This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/11.0.x by this push:
new 0005d50c34 Review "Validate the protocol of OCSP URLs from a client
certificate..."
0005d50c34 is described below
commit 0005d50c34b1c39515e19e32a13c6968f5e05369
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Nov 4 10:49:30 2026 +0000
Review "Validate the protocol of OCSP URLs from a client certificate..."
Simplify code.
Improve comment.
---
.../apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
index df7c3cb303..d57caefc4a 100644
--- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
+++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
@@ -1289,12 +1289,10 @@ public final class OpenSSLEngine extends SSLEngine
implements SSLUtil.ProtocolIn
URL url = (new
URI(urlString)).toURL();
String protocol =
url.getProtocol();
if (!"http".equals(protocol) &&
!"https".equals(protocol)) {
- // OpenSSLEngine can only talk
HTTP/HTTPS to OCSP responders. Other
- // protocol handlers (e.g.
file) trigger a ClassCastException below so
- // treat them as invalid and
skip to the next URL, as the JNI
- // implementation does when
OCSP URL parsing fails.
-
log.warn(sm.getString("engine.invalidOCSPURL", urlString));
- continue;
+ // Only HTTP and HTTPS are
supported for OCSP responders. Treat any
+ // other protocol as an
invalid URL, as the JNI implementation does
+ // when OCSP URL parsing fails.
+ throw new
MalformedURLException(urlString);
}
requestAttempted = true;
ocspResponse =
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
