DO NOT REPLY [Bug 19705] New: - Newlines should not be allowed in status message

[bu...@apache.org]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=19705>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=19705

Newlines should not be allowed in status message

           Summary: Newlines should not be allowed in status message
           Product: Tomcat 4
           Version: 4.1.24
          Platform: All
        OS/Version: Other
            Status: NEW
          Severity: Normal
          Priority: Other
         Component: Catalina
        AssignedTo: tomcat-dev@jakarta.apache.org
        ReportedBy: dpotter@mitre.org


Newlines are currently allowed in the status message, breaking the HTTP/1.1
response.  For example, when a JSP fails to compile, the exception message is
embedded into the HTTP 500 status response.  However, since the exception
message contains new lines, it comes out as follows:

HTTP/1.1 500 Unable to compile class for JSP
An error occurred at line: -1 in the jsp file: null

Generated servlet error:
[javac] Since fork is true, ignoring compiler setting.
[javac] Compiling 1 source file

And so on.  The problem occurs either with the "An error occurred..." line
(since it isn't a valid HTTP/1.1 header) or with the double-newline between that
line and the next line, which ends the HTTP header block.

I'm not sure what the best solution is - it is apparent that newlines need to be
disallowed in the message.  My solution would be to have the newlines stripped
from the message string.  Other options are to prevent the message with newlines
from ever being set.  Regardless, this needs to be fixed since it has
interesting results on error pages when a JSP fails to compile.

---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org