Backport for CVE-2023-46589

java/org/apache/catalina/connector/ClientAbortException.java

@@ -16,15 +16,15 @@
  */
 package org.apache.catalina.connector;
 
-import java.io.IOException;
+import org.apache.coyote.BadRequestException;
 
 /**
  * Extend IOException to identify it as being caused by an abort of a request by
  * a remote client.
  *
  * @author Glenn L. Nielsen
  */
-public final class ClientAbortException extends IOException {
+public final class ClientAbortException extends BadRequestException {
 
     private static final long serialVersionUID = 1L;
 

java/org/apache/catalina/connector/InputBuffer.java

@@ -29,10 +29,11 @@
 import java.util.concurrent.ConcurrentHashMap;
 
 import jakarta.servlet.ReadListener;
+import jakarta.servlet.RequestDispatcher;
 
 import org.apache.catalina.security.SecurityUtil;
 import org.apache.coyote.ActionCode;
-import org.apache.coyote.Request;
+import org.apache.coyote.BadRequestException;
 import org.apache.juli.logging.Log;
 import org.apache.juli.logging.LogFactory;
 import org.apache.tomcat.util.buf.B2CConverter;
@@ -108,7 +109,7 @@ public class InputBuffer extends Reader
     /**
      * Associated Coyote request.
      */
-    private Request coyoteRequest;
+    private org.apache.coyote.Request coyoteRequest;
 
 
     /**
@@ -167,7 +168,7 @@ public InputBuffer(int size) {
      *
      * @param coyoteRequest Associated Coyote request
      */
-    public void setRequest(Request coyoteRequest) {
+    public void setRequest(org.apache.coyote.Request coyoteRequest) {
         this.coyoteRequest = coyoteRequest;
     }
 
@@ -215,8 +216,7 @@ public void close() throws IOException {
     public int available() {
         int available = availableInThisBuffer();
         if (available == 0) {
-            coyoteRequest.action(ActionCode.AVAILABLE,
-                    Boolean.valueOf(coyoteRequest.getReadListener() != null));
+            coyoteRequest.action(ActionCode.AVAILABLE, Boolean.valueOf(coyoteRequest.getReadListener() != null));
             available = (coyoteRequest.getAvailable() > 0) ? 1 : 0;
         }
         return available;
@@ -314,15 +314,30 @@ public int realReadBytes() throws IOException {
 
         try {
             return coyoteRequest.doRead(this);
+        } catch (BadRequestException bre) {
+            // Make the exception visible to the application
+            handleReadException(bre);
+            throw bre;
         } catch (IOException ioe) {
-            coyoteRequest.setErrorException(ioe);
-            // An IOException on a read is almost always due to
-            // the remote client aborting the request.
+            handleReadException(ioe);
+            // Any other IOException on a read is almost always due to the remote client aborting the request.
+            // Make the exception visible to the application
             throw new ClientAbortException(ioe);
         }
     }
 
 
+    private void handleReadException(Exception e) throws IOException {
+        // Set flag used by asynchronous processing to detect errors on non-container threads
+        coyoteRequest.setErrorException(e);
+        // In synchronous processing, this exception may be swallowed by the application so set error flags here.
+        Request request = (Request) coyoteRequest.getNote(CoyoteAdapter.ADAPTER_NOTES);
+        Response response = request.getResponse();
+        request.setAttribute(RequestDispatcher.ERROR_EXCEPTION, e);
+        response.sendError(400);
+    }
+
+
     public int readByte() throws IOException {
         throwIfClosed();
 

java/org/apache/catalina/core/ApplicationDispatcher.java

@@ -41,11 +41,11 @@
 import org.apache.catalina.Context;
 import org.apache.catalina.Globals;
 import org.apache.catalina.Wrapper;
-import org.apache.catalina.connector.ClientAbortException;
 import org.apache.catalina.connector.Request;
 import org.apache.catalina.connector.RequestFacade;
 import org.apache.catalina.connector.Response;
 import org.apache.catalina.connector.ResponseFacade;
+import org.apache.coyote.BadRequestException;
 import org.apache.tomcat.util.ExceptionUtils;
 import org.apache.tomcat.util.res.StringManager;
 
@@ -691,7 +691,7 @@ private void invoke(ServletRequest request, ServletResponse response,
                filterChain.doFilter(request, response);
              }
             // Servlet Service Method is called by the FilterChain
-        } catch (ClientAbortException e) {
+        } catch (BadRequestException e) {
             ioException = e;
         } catch (IOException e) {
             wrapper.getLogger().error(sm.getString("applicationDispatcher.serviceException",
@@ -704,9 +704,9 @@ private void invoke(ServletRequest request, ServletResponse response,
             wrapper.unavailable(e);
         } catch (ServletException e) {
             Throwable rootCause = StandardWrapper.getRootCause(e);
-            if (!(rootCause instanceof ClientAbortException)) {
-                wrapper.getLogger().error(sm.getString("applicationDispatcher.serviceException",
-                        wrapper.getName()), rootCause);
+            if (!(rootCause instanceof BadRequestException)) {
+                wrapper.getLogger().error(sm.getString("applicationDispatcher.serviceException", wrapper.getName()),
+                        rootCause);
             }
             servletException = e;
         } catch (RuntimeException e) {

java/org/apache/catalina/core/StandardHostValve.java

@@ -317,11 +317,14 @@ protected void throwable(Request request, Response response,
                 }
             }
         } else {
-            // A custom error-page has not been defined for the exception
-            // that was thrown during request processing. Check if an
-            // error-page for error code 500 was specified and if so,
-            // send that page back as the response.
-            response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+            /*
+             *  A custom error-page has not been defined for the exception that was thrown during request processing.
+             *  Set the status to 500 if an error status has not already been set and check for custom error-page for
+             *  the status.
+             */
+            if (response.getStatus() < HttpServletResponse.SC_BAD_REQUEST) {
+                response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+            }
             // The response is an error
             response.setError();