[tomcat] branch 9.0.x updated: Escape timestamp output in AccessLog.

[rjung]

This is an automated email from the ASF dual-hosted git repository.

rjung pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/9.0.x by this push:
     new e896fd34d2 Escape timestamp output in AccessLog.
e896fd34d2 is described below

commit e896fd34d20e9b23f57e8b26551983fc04163c00
Author: Rainer Jung <rainer.j...@kippdata.de>
AuthorDate: Thu Apr 27 09:32:13 2023 +0200

    Escape timestamp output in AccessLog.
    
    It is needed if a SimpleDateFormat is used which contains
    verbatim characters that need escaping.
---
 .../apache/catalina/valves/AbstractAccessLogValve.java | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/java/org/apache/catalina/valves/AbstractAccessLogValve.java 
b/java/org/apache/catalina/valves/AbstractAccessLogValve.java
index 87784a205e..6bebc34cfa 100644
--- a/java/org/apache/catalina/valves/AbstractAccessLogValve.java
+++ b/java/org/apache/catalina/valves/AbstractAccessLogValve.java
@@ -1038,6 +1038,8 @@ public abstract class AbstractAccessLogValve extends 
ValveBase implements Access
 
         /* Our format description string, null if CLF */
         private final String format;
+        /* Does the format string contain characters we need to escape */
+        private final boolean needsEscaping;
         /* Whether to use begin of request or end of response as the timestamp 
*/
         private final boolean usesBegin;
         /* The format type */
@@ -1076,6 +1078,16 @@ public abstract class AbstractAccessLogValve extends 
ValveBase implements Access
 
         protected DateAndTimeElement(String sdf) {
             String format = sdf;
+            boolean needsEscaping = false;
+            if (sdf != null) {
+                CharArrayWriter writer = new CharArrayWriter();
+                escapeAndAppend(sdf, writer);
+                String escaped = writer.toString();
+                if (!escaped.equals(sdf)) {
+                    needsEscaping = true;
+                }
+            }
+            this.needsEscaping = needsEscaping;
             boolean usesBegin = false;
             FormatType type = FormatType.CLF;
 
@@ -1160,7 +1172,11 @@ public abstract class AbstractAccessLogValve extends 
ValveBase implements Access
                     temp = temp.replace(tripleMsecPattern, tripleMsec);
                     temp = temp.replace(msecPattern, Long.toString(frac));
                 }
-                buf.append(temp);
+                if (needsEscaping) {
+                    escapeAndAppend(temp, buf);
+                } else {
+                    buf.append(temp);
+                }
             }
         }
     }


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org