This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/11.0.x by this push:
new 38bb2aabf3 Harden CGI servlet against scripts with excessive output on
error status
38bb2aabf3 is described below
commit 38bb2aabf3b6bdca1d31cbd321445c8cb25d997f
Author: Mark Thomas <[email protected]>
AuthorDate: Fri Sep 4 16:11:26 2026 +0100
Harden CGI servlet against scripts with excessive output on error status
---
java/org/apache/catalina/servlets/CGIServlet.java | 10 ++++++----
webapps/docs/changelog.xml | 4 ++++
2 files changed, 10 insertions(+), 4 deletions(-)
diff --git a/java/org/apache/catalina/servlets/CGIServlet.java
b/java/org/apache/catalina/servlets/CGIServlet.java
index 4224d2282f..8211c0a041 100644
--- a/java/org/apache/catalina/servlets/CGIServlet.java
+++ b/java/org/apache/catalina/servlets/CGIServlet.java
@@ -1482,11 +1482,13 @@ public final class CGIServlet extends HttpServlet {
cgiOutput = proc.getInputStream();
try {
- while (!skipBody && (bufRead =
cgiOutput.read(bBuf)) != -1) {
- if (log.isTraceEnabled()) {
- log.trace("output " + bufRead + " bytes of
data");
+ while ((bufRead = cgiOutput.read(bBuf)) != -1) {
+ if (!skipBody) {
+ if (log.isTraceEnabled()) {
+ log.trace("output " + bufRead + "
bytes of data");
+ }
+ out.write(bBuf, 0, bufRead);
}
- out.write(bBuf, 0, bufRead);
}
} finally {
// Attempt to consume any leftover byte if
something bad happens,
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 2d19774bd2..c19180414f 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -193,6 +193,10 @@
<bug>70203</bug>: Fix <code>RegistrationListener</code> notifications
in
Jakarta Authentication implementation. (markt)
</fix>
+ <fix>
+ Handle CGI scripts that write excessively to stdout after setting an
+ HTTP error status code. (schultz)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
