Hello Tomcat developers,
I'm building a static analysis tool to automatically detect a certain class
of errors and am trying it on tomcat 6.0.1-alpha (sources downloaded from
http://tomcat.apache.org/download-60.cgi.)

I wonder if in the piece of code below, which responds with an error if a
jsp page doesn't exist, the second argument to response.sendError() is
intentionally the jspUri. In particular, in most other places in the code,
the second argument to sendError() is some user-understandable error message
typically obtained from a StringManager. Is it intended to give the JSP URI
as the sendError message in this case ? All versions of tomcat sources that
I have looked at including 5.5.x and 4.1.31 seem to have code similar to the
extract below.

Thanks in advance for any comments regarding this potential issue.
Thanks,

Sudheendra


apache-tomcat-6.0.1-src/java/org/apache/jasper/servlet/JspServlet.java:
...
 private void serviceJspFile(HttpServletRequest request,

                               HttpServletResponse response, String jspUri,
                               Throwable exception, boolean precompile)
       throws ServletException, IOException {

       JspServletWrapper wrapper =
           (JspServletWrapper) rctxt.getWrapper(jspUri);
       if (wrapper == null) {
           synchronized(this) {
               wrapper = (JspServletWrapper) rctxt.getWrapper(jspUri);
               if (wrapper == null) {
                   // Check if the requested JSP page exists, to avoid
                   // creating unnecessary directories and files.
                   if (null == context.getResource(jspUri)) {
                       response.sendError(HttpServletResponse.SC_NOT_FOUND,
                                          jspUri);
                       return;
                   }
...
       wrapper.service(request, response, precompile);

   }

Reply via email to