This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new 861f0d8763 No password is not the same as a password of ""
861f0d8763 is described below
commit 861f0d876371b7dc3df66ac69201b94adee14090
Author: Mark Thomas <[email protected]>
AuthorDate: Tue Sep 1 16:46:51 2026 +0100
No password is not the same as a password of ""
---
java/org/apache/catalina/users/MemoryUserDatabase.java | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/java/org/apache/catalina/users/MemoryUserDatabase.java
b/java/org/apache/catalina/users/MemoryUserDatabase.java
index e4e9eb7473..961b9fa740 100644
--- a/java/org/apache/catalina/users/MemoryUserDatabase.java
+++ b/java/org/apache/catalina/users/MemoryUserDatabase.java
@@ -558,9 +558,15 @@ public class MemoryUserDatabase implements UserDatabase {
User user = (User) values.next();
writer.print(" <user username=\"");
writer.print(Escape.xml(user.getUsername()));
- writer.print("\" password=\"");
- writer.print(Escape.xml("", user.getPassword()));
writer.print("\"");
+ // Local copy to avoid TOCTOU inconsistency
+ // No password is not the same as a password of ""
+ String pwd = user.getPassword();
+ if (pwd != null) {
+ writer.print(" password=\"");
+ writer.print(Escape.xml(pwd));
+ writer.print("\"");
+ }
if (null != user.getFullName()) {
writer.print(" fullName=\"");
writer.print(Escape.xml(user.getFullName()));
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
