Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=49657

Correctly handle CGI executables with spaces in the name/path

git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1002185 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/java/org/apache/catalina/servlets/CGIServlet.java b/java/org/apache/catalina/servlets/CGIServlet.java
index 012b9c5..316b918 100644 (file)
--- a/java/org/apache/catalina/servlets/CGIServlet.java
+++ b/java/org/apache/catalina/servlets/CGIServlet.java
@@ -1576,38 +1576,20 @@ public final class CGIServlet extends HttpServlet {
             Process proc = null;
             int bufRead = -1;
 
-            //create query arguments
-            StringBuilder cmdAndArgs = new StringBuilder();
-            if (command.indexOf(" ") < 0) {
-                cmdAndArgs.append(command);
-            } else {
-                // Spaces used as delimiter, so need to use quotes
-                cmdAndArgs.append("\"");
-                cmdAndArgs.append(command);
-                cmdAndArgs.append("\"");
-            }
+            String[] cmdAndArgs = new String[params.size() + 2];
+            
+            cmdAndArgs[0] = cgiExecutable;
+            
+            cmdAndArgs[1] = command;
 
+            //create query arguments
             for (int i=0; i < params.size(); i++) {
-                cmdAndArgs.append(" ");
-                String param = params.get(i);
-                if (param.indexOf(" ") < 0) {
-                    cmdAndArgs.append(param);
-                } else {
-                    // Spaces used as delimiter, so need to use quotes
-                    cmdAndArgs.append("\"");
-                    cmdAndArgs.append(param);
-                    cmdAndArgs.append("\"");
-                }
+                cmdAndArgs[i + 2] = params.get(i);
             }
 
-            StringBuilder command = new StringBuilder(cgiExecutable);
-            command.append(" ");
-            command.append(cmdAndArgs.toString());
-            cmdAndArgs = command;
-
             try {
                 rt = Runtime.getRuntime();
-                proc = rt.exec(cmdAndArgs.toString(), hashToStringArray(env), wd);
+                proc = rt.exec(cmdAndArgs, hashToStringArray(env), wd);
     
                 String sContentLength = env.get("CONTENT_LENGTH");
 

diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 48a4284..a869ad8 100644 (file)
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -58,6 +58,10 @@
         Sylvain Laurent.
       </fix>
       <fix>
+        <bug>49657</bug>: Handle CGI executables with spaces in the path.
+        (markt)
+      </fix>
+      <fix>
         <bug>49670</bug>: Restore SSO functionality that was broken by Lifecycle
         refactoring. (markt)
       </fix>