On 31/08/2012 12:05, Konstantin Kolinko wrote: > 2012/8/31 <ma...@apache.org>: >> Author: markt >> Date: Thu Aug 30 22:55:20 2012 >> New Revision: 1379206 >> >> URL: http://svn.apache.org/viewvc?rev=1379206&view=rev >> Log: >> Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=53801 >> Overlapping URL patterns were sometimes merged incorrectly in security >> constraints leading to incorrect 401 responses. Note: it was possible for >> access to be denied when it should have been granted but it was not possible >> for access to be granted when it should have been denied. >> >> Modified: >> tomcat/trunk/java/org/apache/catalina/realm/RealmBase.java >> >> Modified: tomcat/trunk/java/org/apache/catalina/realm/RealmBase.java >> URL: >> http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/realm/RealmBase.java?rev=1379206&r1=1379205&r2=1379206&view=diff >> ============================================================================== >> --- tomcat/trunk/java/org/apache/catalina/realm/RealmBase.java (original) >> +++ tomcat/trunk/java/org/apache/catalina/realm/RealmBase.java Thu Aug 30 >> 22:55:20 2012 >> @@ -629,14 +629,15 @@ public abstract class RealmBase extends >> } >> } >> if(matched) { >> - found = true; >> if(length > longest) { >> + found = false; >> if(results != null) { >> results.clear(); >> } >> longest = length; >> } >> if(collection[j].findMethod(method)) { >> + found = true; >> if(results == null) { >> results = new ArrayList<>(); >> } > > There are several loops over constraints, with > [[[ > if(found) { > return resultsToArray(results); > } > ]]] > between them, and only one of such loops is fixed by this commit.
Correct. Only in one loop is there the possibility that a previously found constraint will be removed. The bug was that the found flag was not reset in this case and an empty set of constraints returned rather than null. Mark --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
