This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new c3c690f866 Harden CGI servlet against scripts with excessive output on
error status
c3c690f866 is described below
commit c3c690f866d808aea14d199fd59818da3af6a82f
Author: Mark Thomas <[email protected]>
AuthorDate: Fri Sep 4 16:11:26 2026 +0100
Harden CGI servlet against scripts with excessive output on error status
---
java/org/apache/catalina/servlets/CGIServlet.java | 10 ++++++----
webapps/docs/changelog.xml | 4 ++++
2 files changed, 10 insertions(+), 4 deletions(-)
diff --git a/java/org/apache/catalina/servlets/CGIServlet.java
b/java/org/apache/catalina/servlets/CGIServlet.java
index 3b6c7bace0..c4196ba95e 100644
--- a/java/org/apache/catalina/servlets/CGIServlet.java
+++ b/java/org/apache/catalina/servlets/CGIServlet.java
@@ -1476,11 +1476,13 @@ public final class CGIServlet extends HttpServlet {
cgiOutput = proc.getInputStream();
try {
- while (!skipBody && (bufRead =
cgiOutput.read(bBuf)) != -1) {
- if (log.isTraceEnabled()) {
- log.trace("output " + bufRead + " bytes of
data");
+ while ((bufRead = cgiOutput.read(bBuf)) != -1) {
+ if (!skipBody) {
+ if (log.isTraceEnabled()) {
+ log.trace("output " + bufRead + "
bytes of data");
+ }
+ out.write(bBuf, 0, bufRead);
}
- out.write(bBuf, 0, bufRead);
}
} finally {
// Attempt to consume any leftover byte if
something bad happens,
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 240c2e6331..5d03b54a13 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -205,6 +205,10 @@
<bug>70203</bug>: Fix <code>RegistrationListener</code> notifications
in
Jakarta Authentication implementation. (markt)
</fix>
+ <fix>
+ Handle CGI scripts that write excessively to stdout after setting an
+ HTTP error status code. (schultz)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
