(tomcat) branch 11.0.x updated: Similar fix for restrictedUserAgents

This is an automated email from the ASF dual-hosted git repository.

rmaucher pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/11.0.x by this push:
     new 8475f6f8e1 Similar fix for restrictedUserAgents
8475f6f8e1 is described below

commit 8475f6f8e17a6b55ad6d104623b6d515ea7f3e79
Author: remm <[email protected]>
AuthorDate: Fri Jul 31 13:36:01 2026 +0200

    Similar fix for restrictedUserAgents
    
    Coauthored with OpenCode.
---
 java/org/apache/coyote/http11/Http11Processor.java |  2 +-
 .../apache/coyote/http11/TestHttp11Processor.java  | 35 ++++++++++++++++++++++
 webapps/docs/changelog.xml                         |  6 ++++
 3 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/java/org/apache/coyote/http11/Http11Processor.java b/java/org/apache/coyote/http11/Http11Processor.java
index a5a566e337..0305cc7f02 100644
--- a/java/org/apache/coyote/http11/Http11Processor.java
+++ b/java/org/apache/coyote/http11/Http11Processor.java
@@ -672,7 +672,7 @@ public class Http11Processor extends AbstractProcessor {
             // and keepAlive flags accordingly
             if (userAgentValueMB != null && !userAgentValueMB.isNull()) {
                 String userAgentValue = userAgentValueMB.toString();
-                if (restrictedUserAgents.matcher(userAgentValue).matches()) {
+                if (restrictedUserAgents.matcher(userAgentValue).find()) {
                     http11 = false;
                     keepAlive = false;
                 }
diff --git a/test/org/apache/coyote/http11/TestHttp11Processor.java b/test/org/apache/coyote/http11/TestHttp11Processor.java
index fd77108f0d..b1db3dfe7e 100644
--- a/test/org/apache/coyote/http11/TestHttp11Processor.java
+++ b/test/org/apache/coyote/http11/TestHttp11Processor.java
@@ -2201,4 +2201,39 @@ public class TestHttp11Processor extends TomcatBaseTest {
         Assert.assertTrue(newEncodings.contains("br"));
         Assert.assertFalse(newEncodings.contains("gzip"));
     }
+
+    @Test
+    public void testRestrictedUserAgents() throws Exception {
+        Tomcat tomcat = getTomcatInstance();
+
+        // No file system docBase required
+        Context ctx = getProgrammaticRootContext();
+
+        Tomcat.addServlet(ctx, "TesterServlet", new TesterServlet());
+        ctx.addServletMappingDecoded("/*", "TesterServlet");
+
+        // Set restricted user agents to match "MSIE"
+        Assert.assertTrue(tomcat.getConnector().setProperty("restrictedUserAgents", "gorilla|desesplorer|MSIE|tigrus"));
+
+        tomcat.start();
+
+        // User-agent matching the pattern should be downgraded to HTTP/1.0
+        // @formatter:off
+        String request =
+                "GET /test HTTP/1.1" + CRLF +
+                "Host: any" + CRLF +
+                "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" + CRLF +
+                CRLF;
+        // @formatter:on
+
+        Client client = new Client(tomcat.getConnector().getLocalPort());
+        client.setRequest(new String[] { request });
+
+        client.connect();
+        client.processRequest();
+
+        // Should be downgraded to HTTP/1.0, although the server will still advertise HTTP/1.1
+        Assert.assertTrue(client.isResponse200());
+        Assert.assertTrue(client.getResponseHeaders().contains("Connection: close"));
+    }
 }
\ No newline at end of file
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index d828671c27..9732f89ba6 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -196,6 +196,12 @@
         of the example <code>gorilla|desesplorer|tigrus</code> pattern
         documented in the javadoc. (remm)
       </fix>
+      <fix>
+        Fix matching the HTTP/1.1 connector
+        <code>restrictedUserAgents</code> with patterns of the style
+        of the example <code>gorilla|desesplorer|tigrus</code> pattern
+        documented in the javadoc. (remm)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Jasper">