--- java/org/apache/catalina/servlets/CGIServlet.java (revision 1807314) +++ java/org/apache/catalina/servlets/CGIServlet.java (working copy) @@ -282,6 +282,12 @@ /** the shell environment variables to be passed to the CGI script */ private final Hashtable shellEnv = new Hashtable<>(); + /** enable creation of script command line arguments from query-string. + * See https://tools.ietf.org/html/rfc3875#section-4.4 + * 4.4. The Script Command Line + */ + private boolean enableCmdLineArguments = false; + /** * Sets instance variables. *

@@ -341,6 +347,9 @@ envHttpHeadersPattern = Pattern.compile(getServletConfig().getInitParameter("envHttpHeaders")); } + + enableCmdLineArguments = + Boolean.parseBoolean(config.getInitParameter("enableCmdLineArguments")); } @@ -670,9 +679,8 @@ // does not contain an unencoded "=" this is an indexed query. // The parsed query string becomes the command line parameters // for the cgi command. - if (req.getMethod().equals("GET") - || req.getMethod().equals("POST") - || req.getMethod().equals("HEAD")) { + if (enableCmdLineArguments && (req.getMethod().equals("GET") + || req.getMethod().equals("POST") || req.getMethod().equals("HEAD"))) { String qs; if (isIncluded) { qs = (String) req.getAttribute(