[Bug 69731] New: Incorrect count of maxParameterCount (double count) when executing req.getParameter(name) after request.getPart()
https://bz.apache.org/bugzilla/show_bug.cgi?id=69731
Bug ID: 69731
Summary: Incorrect count of maxParameterCount (double count)
when executing req.getParameter(name) after
request.getPart()
Product: Tomcat 9
Version: 9.0.106
Hardware: PC
OS: All
Status: NEW
Severity: normal
Priority: P2
Component: Catalina
Assignee: dev@tomcat.apache.org
Reporter: naozumi.taromaru...@nttdata.com
Target Milestone: -
Condition(for test):
server.xml
---
---
servlet:
---
public class UploadServlet extends HttpServlet {
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse res)
throws ServletException, IOException {
Collection parts = req.getParts();
System.out.println("req.getParts() done.");
System.out.println("param count = " + parts.size());
System.out.println("text=" + req.getParameter("text"));
// omitted file operation
req.getRequestDispatcher("/home.jsp").forward(req, res);
}
}
---
query param: ?text=aaa
multipart params:
text params count: 4
file params count: 0
* This issue does not occur when there are only file parameters.
Expected result:
---
req.getParts() done.
param count = 4
text=aaa
---
Actual result:
---
req.getParts() done.
param count = 4
27-Jun-2025 10:54:02.578 情報 [http-nio-8080-exec-1]
org.apache.tomcat.util.http.Parameters.processParameters 単独のリクエスト ([4])
のリクエストパラメーター (GET および POST) の数が上限値を超えています。上限値を超えるすべてのパラメーターは無視します。上限値を変更するには
Connector 要素の maxParameterCount 属性を設定してください。
注: 以降のこのエラーの発生はDEBUGレベルでログに出力されます。
text=null
---
When the maxParameterCount is "9":
---
req.getParts() done.
param count = 4
text=aaa
---
Possible cause code:
org.apache.catalina.connector.Request#parseParameters()
---
if (parts != null && maxParameterCount > 0) {
maxParameterCount -= parts.size();
}
parameters.setLimit(maxParameterCount);
---
When request.getParts() is already executed, parameters contains the multipart
text parameters.
(see: "parameters.addParameter(name, value);" in
org.apache.catalina.connector.Request#parseParts(boolean explicit))
So the multipart text parameters are effectively double-counted.
Suggestion code:
---
if (parts != null && maxParameterCount > 0) {
maxParameterCount -= parts.size() - parameters.size();
}
parameters.setLimit(maxParameterCount);
---
When request.getParts() is already executed, subtract the number of multipart
file parameters (parts.size() - parameters.size()) from maxParameterCount.
--
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
[Bug 69731] Incorrect count of maxParameterCount (double count) when executing req.getParameter(name) after request.getPart()
https://bz.apache.org/bugzilla/show_bug.cgi?id=69731 Remy Maucherat changed: What|Removed |Added Status|NEW |RESOLVED Resolution|--- |INVALID --- Comment #1 from Remy Maucherat --- Parts parameters also count in the regular parameters count, this is as expected. I don't see how they are double counted. So they count in the maxPartCount and also in the maxParameterCount. Did I miss anything ? Please give some more examples if I did. -- You are receiving this mail because: You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
[Bug 56148] support (multiple) ocsp stapling
https://bz.apache.org/bugzilla/show_bug.cgi?id=56148 --- Comment #19 from logo --- Hi @Mark, I have no ways to fix this myself (provide patch). Any chance to get this fixed? It's been a while that this is happily working in JSSE :-) . Is this actually available in 10.1ff, Native 2.0? Thank You. Peter -- You are receiving this mail because: You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
[Bug 56148] support (multiple) ocsp stapling
https://bz.apache.org/bugzilla/show_bug.cgi?id=56148 --- Comment #20 from Christopher Schultz --- I'm not sure investing a lot of energy in anything OCSP-related is worth it any more. https://letsencrypt.org/2024/12/05/ending-ocsp/ I know it sounds crazy, but we are basically going back to CRL, except it's Not Your Father's CRL. The great news is that web servers won't have to do any of this nonsense anymore. -- You are receiving this mail because: You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
Re: [PR] Enable rejectSuspiciousURIs by default to comply servlet 6 spec [tomcat]
Chenjp commented on PR #871: URL: https://github.com/apache/tomcat/pull/871#issuecomment-3021435704 @markt-asf servlet project contains a testcase (CanonicalUriPathTest.java), is it a part of servlet TCK? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
[Bug 69731] Incorrect count of maxParameterCount (double count) when executing req.getParameter(name) after request.getPart()
https://bz.apache.org/bugzilla/show_bug.cgi?id=69731 naozumi.taromaru...@nttdata.com changed: What|Removed |Added Status|RESOLVED|REOPENED Resolution|INVALID |--- --- Comment #2 from naozumi.taromaru...@nttdata.com --- > Parts parameters also count in the regular parameters count, this is as > expected. I knew that. > So they count in the maxPartCount and also in the maxParameterCount. I knew that. > I don't see how they are double counted. Please see "Possible cause code" at the Description. When there is(are) multipart text parameter(s), 1. parameters.addParameter(name, value); is executed. and 2. limit property of parameters is decremented. (For multipart file parameters, "1" is not performed, so "2" must be performed, but for multipart text parameters, "1" is performed, so "2" must not be performed.) Here are some examples: Fixed conditions: * servlet: see the Description. (execute req.getParameter(name) after req.getParts()) * query param: ?text=aaa (one parameter) * multipart file params count: 0 When multipart text params count: 4 (total parameter count is 5) maxParameterCount="8"(at server.xml) ... result: text=null maxParameterCount="9"(at server.xml) ... result: text=aaa (These are the conditions and results at the Description.) When multipart text params count: 5 (total parameter count is 6) maxParameterCount="10"(at server.xml) ... result: text=null maxParameterCount="11"(at server.xml) ... result: text=aaa When multipart text params count: 6 (total parameter count is 7) maxParameterCount="12"(at server.xml) ... result: text=null maxParameterCount="13"(at server.xml) ... result: text=aaa * Even if "total parameter count" less than(or equal) maxParameterCount, query parameters will not be available. For reference, the behavior when the workaround is implemented is described below. Workaround (Additional condition): Execute req.getParameter(name) before request.getParts(). eg., Add org.apache.catalina.filters.FailedRequestFilter at web.xml. When multipart text params count: 4 (total parameter count is 5) maxParameterCount="4"(at server.xml) ... result: 500 error maxParameterCount="5"(at server.xml) ... result: text=aaa When multipart text params count: 5 (total parameter count is 6) maxParameterCount="5"(at server.xml) ... result: 500 error maxParameterCount="6"(at server.xml) ... result: text=aaa When multipart text params count: 6 (total parameter count is 7) maxParameterCount="6"(at server.xml) ... result: 500 error maxParameterCount="7"(at server.xml) ... result: text=aaa * These are counted correctly. -- You are receiving this mail because: You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
[Bug 69731] Incorrect count of maxParameterCount (double count) when executing req.getParameter(name) after req.getParts()
https://bz.apache.org/bugzilla/show_bug.cgi?id=69731 naozumi.taromaru...@nttdata.com changed: What|Removed |Added Summary|Incorrect count of |Incorrect count of |maxParameterCount (double |maxParameterCount (double |count) when executing |count) when executing |req.getParameter(name) |req.getParameter(name) |after request.getPart() |after req.getParts() -- You are receiving this mail because: You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
