This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit bc253c9e2a501865c04592e6b0be6bcda488e11b Author: opencode <[email protected]> AuthorDate: Wed Sep 30 16:24:53 2026 +0200 Use an instanceof check when instantiating the configured rateLimitClassName in RateLimitFilter.init() so a class that does not implement RateLimiter produces the intended ServletException rather than a raw ClassCastException --- java/org/apache/catalina/filters/RateLimitFilter.java | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/java/org/apache/catalina/filters/RateLimitFilter.java b/java/org/apache/catalina/filters/RateLimitFilter.java index cce983c194..ea3be37f01 100644 --- a/java/org/apache/catalina/filters/RateLimitFilter.java +++ b/java/org/apache/catalina/filters/RateLimitFilter.java @@ -254,7 +254,12 @@ public class RateLimitFilter extends FilterBase { super.init(filterConfig); try { - rateLimiter = (RateLimiter) Class.forName(rateLimitClassName).getConstructor().newInstance(); + Object instance = Class.forName(rateLimitClassName).getConstructor().newInstance(); + if (instance instanceof RateLimiter limiter) { + rateLimiter = limiter; + } else { + throw new ServletException(sm.getString("rateLimitFilter.classNotFound", rateLimitClassName)); + } } catch (ReflectiveOperationException e) { throw new ServletException(sm.getString("rateLimitFilter.classNotFound", rateLimitClassName), e); } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
