You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2022/01/27 08:31:04 UTC
[Bug 65851] New: DefaultServlet.checkIfNoneMatch return 400
https://bz.apache.org/bugzilla/show_bug.cgi?id=65851
Bug ID: 65851
Summary: DefaultServlet.checkIfNoneMatch return 400
Product: Tomcat 8
Version: 8.5.75
Hardware: PC
Status: NEW
Severity: normal
Priority: P2
Component: Catalina
Assignee: dev@tomcat.apache.org
Reporter: jamesx_cn@163.com
Target Milestone: ----
If header contains If-None-Match，response will send
error（HttpServletResponse.SC_BAD_REQUEST），because EntityTag.compareEntityTag
always false
examples:
If-None-Match: W/"43812-1643093925000"
// RFC 7232 requires weak comparison for If-None-Match
headers
Boolean matched = EntityTag.compareEntityTag(new
StringReader(headerValue), true, resourceETag);
if (matched == null) {
if (debug > 10) {
log("DefaultServlet.checkIfNoneMatch: Invalid
header value [" + headerValue + "]");
}
response.sendError(HttpServletResponse.SC_BAD_REQUEST);
return false;
}
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 65851] DefaultServlet.checkIfNoneMatch return 400
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65851
--- Comment #3 from james <ja...@163.com> ---
Google Chrome first visit is success
fist vist http headers:
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: keep-alive
Cookie: JSESSIONID=91060473D6FB4F01EB3E4A73A91224F2;
Hm_lvt_ebe23eb396f5a803e26ea4bd102a8b0f=1643248528,1644831330;
back_ff8080817e8b43a6017efb5e0ce3014f=b; ff8080817e8b43a6017efb5e0ce3014f=4;
r_ff8080817e8b43a6017efb5e0ce3014f=4; back_ff8080817efc22ff017efc4c8964009d=b;
ff8080817efc22ff017efc4c8964009d=9; r_ff8080817efc22ff017efc4c8964009d=9;
Hm_lpvt_ebe23eb396f5a803e26ea4bd102a8b0f=1644911721
Host: localhost:8080
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="98", "Google Chrome";v="98"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 65851] DefaultServlet.checkIfNoneMatch return 400
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65851
--- Comment #4 from Mark Thomas <ma...@apache.org> ---
I've repeated my test with the provided headers. Tomcat does not reject the
request. I suspect something in the application is causing the problem.
I suggest you try to recreate the simplest possible test case that demonstrates
this issue.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 65851] DefaultServlet.checkIfNoneMatch return 400
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65851
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|CLOSED |INVALID
--- Comment #8 from Mark Thomas <ma...@apache.org> ---
Restoring correct resolution. Please do not change this.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 65851] DefaultServlet.checkIfNoneMatch return 400
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65851
james <ja...@163.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|INVALID |FIXED
--- Comment #5 from james <ja...@163.com> ---
Thanks for reply, the application is causing the problem：
before xss filter:
If-None-Match: W/"30248-1644904299670"
after xss filter:
If-None-Match: W/“30248-1644904299670“
Because " escape to “，HttpParser parse value is null, and response send error
400, but tomcat 8.5.57 don't send error, 8.5.73-75 send error.
// Note: RFC 2616 allowed quoted string
// RFC 7232 does not allow " in the entity-tag
String value = HttpParser.readQuotedString(input, true);
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 65851] DefaultServlet.checkIfNoneMatch return 400
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65851
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|FIXED |INVALID
--- Comment #6 from Mark Thomas <ma...@apache.org> ---
Restoring correct resolution - this was an application bug.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 65851] DefaultServlet.checkIfNoneMatch return 400
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65851
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
OS| |All
Resolution|--- |INVALID
--- Comment #1 from Mark Thomas <ma...@apache.org> ---
If the client provides an invalid header then Tomcat will return a 400
response.
The sample header provided is not invalid and Tomcat correctly returns the
requested resource (assuming the resource has a different eTag).
Tested with latest 8.5.x and telnet with the provided header used.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 65851] DefaultServlet.checkIfNoneMatch return 400
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65851
james <ja...@163.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|INVALID |CLOSED
Status|RESOLVED |CLOSED
--- Comment #7 from james <ja...@163.com> ---
This was an application bug.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 65851] DefaultServlet.checkIfNoneMatch return 400
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65851
--- Comment #2 from james <ja...@163.com> ---
Tested with latest tomcat 8.5.75, Google Chrome first visit is return 200, but
second visit is return 400, second visit has If-None-Match header
second vist http headers:
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: keep-alive
Cookie: JSESSIONID=91060473D6FB4F01EB3E4A73A91224F2;
Hm_lvt_ebe23eb396f5a803e26ea4bd102a8b0f=1643248528,1644831330;
back_ff8080817e8b43a6017efb5e0ce3014f=b; ff8080817e8b43a6017efb5e0ce3014f=4;
r_ff8080817e8b43a6017efb5e0ce3014f=4; back_ff8080817efc22ff017efc4c8964009d=b;
ff8080817efc22ff017efc4c8964009d=9; r_ff8080817efc22ff017efc4c8964009d=9;
Hm_lpvt_ebe23eb396f5a803e26ea4bd102a8b0f=1644911721
Host: localhost:8080
If-Modified-Since: Tue, 15 Feb 2022 05:51:39 GMT
If-None-Match: W/"30248-1644904299670"
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="98", "Google Chrome";v="98"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org