This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit a28aa1c66e51ac5288493eb8e4cc70bd3afd19f4 Author: opencode <[email protected]> AuthorDate: Mon Oct 12 23:37:40 2026 +0200 Bound-check the AJP response header code lookup The getResponseHeaderForCode() method of the AJP Constants class indexed its translation array directly and threw an ArrayIndexOutOfBoundsException for a negative code or a code beyond the last known response header. Its two sibling lookups for methods and request headers have always validated the code and returned null instead. Add the same bounds check to the response header lookup so that all three public lookup methods behave consistently, and document the null return contract in the Javadoc of the three methods. No in-tree caller was affected, as the only caller, the static initializer of the response header code map, only uses codes covering the array. Add unit tests covering the first and last valid codes as well as codes below, just past and well beyond the valid range. --- java/org/apache/coyote/ajp/Constants.java | 9 ++++--- test/org/apache/coyote/ajp/TestConstants.java | 36 +++++++++++++++++++++++++++ 2 files changed, 42 insertions(+), 3 deletions(-) diff --git a/java/org/apache/coyote/ajp/Constants.java b/java/org/apache/coyote/ajp/Constants.java index 1ba3f13eac..7a94798532 100644 --- a/java/org/apache/coyote/ajp/Constants.java +++ b/java/org/apache/coyote/ajp/Constants.java @@ -280,7 +280,7 @@ public final class Constants { * * @param code the coded value * - * @return the string value of the method + * @return the string value of the method, or <code>null</code> if the code is out of range */ public static String getMethodForCode(final int code) { if (code < 0 || code >= methodTransArray.length) { @@ -376,7 +376,7 @@ public final class Constants { * * @param code the coded value * - * @return the string value of the header name + * @return the string value of the header name, or <code>null</code> if the code is out of range */ public static String getHeaderForCode(final int code) { if (code < 0 || code >= headerTransArray.length) { @@ -394,9 +394,12 @@ public final class Constants { * * @param code the coded value * - * @return the string value of the header + * @return the string value of the header, or <code>null</code> if the code is out of range */ public static String getResponseHeaderForCode(final int code) { + if (code < 0 || code >= responseTransArray.length) { + return null; + } return responseTransArray[code]; } diff --git a/test/org/apache/coyote/ajp/TestConstants.java b/test/org/apache/coyote/ajp/TestConstants.java new file mode 100644 index 0000000000..e07958bb37 --- /dev/null +++ b/test/org/apache/coyote/ajp/TestConstants.java @@ -0,0 +1,36 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.coyote.ajp; + +import org.junit.Assert; +import org.junit.Test; + +public class TestConstants { + + @Test + public void testGetResponseHeaderForCodeInBounds() { + Assert.assertEquals("Content-Type", Constants.getResponseHeaderForCode(0)); + Assert.assertEquals("WWW-Authenticate", Constants.getResponseHeaderForCode(10)); + } + + @Test + public void testGetResponseHeaderForCodeOutOfBounds() { + Assert.assertNull(Constants.getResponseHeaderForCode(-1)); + Assert.assertNull(Constants.getResponseHeaderForCode(Constants.SC_RESP_AJP13_MAX)); + Assert.assertNull(Constants.getResponseHeaderForCode(Integer.MAX_VALUE)); + } +} --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
