[UNDERTOW-2451] fix the information leakage issues #1668
Conversation
AJP Parser: Do not share the decodeBuffer StringBuilder instance between responses
fix the message leak issue in HPACK decoder
baranowb
added
bug fix
|
@BFionaccept could you please update commit messages? Add [UNDERTOW-2451] as prefix and reword first message, since that CVE is very specific and does not cover class you make change to. |
| @@ -260,12 +258,12 @@ private String readHpackString(ByteBuffer buffer) throws HpackException { | |||
| } | |||
|
|
|||
| private String readHuffmanString(int length, ByteBuffer buffer) throws HpackException { | |||
| StringBuilder stringBuilder = new StringBuilder(length); | |||
There was a problem hiding this comment.
In this fix, I referenced the patch for a similar vulnerability (CVE-2020-17527) in the corresponding functional module of Tomcat, as shown in this commit: apache/tomcat@d56293f#diff-98723542790b05d2e3c2dadeef7c632e641e3118b3b809660e9b1ef41686cfe0R226. I removed the final from the StringBuilder stringBuilder declaration, enhancing code flexibility and allowing for future reassignment if needed.
Certainly, I think it is also acceptable to retain the final modifier.
There was a problem hiding this comment.
Oh, I’m sorry, I accidentally deleted a previous conversation.
baranowb
changed the title
|
@baranowb Hi baranowb, I'm unable to view this issue: https://issues.redhat.com/browse/UNDERTOW-2451. Could you please help add me to it? |
Issue: https://issues.redhat.com/browse/UNDERTOW-2451
fix the information leakage issues