On Tue, Sep 1, 2026 at 5:47 PM <[email protected]> wrote:
>
> This is an automated email from the ASF dual-hosted git repository.
>
> markt-asf pushed a commit to branch main
> in repository https://gitbox.apache.org/repos/asf/tomcat.git
>
>
> The following commit(s) were added to refs/heads/main by this push:
> new 6874871a0f No password is not the same as a password of ""
> 6874871a0f is described below
>
> commit 6874871a0f232b5f9a776fef8e97faf70a886719
> Author: Mark Thomas <[email protected]>
> AuthorDate: Tue Sep 1 16:46:51 2026 +0100
>
> No password is not the same as a password of ""
+1
Rémy
> ---
> java/org/apache/catalina/users/MemoryUserDatabase.java | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/java/org/apache/catalina/users/MemoryUserDatabase.java
> b/java/org/apache/catalina/users/MemoryUserDatabase.java
> index 725329510e..22294dc729 100644
> --- a/java/org/apache/catalina/users/MemoryUserDatabase.java
> +++ b/java/org/apache/catalina/users/MemoryUserDatabase.java
> @@ -545,9 +545,15 @@ public class MemoryUserDatabase implements UserDatabase {
> User user = (User) values.next();
> writer.print(" <user username=\"");
> writer.print(Escape.xml(user.getUsername()));
> - writer.print("\" password=\"");
> - writer.print(Escape.xml("", user.getPassword()));
> writer.print("\"");
> + // Local copy to avoid TOCTOU inconsistency
> + // No password is not the same as a password of ""
> + String pwd = user.getPassword();
> + if (pwd != null) {
> + writer.print(" password=\"");
> + writer.print(Escape.xml(pwd));
> + writer.print("\"");
> + }
> if (null != user.getFullName()) {
> writer.print(" fullName=\"");
> writer.print(Escape.xml(user.getFullName()));
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
