This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit f11e6c592d9272c9619816881121c9f0bcfb97de Author: opencode <[email protected]> AuthorDate: Wed Oct 7 11:55:04 2026 +0200 Treat unknown session times as invalidated in the Manager SessionUtils DummyProxySession, which the HTML Manager uses to represent sessions held on other cluster nodes, returns zero from its time getters. The time methods in SessionUtils turned those zeros into values of about the current epoch time, which the UsedTime, InactiveTime and TTL sort comparators used as ordering keys. Return the -1 sentinel, documented for invalidated sessions, when the creation time is not positive, so proxy sessions sort consistently with unknown values instead of ±epoch magnitudes, and so their zero max inactive interval is not mistaken for the never-times-out case. --- .../apache/catalina/manager/util/SessionUtils.java | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/java/org/apache/catalina/manager/util/SessionUtils.java b/java/org/apache/catalina/manager/util/SessionUtils.java index a6c05d598c..3458159a12 100644 --- a/java/org/apache/catalina/manager/util/SessionUtils.java +++ b/java/org/apache/catalina/manager/util/SessionUtils.java @@ -237,10 +237,14 @@ public class SessionUtils { * * @param in_session The session * @return the time in milliseconds between session creation and the last access, or -1 if the session is - * invalidated + * invalidated or its times are unknown (proxy sessions of a cluster member) */ public static long getUsedTimeForSession(Session in_session) { try { + if (in_session.getCreationTime() <= 0) { + // Unknown times, e.g. a proxy session of a cluster member + return -1; + } return in_session.getThisAccessedTime() - in_session.getCreationTime(); } catch (IllegalStateException ise) { // ignore: invalidated session @@ -253,10 +257,14 @@ public class SessionUtils { * * @param in_session The session * @return the remaining TTL in milliseconds, {@link Long#MAX_VALUE} if the session never times out, or -1 if the - * session is invalidated + * session is invalidated or its times are unknown (proxy sessions of a cluster member) */ public static long getTTLForSession(Session in_session) { try { + if (in_session.getCreationTime() <= 0) { + // Unknown times, e.g. a proxy session of a cluster member + return -1; + } int maxInactiveInterval = in_session.getMaxInactiveInterval(); if (maxInactiveInterval <= 0) { // A non-positive interval means the session never times out @@ -274,10 +282,15 @@ public class SessionUtils { * Returns the time in milliseconds since the session was last accessed. * * @param in_session The session - * @return the inactive time in milliseconds, or -1 if the session is invalidated + * @return the inactive time in milliseconds, or -1 if the session is invalidated or its times are unknown (proxy + * sessions of a cluster member) */ public static long getInactiveTimeForSession(Session in_session) { try { + if (in_session.getCreationTime() <= 0) { + // Unknown times, e.g. a proxy session of a cluster member + return -1; + } return System.currentTimeMillis() - in_session.getThisAccessedTime(); } catch (IllegalStateException ise) { // ignore: invalidated session --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
