This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new 0eec67e684 Strip space around user names
0eec67e684 is described below
commit 0eec67e684382ee31dc4be8d3eea70ff4e75931d
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Oct 28 16:05:07 2026 +0000
Strip space around user names
---
java/org/apache/catalina/realm/LockOutRealm.java | 86 ++++++++++++++++++++++--
webapps/docs/changelog.xml | 4 ++
webapps/docs/config/realm.xml | 14 ++++
3 files changed, 98 insertions(+), 6 deletions(-)
diff --git a/java/org/apache/catalina/realm/LockOutRealm.java
b/java/org/apache/catalina/realm/LockOutRealm.java
index d7f3c8772d..963a785635 100644
--- a/java/org/apache/catalina/realm/LockOutRealm.java
+++ b/java/org/apache/catalina/realm/LockOutRealm.java
@@ -84,6 +84,15 @@ public class LockOutRealm extends CombinedRealm {
*/
private boolean caseSensitive = false;
+ /*
+ * Should user names (the keys) in the failedUsers Map have leading space
removed. The default is true.
+ */
+ private boolean stripLeadingSpace = true;
+
+ /*
+ * Should user names (the keys) in the failedUsers Map have trailing space
removed. The default is true.
+ */
+ private boolean stripTrailingSpace = true;
@Override
protected void startInternal() throws LifecycleException {
@@ -358,9 +367,9 @@ public class LockOutRealm extends CombinedRealm {
/**
- * Get the case sensitivity flag for username matching.
+ * Get the case sensitivity flag for user name matching.
*
- * @return the caseSensitive
+ * @return the current caseSensitive value
*/
public boolean getCaseSensitive() {
return caseSensitive;
@@ -368,7 +377,7 @@ public class LockOutRealm extends CombinedRealm {
/**
- * Set the case sensitivity flag for username matching.
+ * Set the case sensitivity flag for user name matching.
*
* @param caseSensitive the caseSensitive to set
*/
@@ -377,11 +386,76 @@ public class LockOutRealm extends CombinedRealm {
}
+ /**
+ * Get the case strip leading space flag for user name matching.
+ *
+ * @return the current stripLeadingSpace value
+ */
+ public boolean getStripLeadingSpace() {
+ return stripLeadingSpace;
+ }
+
+
+ /**
+ * Set the strip leading space flag for user name matching.
+ *
+ * @param stripLeadingSpace the stripLeadingSpace to set
+ */
+ public void setStripLeadingSpace(boolean stripLeadingSpace) {
+ this.stripLeadingSpace = stripLeadingSpace;
+ }
+
+
+ /**
+ * Get the case strip trailing space flag for user name matching.
+ *
+ * @return the current stripTrailingSpace value
+ */
+ public boolean getStripTrailingSpace() {
+ return stripTrailingSpace;
+ }
+
+
+ /**
+ * Set the strip trailing space flag for user name matching.
+ *
+ * @param stripTrailingSpace the stripTrailingSpace to set
+ */
+ public void setStripTrailingSpace(boolean stripTrailingSpace) {
+ this.stripTrailingSpace = stripTrailingSpace;
+ }
+
+
private String normalizeUsername(String username) {
- if (username != null && !getCaseSensitive()) {
- return username.toLowerCase(Locale.ROOT);
+ if (username == null) {
+ return null;
+ }
+ if (!getCaseSensitive()) {
+ username = username.toLowerCase(Locale.ROOT);
+ }
+
+ // String.strip() only covers Character.isWhitespace().
Character.isSpaceChar() is also needed here.
+ int start = 0;
+ int end = username.length();
+ if (getStripLeadingSpace()) {
+ while (start < end) {
+ char c = username.charAt(start);
+ if (!Character.isSpaceChar(c) && !Character.isWhitespace(c)) {
+ break;
+ }
+ start++;
+ }
+ }
+ if (getStripTrailingSpace()) {
+ while (end > start) {
+ char c = username.charAt(end - 1);
+ if (!Character.isSpaceChar(c) && !Character.isWhitespace(c)) {
+ break;
+ }
+ end--;
+ }
}
- return username;
+ return username.substring(start, end);
}
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index ded62aebd9..cef54e8c0a 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -514,6 +514,10 @@
Do not depend on the content length being defined when processing
request bodies with the CGI Servlet. (csutherl)
</fix>
+ <fix>
+ Align LockoutRealm with some Realm implementations and ignore leading
+ and trailing space in user names by default. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
diff --git a/webapps/docs/config/realm.xml b/webapps/docs/config/realm.xml
index 78d593868b..477d96672a 100644
--- a/webapps/docs/config/realm.xml
+++ b/webapps/docs/config/realm.xml
@@ -920,6 +920,20 @@
will also not reset the lock out time.</p>
</attribute>
+ <attribute name="stripLeadingSpace" required="false">
+ <p>Will leading space (<code>Character.isWhitespace()</code> or
+ <code>Character.isSpaceChar()</code> returns <code>true</code>) be
+ removed from user names when making locking decisions. Defaults to
+ <code>true</code>, meaning leading space will be removed.</p>
+ </attribute>
+
+ <attribute name="stripTrailingSpace" required="false">
+ <p>Will trailing space (<code>Character.isWhitespace()</code> or
+ <code>Character.isSpaceChar()</code> returns <code>true</code>) be
+ removed from user names when making locking decisions. Defaults to
+ <code>true</code>, meaning leading space will be removed.</p>
+ </attribute>
+
<attribute name="transportGuaranteeRedirectStatus" required="false">
<p>The HTTP status code to use when the container needs to issue an
HTTP
redirect to meet the requirements of a configured transport
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
