You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tomee.apache.org by rz...@apache.org on 2023/08/29 09:08:20 UTC
[tomee] 02/02: TOMEE-4239 - Backport fix for CVE-2023-41080 from https://github.com/apache/tomcat/commit/bb4624a9f3e69d495182ebfa68d7983076407a27
This is an automated email from the ASF dual-hosted git repository.
rzo1 pushed a commit to branch tomee-9.x
in repository https://gitbox.apache.org/repos/asf/tomee.git
commit b5e88d1534c457905a7411b8182928a528f6f8d9
Author: Richard Zowalla <rz...@apache.org>
AuthorDate: Tue Aug 29 11:06:19 2023 +0200
TOMEE-4239 - Backport fix for CVE-2023-41080 from https://github.com/apache/tomcat/commit/bb4624a9f3e69d495182ebfa68d7983076407a27
---
.../java/org/apache/catalina/authenticator/FormAuthenticator.java | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/tomee/apache-tomee/src/patch/java/org/apache/catalina/authenticator/FormAuthenticator.java b/tomee/apache-tomee/src/patch/java/org/apache/catalina/authenticator/FormAuthenticator.java
index a412db0071..0e95e2c08d 100644
--- a/tomee/apache-tomee/src/patch/java/org/apache/catalina/authenticator/FormAuthenticator.java
+++ b/tomee/apache-tomee/src/patch/java/org/apache/catalina/authenticator/FormAuthenticator.java
@@ -728,6 +728,12 @@ public class FormAuthenticator
sb.append('?');
sb.append(saved.getQueryString());
}
+
+ // Avoid protocol relative redirects
+ while (sb.length() > 1 && sb.charAt(1) == '/') {
+ sb.deleteCharAt(0);
+ }
+
return sb.toString();
}
}
\ No newline at end of file