This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/10.1.x by this push:
new 01006516d2 Avoid CNFEs with custom managers deployed with the web
application
01006516d2 is described below
commit 01006516d258a112c1c3ae34b135ef69e3b3ace5
Author: Mark Thomas <[email protected]>
AuthorDate: Sun Mar 26 14:09:48 2023 +0100
Avoid CNFEs with custom managers deployed with the web application
---
java/org/apache/catalina/connector/Request.java | 59 ++++++++++++++-----------
webapps/docs/changelog.xml | 5 +++
2 files changed, 39 insertions(+), 25 deletions(-)
diff --git a/java/org/apache/catalina/connector/Request.java
b/java/org/apache/catalina/connector/Request.java
index b645604360..bb3089e0e8 100644
--- a/java/org/apache/catalina/connector/Request.java
+++ b/java/org/apache/catalina/connector/Request.java
@@ -2433,38 +2433,47 @@ public class Request implements HttpServletRequest {
return false;
}
- Manager manager = context.getManager();
- if (manager == null) {
- return false;
- }
-
- Session session = null;
+ /*
+ * As per PR #594, the manager could be provided by the web
application and calls to findSession() could trigger
+ * class loading so set the thread context class loader appropriately
to void ClassNotFoundException.
+ */
+ ClassLoader originalClassLoader = context.bind(null);
try {
- session = manager.findSession(requestedSessionId);
- } catch (IOException e) {
- // Can't find the session
- }
-
- if ((session == null) || !session.isValid()) {
- // Check for parallel deployment contexts
- if (getMappingData().contexts == null) {
+ Manager manager = context.getManager();
+ if (manager == null) {
return false;
- } else {
- for (int i = (getMappingData().contexts.length); i > 0; i--) {
- Context ctxt = getMappingData().contexts[i - 1];
- try {
- if (ctxt.getManager().findSession(requestedSessionId)
!= null) {
- return true;
+ }
+
+ Session session = null;
+ try {
+ session = manager.findSession(requestedSessionId);
+ } catch (IOException e) {
+ // Can't find the session
+ }
+
+ if ((session == null) || !session.isValid()) {
+ // Check for parallel deployment contexts
+ if (getMappingData().contexts == null) {
+ return false;
+ } else {
+ for (int i = (getMappingData().contexts.length); i > 0;
i--) {
+ Context ctxt = getMappingData().contexts[i - 1];
+ try {
+ if
(ctxt.getManager().findSession(requestedSessionId) != null) {
+ return true;
+ }
+ } catch (IOException e) {
+ // Ignore
}
- } catch (IOException e) {
- // Ignore
}
+ return false;
}
- return false;
}
- }
- return true;
+ return true;
+ } finally {
+ context.unbind(originalClassLoader);
+ }
}
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index ac14b072c3..b403d9f753 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -159,6 +159,11 @@
with some OSGi custom URL schemes that can trigger potentially slow DNS
lookups in some configurations. (markt)
</fix>
+ <fix>
+ When using a custom session manager deployed as part of the web
+ application, avoid <code>ClassNotFoundException</code>s when validating
+ session IDs extracted from requests. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
