This is an automated email from the ASF dual-hosted git repository.
rmaucher pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new b4a5d38d93 Add some clarification to the comments
b4a5d38d93 is described below
commit b4a5d38d93fd3dc1991bc2905502e5772ba77d19
Author: remm <[email protected]>
AuthorDate: Fri Aug 28 11:32:03 2026 +0200
Add some clarification to the comments
---
java/org/apache/catalina/servlets/WebdavServlet.java | 1 +
java/org/apache/coyote/http2/HpackEncoder.java | 1 +
java/org/apache/tomcat/util/http/RequestUtil.java | 4 ++--
3 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/java/org/apache/catalina/servlets/WebdavServlet.java
b/java/org/apache/catalina/servlets/WebdavServlet.java
index 9874e8cfa5..9f8c42bbf8 100644
--- a/java/org/apache/catalina/servlets/WebdavServlet.java
+++ b/java/org/apache/catalina/servlets/WebdavServlet.java
@@ -1115,6 +1115,7 @@ public class WebdavServlet extends DefaultServlet
implements PeriodicEventListen
DocumentBuilder documentBuilder = getDocumentBuilder();
ArrayList<ProppatchOperation> operations = new ArrayList<>();
+ // There is no size limit for the PROPPATCH body, since write access
is already considered high privilege
byte[] body;
try (InputStream is = req.getInputStream(); ByteArrayOutputStream os =
new ByteArrayOutputStream()) {
IOTools.flow(is, os);
diff --git a/java/org/apache/coyote/http2/HpackEncoder.java
b/java/org/apache/coyote/http2/HpackEncoder.java
index bd7a55e506..af7d0e606c 100644
--- a/java/org/apache/coyote/http2/HpackEncoder.java
+++ b/java/org/apache/coyote/http2/HpackEncoder.java
@@ -180,6 +180,7 @@ class HpackEncoder {
// We use 11 to make sure we have enough room for the
// variable length integers
+ // 12 is the maximum in theory but it cannot happen in practice
int required = 11 + headerName.length() + 1 + val.length();
if (target.remaining() < required) {
diff --git a/java/org/apache/tomcat/util/http/RequestUtil.java
b/java/org/apache/tomcat/util/http/RequestUtil.java
index 2a8d6dc860..aca6007631 100644
--- a/java/org/apache/tomcat/util/http/RequestUtil.java
+++ b/java/org/apache/tomcat/util/http/RequestUtil.java
@@ -171,8 +171,8 @@ public class RequestUtil {
}
- // Both scheme and host are case-insensitive but the CORS spec states
- // this check should be case-sensitive
+ // Both scheme and host are case-insensitive usually
+ // However, CORS same origin check must be case-sensitive (from the
CORS specification)
return origin.contentEquals(target);
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
