This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/11.0.x by this push:
new fe2309be6c No password is not the same as a password of ""
fe2309be6c is described below
commit fe2309be6c648cc6a3898c75926db42530c4a1f2
Author: Mark Thomas <[email protected]>
AuthorDate: Tue Sep 1 16:46:51 2026 +0100
No password is not the same as a password of ""
---
java/org/apache/catalina/users/MemoryUserDatabase.java | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/java/org/apache/catalina/users/MemoryUserDatabase.java
b/java/org/apache/catalina/users/MemoryUserDatabase.java
index 725329510e..22294dc729 100644
--- a/java/org/apache/catalina/users/MemoryUserDatabase.java
+++ b/java/org/apache/catalina/users/MemoryUserDatabase.java
@@ -545,9 +545,15 @@ public class MemoryUserDatabase implements UserDatabase {
User user = (User) values.next();
writer.print(" <user username=\"");
writer.print(Escape.xml(user.getUsername()));
- writer.print("\" password=\"");
- writer.print(Escape.xml("", user.getPassword()));
writer.print("\"");
+ // Local copy to avoid TOCTOU inconsistency
+ // No password is not the same as a password of ""
+ String pwd = user.getPassword();
+ if (pwd != null) {
+ writer.print(" password=\"");
+ writer.print(Escape.xml(pwd));
+ writer.print("\"");
+ }
if (null != user.getFullName()) {
writer.print(" fullName=\"");
writer.print(Escape.xml(user.getFullName()));
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
