This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 10.1.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 947f7f75ca76b581790c0d8662f4bc98751542e3 Author: opencode <[email protected]> AuthorDate: Sun Oct 18 22:40:21 2026 +0200 Validate page directive buffer values against the JSP specification JSP.7.2.1 requires the buffer attribute to be "none" or a positive integer followed by "kb". PageInfo.setBufferValue() only checked that the value ended in "kb" and that the remainder parsed as an integer. The multiplication of that integer by 1024 was not range checked. Out of range values therefore produced nonsense buffer sizes in the generated servlet. For example, buffer="4194304kb" silently over-flowed to zero, running the page unbuffered, while buffer="2097152kb" over-flowed to Integer.MIN_VALUE and buffer="-1kb" produced a negative size. The negative sizes passed translation and made every request for the page fail at run time with an IllegalArgumentException from the JspWriterImpl constructor. Zero and negative values are invalid in themselves per the specification. Reject values outside the range 1kb to (Integer.MAX_VALUE / 1024)kb during translation using the existing error message. The validation is applied in setBufferValue() so it covers values from page directives, JSP property groups and the XML syntax equivalently. Found by code review. --- java/org/apache/jasper/compiler/PageInfo.java | 10 +++ test/org/apache/jasper/compiler/TestPageInfo.java | 79 +++++++++++++++++++++++ test/webapp/jsp/pageinfo/buffer-min.jsp | 18 ++++++ test/webapp/jsp/pageinfo/buffer-negative.jsp | 18 ++++++ test/webapp/jsp/pageinfo/buffer-none.jsp | 18 ++++++ test/webapp/jsp/pageinfo/buffer-overflow.jsp | 18 ++++++ test/webapp/jsp/pageinfo/buffer-valid.jsp | 18 ++++++ test/webapp/jsp/pageinfo/buffer-zero.jsp | 18 ++++++ 8 files changed, 197 insertions(+) diff --git a/java/org/apache/jasper/compiler/PageInfo.java b/java/org/apache/jasper/compiler/PageInfo.java index 9100102403..734291e187 100644 --- a/java/org/apache/jasper/compiler/PageInfo.java +++ b/java/org/apache/jasper/compiler/PageInfo.java @@ -623,6 +623,16 @@ public class PageInfo { try { @SuppressWarnings("null") // value can't be null here int k = Integer.parseInt(value.substring(0, value.length() - 2)); + // JSP.7.2.1 requires a positive integer. Values outside this + // range are invalid in themselves and would additionally + // overflow the multiplication by 1024 below. + if (k <= 0 || k > Integer.MAX_VALUE / 1024) { + if (n == null) { + err.jspError("jsp.error.page.invalid.buffer"); + } else { + err.jspError(n, "jsp.error.page.invalid.buffer"); + } + } buffer = k * 1024; } catch (NumberFormatException e) { if (n == null) { diff --git a/test/org/apache/jasper/compiler/TestPageInfo.java b/test/org/apache/jasper/compiler/TestPageInfo.java new file mode 100644 index 0000000000..4a97557bae --- /dev/null +++ b/test/org/apache/jasper/compiler/TestPageInfo.java @@ -0,0 +1,79 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.jasper.compiler; + +import org.junit.Assert; +import org.junit.Test; + +import org.apache.catalina.startup.TomcatBaseTest; +import org.apache.tomcat.util.buf.ByteChunk; + +public class TestPageInfo extends TomcatBaseTest { + + @Test + public void testBufferNone() throws Exception { + doTestBuffer("none", 200, null); + } + + @Test + public void testBufferValid() throws Exception { + doTestBuffer("valid", 200, null); + } + + @Test + public void testBufferZero() throws Exception { + // JSP.7.2.1 requires a positive integer + doTestBuffer("zero", 500, "invalid value for buffer"); + } + + @Test + public void testBufferNegative() throws Exception { + // JSP.7.2.1 requires a positive integer + doTestBuffer("negative", 500, "invalid value for buffer"); + } + + @Test + public void testBufferOverflowMinimum() throws Exception { + // The multiplication by 1024 overflows to Integer.MIN_VALUE + doTestBuffer("min", 500, "invalid value for buffer"); + } + + @Test + public void testBufferOverflowWrapAround() throws Exception { + // The multiplication by 1024 overflows to zero + doTestBuffer("overflow", 500, "invalid value for buffer"); + } + + private void doTestBuffer(String name, int expectedStatus, String expectedMessage) throws Exception { + getTomcatInstanceTestWebapp(false, true); + + ByteChunk res = new ByteChunk(); + int sc = getUrl("http://localhost:"; + getPort() + "/test/jsp/pageinfo/buffer-" + name + ".jsp", res, null); + + Assert.assertEquals(expectedStatus, sc); + + String result = res.toString(); + if (expectedMessage == null) { + Assert.assertTrue(result, result.contains("OK")); + } else { + // The page should fail translation with a clear message. Before + // the range was validated, overflow and negative values either + // passed translation silently or failed later at run time. + Assert.assertTrue(result, result.contains(expectedMessage)); + } + } +} diff --git a/test/webapp/jsp/pageinfo/buffer-min.jsp b/test/webapp/jsp/pageinfo/buffer-min.jsp new file mode 100644 index 0000000000..ef0dc6930f --- /dev/null +++ b/test/webapp/jsp/pageinfo/buffer-min.jsp @@ -0,0 +1,18 @@ +<%-- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +--%> +<%@ page buffer="2097152kb" %> +OK diff --git a/test/webapp/jsp/pageinfo/buffer-negative.jsp b/test/webapp/jsp/pageinfo/buffer-negative.jsp new file mode 100644 index 0000000000..36f4314739 --- /dev/null +++ b/test/webapp/jsp/pageinfo/buffer-negative.jsp @@ -0,0 +1,18 @@ +<%-- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +--%> +<%@ page buffer="-1kb" %> +OK diff --git a/test/webapp/jsp/pageinfo/buffer-none.jsp b/test/webapp/jsp/pageinfo/buffer-none.jsp new file mode 100644 index 0000000000..e777f6d3db --- /dev/null +++ b/test/webapp/jsp/pageinfo/buffer-none.jsp @@ -0,0 +1,18 @@ +<%-- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +--%> +<%@ page buffer="none" %> +OK diff --git a/test/webapp/jsp/pageinfo/buffer-overflow.jsp b/test/webapp/jsp/pageinfo/buffer-overflow.jsp new file mode 100644 index 0000000000..1c4c1f86c5 --- /dev/null +++ b/test/webapp/jsp/pageinfo/buffer-overflow.jsp @@ -0,0 +1,18 @@ +<%-- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +--%> +<%@ page buffer="4194304kb" %> +OK diff --git a/test/webapp/jsp/pageinfo/buffer-valid.jsp b/test/webapp/jsp/pageinfo/buffer-valid.jsp new file mode 100644 index 0000000000..0d78801afc --- /dev/null +++ b/test/webapp/jsp/pageinfo/buffer-valid.jsp @@ -0,0 +1,18 @@ +<%-- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +--%> +<%@ page buffer="8kb" %> +OK diff --git a/test/webapp/jsp/pageinfo/buffer-zero.jsp b/test/webapp/jsp/pageinfo/buffer-zero.jsp new file mode 100644 index 0000000000..315ce9d0c1 --- /dev/null +++ b/test/webapp/jsp/pageinfo/buffer-zero.jsp @@ -0,0 +1,18 @@ +<%-- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +--%> +<%@ page buffer="0kb" %> +OK --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
