Hello,

Prior to Tomcat 8.5.15 if the Content-Type request header specifies an
invalid charset, then the HttpServletRequest.getReader() throws a
UnsupportedEncodingException (from its javadoc:it should throw such an
exception if the character set encoding used is not supported and the text
cannot be decoded).

However, in Tomcat 8.5.15, with change
https://github.com/apache/tomcat85/commit/18e70aff0fd3e9195d2bf01e445c49ea9fd44d0b
this exception is silently ignored
(in org.apache.coyote.Request.getCharsetFromContentType() ) and then the
default charset is used (in
org.apache.catalina.connector.InputBuffer.checkConverter()).

According to Servlet 3.1 specification, 3.11, the default charset should be
used if the client does not specify a charset in the request.

Is this change of behavior in 8.5.15 intentional?

Regards,
Lazar

Reply via email to