Author: markt
Date: Tue Sep  7 16:10:49 2010
New Revision: 993414

URL: http://svn.apache.org/viewvc?rev=993414&view=rev
Log:
Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=38113
Add system property to allow spec compliant handling of query string

Modified:
    tomcat/tc6.0.x/trunk/STATUS.txt
    tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java
    tomcat/tc6.0.x/trunk/webapps/docs/changelog.xml
    tomcat/tc6.0.x/trunk/webapps/docs/config/systemprops.xml

Modified: tomcat/tc6.0.x/trunk/STATUS.txt
URL: 
http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/STATUS.txt?rev=993414&r1=993413&r2=993414&view=diff
==============================================================================
--- tomcat/tc6.0.x/trunk/STATUS.txt (original)
+++ tomcat/tc6.0.x/trunk/STATUS.txt Tue Sep  7 16:10:49 2010
@@ -160,12 +160,6 @@ PATCHES PROPOSED TO BACKPORT:
   -1:
   rjung: s/vesion/version/g
 
-* Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=38113
-  Add system property to allow spec compliant handling of query string
-  http://people.apache.org/~markt/patches/2010-08-25-bug38113.patch
-  +1: markt, kkolinko, rjung
-  -1:
-
 * Provide better web application state information via JMX
   A limited back-port of http://svn.apache.org/viewvc?rev=992245&view=rev that
   could be extended to other components that use LifecycleSupport and expose

Modified: tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java
URL: 
http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java?rev=993414&r1=993413&r2=993414&view=diff
==============================================================================
--- tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java 
(original)
+++ tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java Tue 
Sep  7 16:10:49 2010
@@ -83,16 +83,20 @@ import org.apache.catalina.util.StringPa
 public class Request
     implements HttpServletRequest {
 
-
-    // ----------------------------------------------------------- Constructors
-
+    private final static boolean ALLOW_EMPTY_QUERY_STRING;
 
     static {
         // Ensure that classes are loaded for SM
         new StringCache.ByteEntry();
         new StringCache.CharEntry();
+        
+        ALLOW_EMPTY_QUERY_STRING = Boolean.parseBoolean(System.getProperty(
+                
"org.apache.catalina.connector.Request.ALLOW_EMPTY_QUERY_STRING",
+                Boolean.toString(Globals.STRICT_SERVLET_COMPLIANCE)));
     }
 
+    
+    // ----------------------------------------------------------- Constructors
     public Request() {
 
         formats[0].setTimeZone(GMT_ZONE);
@@ -1975,11 +1979,11 @@ public class Request
      */
     public String getQueryString() {
         String queryString = coyoteRequest.queryString().toString();
-        if (queryString == null || queryString.equals("")) {
-            return (null);
-        } else {
-            return queryString;
+        if (!ALLOW_EMPTY_QUERY_STRING && "".equals(queryString)) {
+            return null;
         }
+        
+        return queryString;
     }
 
 

Modified: tomcat/tc6.0.x/trunk/webapps/docs/changelog.xml
URL: 
http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/webapps/docs/changelog.xml?rev=993414&r1=993413&r2=993414&view=diff
==============================================================================
--- tomcat/tc6.0.x/trunk/webapps/docs/changelog.xml (original)
+++ tomcat/tc6.0.x/trunk/webapps/docs/changelog.xml Tue Sep  7 16:10:49 2010
@@ -50,6 +50,11 @@
   <subsection name="Catalina">
     <changelog>
       <fix>
+        <bug>38113</bug>: Provide a system property that enables a strict
+        interpretation of the specification for <code>getQueryString()</code>
+        when an empty query string is provided by the user agent. (markt)
+      </fix>
+      <fix>
         Return a copy of the current URLs for the 
<code>WebappClassLoader</code>
         to prevent modification. This facilitated, although it wasn't the root
         cause, CVE-2010-1622. (markt)

Modified: tomcat/tc6.0.x/trunk/webapps/docs/config/systemprops.xml
URL: 
http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/webapps/docs/config/systemprops.xml?rev=993414&r1=993413&r2=993414&view=diff
==============================================================================
--- tomcat/tc6.0.x/trunk/webapps/docs/config/systemprops.xml (original)
+++ tomcat/tc6.0.x/trunk/webapps/docs/config/systemprops.xml Tue Sep  7 
16:10:49 2010
@@ -250,7 +250,16 @@
     </property>
 
     <property
-    name="org.apache.catalina.session. StandardSession.ACTIVITY_CHECK">
+        name="org.apache.catalina. connector.Request.ALLOW_EMPTY_QUERY_STRING">
+      <p>If this is <code>true</code> Tomcat will return an empty string rather
+      than <code>null</code> for empty query strings - i.e. query strings where
+      only <code>?</code> is present. If not specified, the value of
+      <code>org.apache.catalina.STRICT_SERVLET_COMPLIANCE</code> will be used 
as
+      the default.</p> 
+    </property>
+
+    <property
+        name="org.apache.catalina.session. StandardSession.ACTIVITY_CHECK">
       <p>If this is <code>true</code> or if
       <code>org.apache.catalina.STRICT_SERVLET_COMPLIANCE</code> is
       <code>true</code> Tomcat will track the number of active requests for 
each



---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

Reply via email to