This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/10.1.x by this push:
new 446efef55c Limit number of messages in per client buffer
446efef55c is described below
commit 446efef55c69b0cabde1f7e582382cb26e651022
Author: Mark Thomas <[email protected]>
AuthorDate: Fri Jul 24 15:48:14 2026 +0100
Limit number of messages in per client buffer
---
webapps/docs/changelog.xml | 5 +++++
.../WEB-INF/classes/websocket/chat/ChatAnnotation.java | 18 ++++++++++++++++++
2 files changed, 23 insertions(+)
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index ec5489cc09..ba9eaa25dd 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -237,6 +237,11 @@
and add a note that the exact configuration required will depend on the
overall httpd configuration. (markt)
</fix>
+ <fix>
+ Examples: Limit the buffering of messages in the WebSocket chat example
+ to prevent a malicious client triggering excessive memory usage that
+ could lead to a DoS. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Other">
diff --git
a/webapps/examples/WEB-INF/classes/websocket/chat/ChatAnnotation.java
b/webapps/examples/WEB-INF/classes/websocket/chat/ChatAnnotation.java
index 4f98c434a0..a6c16a6707 100644
--- a/webapps/examples/WEB-INF/classes/websocket/chat/ChatAnnotation.java
+++ b/webapps/examples/WEB-INF/classes/websocket/chat/ChatAnnotation.java
@@ -43,6 +43,7 @@ public class ChatAnnotation {
private static final String GUEST_PREFIX = "Guest";
private static final AtomicInteger connectionIds = new AtomicInteger(0);
private static final Set<ChatAnnotation> connections = new
CopyOnWriteArraySet<>();
+ private static final int BACKLOG_LIMIT = 10;
private final String nickname;
private Session session;
@@ -52,6 +53,7 @@ public class ChatAnnotation {
*/
private Queue<String> messageBacklog = new ArrayDeque<>();
private boolean messageInProgress = false;
+ private long skippedMessageCount = 0;
public ChatAnnotation() {
nickname = GUEST_PREFIX + connectionIds.getAndIncrement();
@@ -97,9 +99,25 @@ public class ChatAnnotation {
synchronized (this) {
if (messageInProgress) {
+ if (skippedMessageCount > 0) {
+ skippedMessageCount++;
+ return;
+ } else if (messageBacklog.size() >= BACKLOG_LIMIT) {
+ // Clear the backlog
+ skippedMessageCount = messageBacklog.size();
+ messageBacklog.clear();
+ // And skip the current message
+ skippedMessageCount++;
+ return;
+ }
messageBacklog.add(msg);
return;
} else {
+ if (skippedMessageCount > 0) {
+ messageBacklog.add(msg);
+ msg = "Skipped [" + skippedMessageCount + "] messages due
to slow client";
+ skippedMessageCount = 0;
+ }
messageInProgress = true;
}
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
