This is an automated email from the ASF dual-hosted git repository.
remm pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new 2e2fa23f26 HTTP/0.9 only allows GET
2e2fa23f26 is described below
commit 2e2fa23f2635bbb819759576a2f2f5e64ecf7c5f
Author: remm <[email protected]>
AuthorDate: Wed Nov 26 21:42:02 2025 +0100
HTTP/0.9 only allows GET
---
java/org/apache/coyote/http11/Http11Processor.java | 5 +++++
test/org/apache/coyote/http11/TestHttp11InputBuffer.java | 15 +++++++++++++++
webapps/docs/changelog.xml | 3 +++
3 files changed, 23 insertions(+)
diff --git a/java/org/apache/coyote/http11/Http11Processor.java
b/java/org/apache/coyote/http11/Http11Processor.java
index 9baecfec8f..6b12e057aa 100644
--- a/java/org/apache/coyote/http11/Http11Processor.java
+++ b/java/org/apache/coyote/http11/Http11Processor.java
@@ -608,6 +608,11 @@ public class Http11Processor extends AbstractProcessor {
http09 = true;
http11 = false;
keepAlive = false;
+ if (!Method.GET.equals(request.getMethod())) {
+ // Send 400, GET is the only allowed method for HTTP/0.9
+ response.setStatus(400);
+ setErrorState(ErrorState.CLOSE_CLEAN, null);
+ }
} else {
// Unsupported protocol
http09 = false;
diff --git a/test/org/apache/coyote/http11/TestHttp11InputBuffer.java
b/test/org/apache/coyote/http11/TestHttp11InputBuffer.java
index e3fa2c1fba..ddfd153ff7 100644
--- a/test/org/apache/coyote/http11/TestHttp11InputBuffer.java
+++ b/test/org/apache/coyote/http11/TestHttp11InputBuffer.java
@@ -657,6 +657,21 @@ public class TestHttp11InputBuffer extends TomcatBaseTest {
}
+ @Test
+ public void testInvalidHttp09Method() {
+
+ String[] request = new String[1];
+ request[0] = "POST /test" + CRLF;
+
+ InvalidClient client = new InvalidClient(request);
+
+ client.doRequest();
+ // The response in that case is HTTP/0.9 so only the body
+ Assert.assertTrue(client.getResponseLine(),
client.getResponseLine().contains("400"));
+ Assert.assertTrue(client.isResponseBodyOK());
+ }
+
+
@Test
public void testInvalidEndOfRequestLine01() {
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index bdb488247b..4daa8ef876 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -135,6 +135,9 @@
creating a TLS connector if the <code>KeyStore</code> instance has been
set directly on the connector. (markt)
</fix>
+ <fix>
+ HTTP/0.9 only allows GET as the HTTP method. (remm)
+ </fix>
</changelog>
</subsection>
<subsection name="Jasper">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
