This is an automated email from the ASF dual-hosted git repository.
rmaucher pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new aaa3906888 Add some clarification to the comments
aaa3906888 is described below
commit aaa390688825d7bf1708376009d202ff51320db5
Author: remm <[email protected]>
AuthorDate: Fri Aug 28 11:32:03 2026 +0200
Add some clarification to the comments
---
java/org/apache/catalina/servlets/WebdavServlet.java | 1 +
java/org/apache/coyote/http2/HpackEncoder.java | 1 +
java/org/apache/tomcat/util/http/RequestUtil.java | 4 ++--
3 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/java/org/apache/catalina/servlets/WebdavServlet.java
b/java/org/apache/catalina/servlets/WebdavServlet.java
index 8b2b95a271..cefb1ea412 100644
--- a/java/org/apache/catalina/servlets/WebdavServlet.java
+++ b/java/org/apache/catalina/servlets/WebdavServlet.java
@@ -1110,6 +1110,7 @@ public class WebdavServlet extends DefaultServlet
implements PeriodicEventListen
DocumentBuilder documentBuilder = getDocumentBuilder();
ArrayList<ProppatchOperation> operations = new ArrayList<>();
+ // There is no size limit for the PROPPATCH body, since write access
is already considered high privilege
byte[] body;
try (InputStream is = req.getInputStream(); ByteArrayOutputStream os =
new ByteArrayOutputStream()) {
IOTools.flow(is, os);
diff --git a/java/org/apache/coyote/http2/HpackEncoder.java
b/java/org/apache/coyote/http2/HpackEncoder.java
index 3af766cb47..af9873b394 100644
--- a/java/org/apache/coyote/http2/HpackEncoder.java
+++ b/java/org/apache/coyote/http2/HpackEncoder.java
@@ -177,6 +177,7 @@ class HpackEncoder {
// We use 11 to make sure we have enough room for the
// variable length integers
+ // 12 is the maximum in theory but it cannot happen in practice
int required = 11 + headerName.length() + 1 + val.length();
if (target.remaining() < required) {
diff --git a/java/org/apache/tomcat/util/http/RequestUtil.java
b/java/org/apache/tomcat/util/http/RequestUtil.java
index e1b8a235a5..dea89dd9b2 100644
--- a/java/org/apache/tomcat/util/http/RequestUtil.java
+++ b/java/org/apache/tomcat/util/http/RequestUtil.java
@@ -171,8 +171,8 @@ public class RequestUtil {
}
- // Both scheme and host are case-insensitive but the CORS spec states
- // this check should be case-sensitive
+ // Both scheme and host are case-insensitive usually
+ // However, CORS same origin check must be case-sensitive (from the
CORS specification)
return origin.contentEquals(target);
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
