This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/10.1.x by this push:
new 183cacc2b2 Strip space around user names
183cacc2b2 is described below
commit 183cacc2b241ac5a7942806fbc712f45781ad85a
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Oct 28 16:05:07 2026 +0000
Strip space around user names
---
java/org/apache/catalina/realm/LockOutRealm.java | 86 ++++++++++++++++++++++--
webapps/docs/changelog.xml | 4 ++
webapps/docs/config/realm.xml | 14 ++++
3 files changed, 98 insertions(+), 6 deletions(-)
diff --git a/java/org/apache/catalina/realm/LockOutRealm.java
b/java/org/apache/catalina/realm/LockOutRealm.java
index c19612d57a..e2931d3386 100644
--- a/java/org/apache/catalina/realm/LockOutRealm.java
+++ b/java/org/apache/catalina/realm/LockOutRealm.java
@@ -83,6 +83,15 @@ public class LockOutRealm extends CombinedRealm {
*/
private boolean caseSensitive = false;
+ /*
+ * Should user names (the keys) in the failedUsers Map have leading space
removed. The default is true.
+ */
+ private boolean stripLeadingSpace = true;
+
+ /*
+ * Should user names (the keys) in the failedUsers Map have trailing space
removed. The default is true.
+ */
+ private boolean stripTrailingSpace = true;
@Override
protected void startInternal() throws LifecycleException {
@@ -356,9 +365,9 @@ public class LockOutRealm extends CombinedRealm {
/**
- * Get the case sensitivity flag for username matching.
+ * Get the case sensitivity flag for user name matching.
*
- * @return the caseSensitive
+ * @return the current caseSensitive value
*/
public boolean getCaseSensitive() {
return caseSensitive;
@@ -366,7 +375,7 @@ public class LockOutRealm extends CombinedRealm {
/**
- * Set the case sensitivity flag for username matching.
+ * Set the case sensitivity flag for user name matching.
*
* @param caseSensitive the caseSensitive to set
*/
@@ -375,11 +384,76 @@ public class LockOutRealm extends CombinedRealm {
}
+ /**
+ * Get the case strip leading space flag for user name matching.
+ *
+ * @return the current stripLeadingSpace value
+ */
+ public boolean getStripLeadingSpace() {
+ return stripLeadingSpace;
+ }
+
+
+ /**
+ * Set the strip leading space flag for user name matching.
+ *
+ * @param stripLeadingSpace the stripLeadingSpace to set
+ */
+ public void setStripLeadingSpace(boolean stripLeadingSpace) {
+ this.stripLeadingSpace = stripLeadingSpace;
+ }
+
+
+ /**
+ * Get the case strip trailing space flag for user name matching.
+ *
+ * @return the current stripTrailingSpace value
+ */
+ public boolean getStripTrailingSpace() {
+ return stripTrailingSpace;
+ }
+
+
+ /**
+ * Set the strip trailing space flag for user name matching.
+ *
+ * @param stripTrailingSpace the stripTrailingSpace to set
+ */
+ public void setStripTrailingSpace(boolean stripTrailingSpace) {
+ this.stripTrailingSpace = stripTrailingSpace;
+ }
+
+
private String normalizeUsername(String username) {
- if (username != null && !getCaseSensitive()) {
- return username.toLowerCase(Locale.ROOT);
+ if (username == null) {
+ return null;
+ }
+ if (!getCaseSensitive()) {
+ username = username.toLowerCase(Locale.ROOT);
+ }
+
+ // String.strip() only covers Character.isWhitespace().
Character.isSpaceChar() is also needed here.
+ int start = 0;
+ int end = username.length();
+ if (getStripLeadingSpace()) {
+ while (start < end) {
+ char c = username.charAt(start);
+ if (!Character.isSpaceChar(c) && !Character.isWhitespace(c)) {
+ break;
+ }
+ start++;
+ }
+ }
+ if (getStripTrailingSpace()) {
+ while (end > start) {
+ char c = username.charAt(end - 1);
+ if (!Character.isSpaceChar(c) && !Character.isWhitespace(c)) {
+ break;
+ }
+ end--;
+ }
}
- return username;
+ return username.substring(start, end);
}
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 15d59750d0..3fbaa19c86 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -334,6 +334,10 @@
Do not depend on the content length being defined when processing
request bodies with the CGI Servlet. (csutherl)
</fix>
+ <fix>
+ Align LockoutRealm with some Realm implementations and ignore leading
+ and trailing space in user names by default. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
diff --git a/webapps/docs/config/realm.xml b/webapps/docs/config/realm.xml
index 218b0f11a0..25ee65e019 100644
--- a/webapps/docs/config/realm.xml
+++ b/webapps/docs/config/realm.xml
@@ -1032,6 +1032,20 @@
will also not reset the lock out time.</p>
</attribute>
+ <attribute name="stripLeadingSpace" required="false">
+ <p>Will leading space (<code>Character.isWhitespace()</code> or
+ <code>Character.isSpaceChar()</code> returns <code>true</code>) be
+ removed from user names when making locking decisions. Defaults to
+ <code>true</code>, meaning leading space will be removed.</p>
+ </attribute>
+
+ <attribute name="stripTrailingSpace" required="false">
+ <p>Will trailing space (<code>Character.isWhitespace()</code> or
+ <code>Character.isSpaceChar()</code> returns <code>true</code>) be
+ removed from user names when making locking decisions. Defaults to
+ <code>true</code>, meaning leading space will be removed.</p>
+ </attribute>
+
<attribute name="transportGuaranteeRedirectStatus" required="false">
<p>The HTTP status code to use when the container needs to issue an
HTTP
redirect to meet the requirements of a configured transport
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
