This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new 6874871a0f No password is not the same as a password of ""
6874871a0f is described below
commit 6874871a0f232b5f9a776fef8e97faf70a886719
Author: Mark Thomas <[email protected]>
AuthorDate: Tue Sep 1 16:46:51 2026 +0100
No password is not the same as a password of ""
---
java/org/apache/catalina/users/MemoryUserDatabase.java | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/java/org/apache/catalina/users/MemoryUserDatabase.java
b/java/org/apache/catalina/users/MemoryUserDatabase.java
index 725329510e..22294dc729 100644
--- a/java/org/apache/catalina/users/MemoryUserDatabase.java
+++ b/java/org/apache/catalina/users/MemoryUserDatabase.java
@@ -545,9 +545,15 @@ public class MemoryUserDatabase implements UserDatabase {
User user = (User) values.next();
writer.print(" <user username=\"");
writer.print(Escape.xml(user.getUsername()));
- writer.print("\" password=\"");
- writer.print(Escape.xml("", user.getPassword()));
writer.print("\"");
+ // Local copy to avoid TOCTOU inconsistency
+ // No password is not the same as a password of ""
+ String pwd = user.getPassword();
+ if (pwd != null) {
+ writer.print(" password=\"");
+ writer.print(Escape.xml(pwd));
+ writer.print("\"");
+ }
if (null != user.getFullName()) {
writer.print(" fullName=\"");
writer.print(Escape.xml(user.getFullName()));
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
