You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2020/02/20 23:18:09 UTC

[Bug 64166] New: RequestDumperFilter duplicates headers

https://bz.apache.org/bugzilla/show_bug.cgi?id=64166

            Bug ID: 64166
           Summary: RequestDumperFilter duplicates headers
           Product: Tomcat 9
           Version: 9.0.x
          Hardware: PC
            Status: NEW
          Severity: minor
          Priority: P2
         Component: Catalina
          Assignee: dev@tomcat.apache.org
          Reporter: gpeterson@bravurasolutions.com
  Target Milestone: -----

Created attachment 37031
  --> https://bz.apache.org/bugzilla/attachment.cgi?id=37031&action=edit
Patch to correct logging of response headers

The RequestDumper attempts to log the outgoing headers by first obtaining the
header names, then for each header name it outputs the values for that header.
The problem is that the header names are not unique, so if there are two
cookies, there are two Set-Cookie headers. The dumper uses the getHeaders
method, which returns all values for the named header. Since it sees the
Set-Cookie header twice, calling getHeaders returns both values, so it logs
both values for each occurrence of the Set-Cookie header, so we see each cookie
twice in the request log.

Attached patch ensures headers are unique before logging.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org


[Bug 64166] RequestDumperFilter duplicates headers

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64166

Mark Thomas <ma...@apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 OS|                            |All

--- Comment #1 from Mark Thomas <ma...@apache.org> ---
I'm thinking that the return value for getHeaderNames() should be
de-duplicated. The only scenarios I can think of where that would cause issues,
the client is doing something unreasonable.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org


[Bug 64166] RequestDumperFilter duplicates headers

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64166

Mark Thomas <ma...@apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #2 from Mark Thomas <ma...@apache.org> ---
Fixed in:
- master for 10.0.0-M2 onwards
- 9.0.x for 9.0.32 onwards
- 8.5.x for 8.5.52 onwards
- 7.0.x for 7.0.101 onwards

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org


[Bug 64166] RequestDumperFilter duplicates headers

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64166

Michael Osipov <mi...@apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |michaelo@apache.org
  Attachment #37031|application/mbox            |text/plain
          mime type|                            |
  Attachment #37031|0                           |1
           is patch|                            |

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org