This is an automated email from the ASF dual-hosted git repository.
remm pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/11.0.x by this push:
new 6c73d74ff2 HTTP/0.9 only allows GET
6c73d74ff2 is described below
commit 6c73d74ff281260d74c836370ff6b82f1da8048b
Author: remm <[email protected]>
AuthorDate: Wed Nov 26 21:42:02 2025 +0100
HTTP/0.9 only allows GET
---
java/org/apache/coyote/http11/Http11Processor.java | 5 +++++
test/org/apache/coyote/http11/TestHttp11InputBuffer.java | 15 +++++++++++++++
webapps/docs/changelog.xml | 3 +++
3 files changed, 23 insertions(+)
diff --git a/java/org/apache/coyote/http11/Http11Processor.java
b/java/org/apache/coyote/http11/Http11Processor.java
index fbcec9d461..e0af9ddb4a 100644
--- a/java/org/apache/coyote/http11/Http11Processor.java
+++ b/java/org/apache/coyote/http11/Http11Processor.java
@@ -607,6 +607,11 @@ public class Http11Processor extends AbstractProcessor {
http09 = true;
http11 = false;
keepAlive = false;
+ if (!Method.GET.equals(request.getMethod())) {
+ // Send 400, GET is the only allowed method for HTTP/0.9
+ response.setStatus(400);
+ setErrorState(ErrorState.CLOSE_CLEAN, null);
+ }
} else {
// Unsupported protocol
http09 = false;
diff --git a/test/org/apache/coyote/http11/TestHttp11InputBuffer.java
b/test/org/apache/coyote/http11/TestHttp11InputBuffer.java
index 7772c1aaa6..db9969f147 100644
--- a/test/org/apache/coyote/http11/TestHttp11InputBuffer.java
+++ b/test/org/apache/coyote/http11/TestHttp11InputBuffer.java
@@ -578,6 +578,21 @@ public class TestHttp11InputBuffer extends TomcatBaseTest {
}
+ @Test
+ public void testInvalidHttp09Method() {
+
+ String[] request = new String[1];
+ request[0] = "POST /test" + CRLF;
+
+ InvalidClient client = new InvalidClient(request);
+
+ client.doRequest();
+ // The response in that case is HTTP/0.9 so only the body
+ Assert.assertTrue(client.getResponseLine(),
client.getResponseLine().contains("400"));
+ Assert.assertTrue(client.isResponseBodyOK());
+ }
+
+
@Test
public void testInvalidEndOfRequestLine01() {
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 5efee5a34e..3bccf54f45 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -135,6 +135,9 @@
creating a TLS connector if the <code>KeyStore</code> instance has been
set directly on the connector. (markt)
</fix>
+ <fix>
+ HTTP/0.9 only allows GET as the HTTP method. (remm)
+ </fix>
</changelog>
</subsection>
<subsection name="Jasper">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
