This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit db5c4e163c8f3350cb4ad3db1fe1f7163fd0912c Author: opencode <[email protected]> AuthorDate: Fri Oct 16 10:43:03 2026 +0200 Validate the protocol of OCSP URLs from a client certificate AIA extension The FFM OpenSSL implementation accepted any protocol that has a URL stream handler registered in the JVM (for example file: or jar:) when building OCSP requests from the URLs found in the OCSP No Check AIA extension of a client certificate. Setting requestAttempted to true before the URLConnection was cast to HttpURLConnection meant that the resulting ClassCastException was reported as a non-soft-failable X509_V_ERR_APPLICATION_VERIFICATION error, causing the handshake to fail even when ocspSoftFail was enabled (the default). Now the protocol is checked before a request is attempted. A URL with a protocol other than http or https is logged as invalid and skipped, matching the handling of syntactically invalid URLs at the same place and the behaviour of the JNI/tomcat-native implementation, where OSSL_HTTP_parse_url() rejects non-HTTP URLs and no request is made. The other elements of the original report were rejected: the DER length claims used by the OCSP URL parser are bounded by Asn1Parser.parseLength() against the real remaining data before any array is allocated, so no oversized allocation is possible; and bounding the number of responder URLs or the aggregate wait time would change the behaviour of the opt-in OCSP feature beyond what the JNI implementation offers for an exposure limited to certificates signed by trusted CAs. --- .../org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java index 3d54c6bfd0..5109c42b9a 100644 --- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java +++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java @@ -1278,6 +1278,15 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn for (String urlString : urls) { try { URL url = (new URI(urlString)).toURL(); + String protocol = url.getProtocol(); + if (!"http".equals(protocol) && !"https".equals(protocol)) { + // OpenSSLEngine can only talk HTTP/HTTPS to OCSP responders. Other + // protocol handlers (e.g. file) trigger a ClassCastException below so + // treat them as invalid and skip to the next URL, as the JNI + // implementation does when OCSP URL parsing fails. + log.warn(sm.getString("engine.invalidOCSPURL", urlString)); + continue; + } requestAttempted = true; ocspResponse = processOCSPRequest(state, url, issuer, x509, x509ctx, localArena); --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
