This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new f6dda658e4 Limit number of messages in per client buffer
f6dda658e4 is described below
commit f6dda658e4eda2190de96219c182b9a75d27ab06
Author: Mark Thomas <[email protected]>
AuthorDate: Fri Jul 24 15:48:14 2026 +0100
Limit number of messages in per client buffer
---
webapps/docs/changelog.xml | 5 +++++
.../WEB-INF/classes/websocket/chat/ChatAnnotation.java | 18 ++++++++++++++++++
2 files changed, 23 insertions(+)
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 2182a40bfa..68409f179c 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -237,6 +237,11 @@
and add a note that the exact configuration required will depend on the
overall httpd configuration. (markt)
</fix>
+ <fix>
+ Examples: Limit the buffering of messages in the WebSocket chat example
+ to prevent a malicious client triggering excessive memory usage that
+ could lead to a DoS. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Other">
diff --git
a/webapps/examples/WEB-INF/classes/websocket/chat/ChatAnnotation.java
b/webapps/examples/WEB-INF/classes/websocket/chat/ChatAnnotation.java
index 7747df0aa0..cdc9c84a81 100644
--- a/webapps/examples/WEB-INF/classes/websocket/chat/ChatAnnotation.java
+++ b/webapps/examples/WEB-INF/classes/websocket/chat/ChatAnnotation.java
@@ -43,6 +43,7 @@ public class ChatAnnotation {
private static final String GUEST_PREFIX = "Guest";
private static final AtomicInteger connectionIds = new AtomicInteger(0);
private static final Set<ChatAnnotation> connections = new
CopyOnWriteArraySet<>();
+ private static final int BACKLOG_LIMIT = 10;
private final String nickname;
private Session session;
@@ -52,6 +53,7 @@ public class ChatAnnotation {
*/
private Queue<String> messageBacklog = new ArrayDeque<>();
private boolean messageInProgress = false;
+ private long skippedMessageCount = 0;
public ChatAnnotation() {
nickname = GUEST_PREFIX + connectionIds.getAndIncrement();
@@ -97,9 +99,25 @@ public class ChatAnnotation {
synchronized (this) {
if (messageInProgress) {
+ if (skippedMessageCount > 0) {
+ skippedMessageCount++;
+ return;
+ } else if (messageBacklog.size() >= BACKLOG_LIMIT) {
+ // Clear the backlog
+ skippedMessageCount = messageBacklog.size();
+ messageBacklog.clear();
+ // And skip the current message
+ skippedMessageCount++;
+ return;
+ }
messageBacklog.add(msg);
return;
} else {
+ if (skippedMessageCount > 0) {
+ messageBacklog.add(msg);
+ msg = "Skipped [" + skippedMessageCount + "] messages due
to slow client";
+ skippedMessageCount = 0;
+ }
messageInProgress = true;
}
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
