On 09/10/2025 11:09, [email protected] wrote:
This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new 933966af24 Reject requests that map to invalid Windows file names
earlier.
933966af24 is described below
commit 933966af245382e2c12e331931cd97abbd4065fe
Author: Mark Thomas <[email protected]>
AuthorDate: Thu Oct 9 11:08:49 2025 +0100
Reject requests that map to invalid Windows file names earlier.
This is triggering test failures. It looks like paths are being passed
to this method as well as file names. That will require some adjustments.
I'm looking at this now.
Mark
---
.../webresources/AbstractFileResourceSet.java | 36 +++++++++++++---------
webapps/docs/changelog.xml | 3 ++
2 files changed, 25 insertions(+), 14 deletions(-)
diff --git a/java/org/apache/catalina/webresources/AbstractFileResourceSet.java
b/java/org/apache/catalina/webresources/AbstractFileResourceSet.java
index df1953ec67..63942002ce 100644
--- a/java/org/apache/catalina/webresources/AbstractFileResourceSet.java
+++ b/java/org/apache/catalina/webresources/AbstractFileResourceSet.java
@@ -97,7 +97,7 @@ public abstract class AbstractFileResourceSet extends
AbstractResourceSet {
}
// Additional Windows specific checks to handle known problems with
- // File.getCanonicalPath()
+ // File.getCanonicalPath() and other issues
if (JrePlatform.IS_WINDOWS && isInvalidWindowsFilename(name)) {
return null;
}
@@ -172,29 +172,37 @@ public abstract class AbstractFileResourceSet extends
AbstractResourceSet {
}
}
+
private boolean isInvalidWindowsFilename(String name) {
final int len = name.length();
if (len == 0) {
return false;
}
- // This consistently ~10 times faster than the equivalent regular
- // expression irrespective of input length.
+ // This is consistently ~10 times faster than the equivalent regular
expression irrespective of input length.
for (int i = 0; i < len; i++) {
char c = name.charAt(i);
- if (c == '\"' || c == '<' || c == '>' || c == ':') {
- // These characters are disallowed in Windows file names and
- // there are known problems for file names with these
characters
- // when using File#getCanonicalPath().
- // Note: There are additional characters that are disallowed in
- // Windows file names but these are not known to cause
- // problems when using File#getCanonicalPath().
+ /*
+ * '\"', ':', '<' and '>' are disallowed in Windows file names and
there are known problems with these
+ * characters when using File#getCanonicalPath().
+ *
+ * Control characters (0x00-0x31) are not permitted and tend to be
display strangely in log messages and
+ * similar.
+ *
+ * '*', '/', '?', '\\' and '|' are also not allowed and, while
they are not currently known to cause other
+ * difficulties, they are checked here rather than wasting cycles
trying to find an invalid file later.
+ *
+ * Note: Characters listed in ASCII order.
+ */
+ if (c < 32 || c == '\"' || c == '*' || c == '/' || c == ':' || c ==
'<' || c == '>' || c == '?' || c == '\\'
+ || c == '|') {
return true;
}
}
- // Windows does not allow file names to end in ' ' unless specific low
- // level APIs are used to create the files that bypass various checks.
- // File names that end in ' ' are known to cause problems when using
- // File#getCanonicalPath().
+ /*
+ * Windows does not allow file names to end in ' ' unless specific
low-level APIs are used to create the files
+ * that bypass various checks. File names that end in ' ' are known to
cause problems when using
+ * File#getCanonicalPath().
+ */
return name.charAt(len - 1) == ' ';
}
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index dc8c878442..ff3413062f 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -199,6 +199,9 @@
<bug>69837</bug>: Fix corruption of the class path generated by the
Loader when running on Windows. (markt)
</fix>
+ <fix>
+ Reject requests that map to invalid Windows file names earlier. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
