This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/10.1.x by this push:
new c9e0d3f5e7 Review "Validate the protocol of OCSP URLs from a client
certificate..."
c9e0d3f5e7 is described below
commit c9e0d3f5e79b6c686946277a2fa9b626a9083dac
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Nov 4 10:49:30 2026 +0000
Review "Validate the protocol of OCSP URLs from a client certificate..."
Simplify code.
Improve comment.
---
.../apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
index 1c45646372..5b5bf566ce 100644
--- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
+++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
@@ -1289,12 +1289,10 @@ public final class OpenSSLEngine extends SSLEngine
implements SSLUtil.ProtocolIn
URL url = (new
URI(urlString)).toURL();
String protocol =
url.getProtocol();
if (!"http".equals(protocol) &&
!"https".equals(protocol)) {
- // OpenSSLEngine can only talk
HTTP/HTTPS to OCSP responders. Other
- // protocol handlers (e.g.
file) trigger a ClassCastException below so
- // treat them as invalid and
skip to the next URL, as the JNI
- // implementation does when
OCSP URL parsing fails.
-
log.warn(sm.getString("engine.invalidOCSPURL", urlString));
- continue;
+ // Only HTTP and HTTPS are
supported for OCSP responders. Treat any
+ // other protocol as an
invalid URL, as the JNI implementation does
+ // when OCSP URL parsing fails.
+ throw new
MalformedURLException(urlString);
}
requestAttempted = true;
ocspResponse =
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
