This is an automated email from the ASF dual-hosted git repository.
rmaucher pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/10.1.x by this push:
new 7fac7e996a Revert the change to UTF-8 for the WS client
7fac7e996a is described below
commit 7fac7e996aadc644982db68f616702384db808cb
Author: remm <[email protected]>
AuthorDate: Sun Oct 18 19:16:21 2026 +0200
Revert the change to UTF-8 for the WS client
Drop UTF-8 test.
---
.../apache/tomcat/websocket/BasicAuthenticator.java | 20 ++++++++++++++------
.../tomcat/websocket/TestBasicAuthenticator.java | 9 +++++----
.../websocket/server/TestHandshakeRequest.java | 10 ----------
webapps/docs/changelog.xml | 8 +++++---
4 files changed, 24 insertions(+), 23 deletions(-)
diff --git a/java/org/apache/tomcat/websocket/BasicAuthenticator.java
b/java/org/apache/tomcat/websocket/BasicAuthenticator.java
index 649457bac0..9e7dc82195 100644
--- a/java/org/apache/tomcat/websocket/BasicAuthenticator.java
+++ b/java/org/apache/tomcat/websocket/BasicAuthenticator.java
@@ -16,6 +16,7 @@
*/
package org.apache.tomcat.websocket;
+import java.nio.charset.Charset;
import java.nio.charset.StandardCharsets;
import java.util.Base64;
import java.util.Map;
@@ -52,16 +53,23 @@ public class BasicAuthenticator extends Authenticator {
String userPass = userName + ":" + userPassword;
/*
- * RFC 7617 section 2.1 leaves the default character encoding
undefined and only allows UTF-8 as the value of
- * the charset parameter, reserving any other value for future use.
Use UTF-8 by default and reject challenges
- * that ask for any other encoding rather than silently guessing one.
+ * RFC 7617 section 2.1 leaves the default character encoding
undefined. Use ISO-8859-1, the default used by
+ * Tomcat servers of this branch, when the challenge does not specify
a charset. UTF-8 is the only value the
+ * RFC allows for the charset parameter, reserving any other value for
future use, so use UTF-8 when the
+ * challenge asks for it and reject challenges that ask for any other
encoding rather than silently guessing
+ * one.
*/
String charsetParam = parameterMap.get(charsetparam);
- if (charsetParam != null && !charsetParam.equalsIgnoreCase("UTF-8")) {
- throw new
AuthenticationException(sm.getString("basicAuthenticator.invalidCharset",
charsetParam));
+ Charset charset = StandardCharsets.ISO_8859_1;
+ if (charsetParam != null) {
+ if (charsetParam.equalsIgnoreCase("UTF-8")) {
+ charset = StandardCharsets.UTF_8;
+ } else {
+ throw new
AuthenticationException(sm.getString("basicAuthenticator.invalidCharset",
charsetParam));
+ }
}
- String base64 =
Base64.getEncoder().encodeToString(userPass.getBytes(StandardCharsets.UTF_8));
+ String base64 =
Base64.getEncoder().encodeToString(userPass.getBytes(charset));
return " Basic " + base64;
}
diff --git a/test/org/apache/tomcat/websocket/TestBasicAuthenticator.java
b/test/org/apache/tomcat/websocket/TestBasicAuthenticator.java
index 62220ef891..91ca6584f6 100644
--- a/test/org/apache/tomcat/websocket/TestBasicAuthenticator.java
+++ b/test/org/apache/tomcat/websocket/TestBasicAuthenticator.java
@@ -27,11 +27,12 @@ public class TestBasicAuthenticator {
@Test
public void testAuthorizationNoCharset() throws Exception {
- // UTF-8 is used by default if no charset is specified. The pound
- // sign is a single byte in ISO-8859-1 and two bytes in UTF-8 so the
- // two encodings can be distinguished.
+ // ISO-8859-1 is used by default if no charset is specified, matching
+ // the default used by Tomcat servers of this branch. The pound sign
+ // is a single byte in ISO-8859-1 and two bytes in UTF-8 so the two
+ // encodings can be distinguished.
String authorization = getAuthorization("Basic realm=\"realm\"",
"user", "pass\u00A3word");
- Assert.assertEquals(" Basic " + encode("user:pass\u00A3word",
StandardCharsets.UTF_8), authorization);
+ Assert.assertEquals(" Basic " + encode("user:pass\u00A3word",
StandardCharsets.ISO_8859_1), authorization);
}
@Test
diff --git a/test/org/apache/tomcat/websocket/server/TestHandshakeRequest.java
b/test/org/apache/tomcat/websocket/server/TestHandshakeRequest.java
index b435f38137..9025262a72 100644
--- a/test/org/apache/tomcat/websocket/server/TestHandshakeRequest.java
+++ b/test/org/apache/tomcat/websocket/server/TestHandshakeRequest.java
@@ -64,16 +64,6 @@ public class TestHandshakeRequest extends WebSocketBaseTest {
}
- /*
- * URI syntax is valid here so the request reaches query string decoding.
That mechanism already rejects the
- * invalid UTF-8 sequence with a 400 response. Pinned here since it is a
different code path.
- */
- @Test
- public void testInvalidUtf8Escape() throws Exception {
- doTest("?x=%C0%80", HttpServletResponse.SC_BAD_REQUEST);
- }
-
-
@Test
public void testEmptyQueryString() throws Exception {
doTest("?", HttpServletResponse.SC_SWITCHING_PROTOCOLS);
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index cb6ba29eee..af6ce6339a 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -417,9 +417,11 @@
</fix>
<fix>
Encode the credentials used for basic authentication by the WebSocket
- client with UTF-8 by default rather than ISO-8859-1, and reject
- challenges that specify a charset other than UTF-8, the only value
- RFC 7617 allows. (remm)
+ client with UTF-8 when the server challenge specifies the charset
+ UTF-8, the only value RFC 7617 allows, and reject challenges that
+ specify any other charset. Challenges without a charset continue to
+ use ISO-8859-1, the default used by Tomcat servers of this branch.
+ (remm)
</fix>
</changelog>
</subsection>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
