache/coyote/http11/AbstractHttp11Processor.java index bc149d3..c2750df 100644 --- a/java/org/apache/coyote/http11/AbstractHttp11Processor.java +++ b/java/org/apache/coyote/http11/AbstractHttp11Processor.java @@ -18,6 +18,9 @@ package org.apache.coyote.http11; import java.io.IOException; import java.io.InterruptedIOException; +import java.io.StringReader; +import java.util.Enumeration; +import java.util.List; import java.util.Locale; import java.util.Set; import java.util.StringTokenizer; @@ -48,6 +51,7 @@ import org.apache.tomcat.util.buf.MessageBytes; import org.apache.tomcat.util.http.FastHttpDateFormat; import org.apache.tomcat.util.http.MimeHeaders; import org.apache.tomcat.util.http.ResponseUtil; +import org.apache.tomcat.util.http.parser.AcceptEncoding; import org.apache.tomcat.util.http.parser.HttpParser; import org.apache.tomcat.util.log.UserDataHelper; import org.apache.tomcat.util.net.AbstractEndpoint; @@ -636,12 +640,29 @@ public abstract class AbstractHttp11Processor<S> extends AbstractProcessor<S> { */ private boolean useCompression() { - // Check if browser support gzip encoding - MessageBytes acceptEncodingMB = - request.getMimeHeaders().getValue("accept-encoding"); + // Check if user-agent supports gzip encoding + // Only interested in whether gzip encoding is supported. Other + // encodings and weights can be ignored. + Enumeration<String> headerValues = request.getMimeHeaders().values("accept-encoding"); + boolean foundGzip = false; + while (!foundGzip && headerValues.hasMoreElements()) { + List<AcceptEncoding> acceptEncodings = null; + try { + acceptEncodings = AcceptEncoding.parse(new StringReader(headerValues.nextElement())); + } catch (IOException ioe) { + // If there is a problem reading the header, disable compression + return false; + } + + for (AcceptEncoding acceptEncoding : acceptEncodings) { + if ("gzip".equalsIgnoreCase(acceptEncoding.getEncoding())) { + foundGzip = true; + break; + } + } + } - if ((acceptEncodingMB == null) - || (acceptEncodingMB.indexOf("gzip") == -1)) { + if (!foundGzip) { return false; } diff --git a/java/org/apache/tomcat/util/http/parser/AcceptEncoding.java b/java/org/apache/tomcat/util/http/parser/AcceptEncoding.java new file mode 100644 index 0000000..a2a2e2b --- /dev/null +++ b/java/org/apache/tomcat/util/http/parser/AcceptEncoding.java @@ -0,0 +1,76 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.tomcat.util.http.parser; + +import java.io.IOException; +import java.io.StringReader; +import java.util.ArrayList; +import java.util.List; + +import org.apache.tomcat.util.http.parser.HttpParser.SkipResult; + +public class AcceptEncoding { + + private final String encoding; + private final double quality; + + protected AcceptEncoding(String encoding, double quality) { + this.encoding = encoding; + this.quality = quality; + } + + public String getEncoding() { + return encoding; + } + + public double getQuality() { + return quality; + } + + + public static List<AcceptEncoding> parse(StringReader input) throws IOException { + + List<AcceptEncoding> result = new ArrayList<AcceptEncoding>(); + + do { + String encoding = HttpParser.readToken(input); + if (encoding == null) { + // Invalid encoding, skip to the next one + HttpParser.skipUntil(input, 0, ','); + continue; + } + + if (encoding.length() == 0) { + // No more data to read + break; + } + + // See if a quality has been provided + double quality = 1; + SkipResult lookForSemiColon = HttpParser.skipConstant(input, ";"); + if (lookForSemiColon == SkipResult.FOUND) { + quality = HttpParser.readWeight(input, ','); + } + + if (quality > 0) { + result.add(new AcceptEncoding(encoding, quality)); + } + } while (true); + + return result; + } +} diff --git a/java/org/apache/tomcat/util/http/parser/HttpParser.java b/java/org/apache/tomcat/util/http/parser/HttpParser.java index 4cff050..aeaae15 100644 --- a/java/org/apache/tomcat/util/http/parser/HttpParser.java +++ b/java/org/apache/tomcat/util/http/parser/HttpParser.java @@ -743,6 +743,80 @@ public class HttpParser { } } + static double readWeight(Reader input, char delimiter) throws IOException { + skipLws(input); + int c = input.read(); + if (c == -1 || c == delimiter) { + // No q value just whitespace + return 1; + } else if (c != 'q') { + // Malformed. Use quality of zero so it is dropped. + skipUntil(input, c, delimiter); + return 0; + } + // RFC 7231 does not allow whitespace here but be tolerant + skipLws(input); + c = input.read(); + if (c != '=') { + // Malformed. Use quality of zero so it is dropped. + skipUntil(input, c, delimiter); + return 0; + } + + // RFC 7231 does not allow whitespace here but be tolerant + skipLws(input); + c = input.read(); + + // Should be no more than 3 decimal places + StringBuilder value = new StringBuilder(5); + int decimalPlacesRead = -1; + + if (c == '0' || c == '1') { + value.append((char) c); + c = input.read(); + + while (true) { + if (decimalPlacesRead == -1 && c == '.') { + value.append('.'); + decimalPlacesRead = 0; + } else if (decimalPlacesRead > -1 && c >= '0' && c <= '9') { + if (decimalPlacesRead < 3) { + value.append((char) c); + decimalPlacesRead++; + } + } else { + break; + } + c = input.read(); + } + } else { + // Malformed. Use quality of zero so it is dropped and skip until + // EOF or the next delimiter + skipUntil(input, c, delimiter); + return 0; + } + + if (c == 9 || c == 32) { + skipLws(input); + c = input.read(); + } + + // Must be at delimiter or EOF + if (c != delimiter && c != -1) { + // Malformed. Use quality of zero so it is dropped and skip until + // EOF or the next delimiter + skipUntil(input, c, delimiter); + return 0; + } + + double result = Double.parseDouble(value.toString()); + if (result > 1) { + return 0; + } + return result; + } + + static enum SkipResult { FOUND, NOT_FOUND, diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml index 7c1fbf0..58301fa 100644 --- a/webapps/docs/changelog.xml +++ b/webapps/docs/changelog.xml @@ -115,6 +115,11 @@ were used with older, no longer supported versions of Windows that could not support larger pollsets. (markt) </scode> + <fix> + <bug>63737</bug>: Correct various issues when parsing the + <code>accept-encoding</code> header to determine if gzip encoding is + supported including only parsing the first header found. (markt) + </fix> </changelog> </subsection> <subsection name="Web applications"> --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org