This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/10.1.x by this push:
new e09f9dcebb Harden CGI servlet against scripts with excessive output on
error status
e09f9dcebb is described below
commit e09f9dcebba6d4a2aeaf59c03fe07f807977374a
Author: Mark Thomas <[email protected]>
AuthorDate: Fri Sep 4 16:11:26 2026 +0100
Harden CGI servlet against scripts with excessive output on error status
---
java/org/apache/catalina/servlets/CGIServlet.java | 10 ++++++----
webapps/docs/changelog.xml | 4 ++++
2 files changed, 10 insertions(+), 4 deletions(-)
diff --git a/java/org/apache/catalina/servlets/CGIServlet.java
b/java/org/apache/catalina/servlets/CGIServlet.java
index 3e9e9a61d7..af373c795b 100644
--- a/java/org/apache/catalina/servlets/CGIServlet.java
+++ b/java/org/apache/catalina/servlets/CGIServlet.java
@@ -1473,11 +1473,13 @@ public final class CGIServlet extends HttpServlet {
cgiOutput = proc.getInputStream();
try {
- while (!skipBody && (bufRead =
cgiOutput.read(bBuf)) != -1) {
- if (log.isTraceEnabled()) {
- log.trace("output " + bufRead + " bytes of
data");
+ while ((bufRead = cgiOutput.read(bBuf)) != -1) {
+ if (!skipBody) {
+ if (log.isTraceEnabled()) {
+ log.trace("output " + bufRead + "
bytes of data");
+ }
+ out.write(bBuf, 0, bufRead);
}
- out.write(bBuf, 0, bufRead);
}
} finally {
// Attempt to consume any leftover byte if
something bad happens,
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 6080b00cb5..c92515d7d8 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -181,6 +181,10 @@
<bug>70203</bug>: Fix <code>RegistrationListener</code> notifications
in
Jakarta Authentication implementation. (markt)
</fix>
+ <fix>
+ Handle CGI scripts that write excessively to stdout after setting an
+ HTTP error status code. (schultz)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
