Return-Path: Delivered-To: apmail-tomcat-users-archive@www.apache.org Received: (qmail 52565 invoked from network); 13 Feb 2009 05:29:28 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.2) by minotaur.apache.org with SMTP; 13 Feb 2009 05:29:28 -0000 Received: (qmail 93837 invoked by uid 500); 13 Feb 2009 05:29:16 -0000 Delivered-To: apmail-tomcat-users-archive@tomcat.apache.org Received: (qmail 93811 invoked by uid 500); 13 Feb 2009 05:29:16 -0000 Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: "Tomcat Users List" Delivered-To: mailing list users@tomcat.apache.org Received: (qmail 93799 invoked by uid 99); 13 Feb 2009 05:29:15 -0000 Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 12 Feb 2009 21:29:15 -0800 X-ASF-Spam-Status: No, hits=-0.0 required=10.0 tests=SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (nike.apache.org: local policy) Received: from [72.19.170.120] (HELO www01.kensystem.com) (72.19.170.120) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 13 Feb 2009 05:29:08 +0000 Received: from 192.168.0.3 by www01.kensystem.com (SMTPD); id s20090213052843.562320; Fri, 13 Feb 2009 05:28:43 Message-ID: <4995050B.5040104@kensystem.com> Date: Thu, 12 Feb 2009 22:28:43 -0700 From: Ken Johanson User-Agent: Thunderbird 1.5.0.14 (Windows/20071210) MIME-Version: 1.0 To: Tomcat Users List Subject: Bug?: tomcat does not log reqs without c-length or transfer-encoding Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Checked: Checked by ClamAV on apache.org Hi, I noticed that requests (POST in the case) that are missing both the Content-Length and also Transfer-encoding, are not logged (as invalid) in Tomcat/6.0.18. Seems potential for stealth mis-use (DoS etc). I'm not sure of this is core or org.apache.catalina.valves.AccessLogValve (would appear to be a org/apache/coyote/http11/ Processor?) Regards, ken --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org For additional commands, e-mail: users-help@tomcat.apache.org