WebDAV servlet returns 500 if files not readable

2009-12-01 Thread Martin Carpenter

Hello,

I have an issue with the standard WebDAV servlet bundled with Tomcat 5.5
and 6.0 (tested 5.5.26 and 6.0.20) that is causing me some pain. If a
directory contains a file that is not readable by the tomcat process (eg
file permissions, dangling symlink) then TC throws a NullPointerException
and returns a 500 Internal Server Error to the client. I think this
is incorrect behavior and that it should at least list the files in a
directory even if they are not all accessible to the user.

I couldn't see this issue reported in the BugZilla or on this list.

Stack:

SEVERE: Servlet.service() for servlet webdav threw exception
java.lang.NullPointerException
at 
org.apache.catalina.servlets.WebdavServlet.parseProperties(Unknown Source)
at org.apache.catalina.servlets.WebdavServlet.doPropfind(Unknown 
Source)
at org.apache.catalina.servlets.WebdavServlet.service(Unknown 
Source)
at javax.servlet.http.HttpServlet.service(Unknown Source)
...


Method parseProperties() is in
java/org/apache/catalina/servlets/WebdavServlet.java.org and the NPE
happens when cacheEntry.attributes is null (case FIND_BY_PROPERTY in my
testing and possibly in other cases too).

Following the breadcrumbs via:

cacheEntry = resources.lookupCache(path);

leads eventually to java/org/apache/naming/resources/FileDirContext.java:

public Attributes getAttributes(String name, String[] attrIds)
throws NamingException {
// Building attribute list
File file = file(name);
if (file == null)
throw new NamingException
(sm.getString("resources.notFound", name));
...
protected File file(String name) {
File file = new File(base, name);
if (file.exists() && file.canRead()) {
... // do useful stuff
} else {
return null; // ouch
}


I see two potential fixes (but I'm not at all familiar with the
codebase):

1. Add lots of guard statements into caller parseProperties():

if(cacheEntry.attributes == null) {
propertiesNotFound.addElement(property);
} else {
...

This is ugly and repetitive. There is already something like this for
cacheEntry.context and I can make this strategy work but adding more
code like this feels wrong.


2. Fix FileDirContext.file() to make it do as much as possible even
when exists()/canRead() return false.  Alternatively, do something
with/other than throwing NamingException when file() returns null.

This seems like a better solution but I worry about other dependencies on
the existing behaviour. How is test coverage?


Any other advice on how best to solve this appreciated!

Thanks,

Martin.



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



Re: WebDAV servlet returns 500 if files not readable

2009-12-01 Thread Mark Thomas
Martin Carpenter wrote:
> Hello,
> 
> I have an issue with the standard WebDAV servlet bundled with Tomcat 5.5
> and 6.0 (tested 5.5.26 and 6.0.20) that is causing me some pain. If a
> directory contains a file that is not readable by the tomcat process (eg
> file permissions, dangling symlink) then TC throws a NullPointerException
> and returns a 500 Internal Server Error to the client. I think this
> is incorrect behavior and that it should at least list the files in a
> directory even if they are not all accessible to the user.
> 
> I couldn't see this issue reported in the BugZilla or on this list.

Please create a new issue.

> This seems like a better solution but I worry about other dependencies on
> the existing behaviour. How is test coverage?

Tomcat unit tests are non-existent for this. I tend to use the litmus
test suite for WebDAV testing.

> Any other advice on how best to solve this appreciated!

I'm tempted to say any inaccessible file should just be ignored.
However, that could cause issues if a user tries to upload a file of
that name. Certainly, any such configuration isn't valid so returning an
error to the user and logging an error isn't too unreasonable. Maybe
better error reporting is the way to go with this one.

Mark




-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r885770 - in /tomcat/trunk: java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java webapps/docs/config/http.xml

2009-12-01 Thread markt
Author: markt
Date: Tue Dec  1 14:34:55 2009
New Revision: 885770

URL: http://svn.apache.org/viewvc?rev=885770&view=rev
Log:
Provide a simple way of enabling all cipher suites when testing.

Modified:
tomcat/trunk/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java
tomcat/trunk/webapps/docs/config/http.xml

Modified: 
tomcat/trunk/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java?rev=885770&r1=885769&r2=885770&view=diff
==
--- tomcat/trunk/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java 
(original)
+++ tomcat/trunk/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java 
Tue Dec  1 14:34:55 2009
@@ -92,6 +92,7 @@
 = System.getProperty("user.home") + "/.keystore";
 private static final int defaultSessionCacheSize = 0;
 private static final int defaultSessionTimeout = 86400;
+private static final String ALLOW_ALL_SUPPORTED_CIPHERS = "ALL";
 public static final String DEFAULT_KEY_PASS = "changeit";
 
 static final org.apache.juli.logging.Log log =
@@ -190,6 +191,10 @@
 
 String[] result = null;
 
+if (ALLOW_ALL_SUPPORTED_CIPHERS.equals(requestedCiphers)) {
+return supportedCiphers;
+}
+
 if (requestedCiphers != null) {
 Vector vec = null;
 String cipher = requestedCiphers;

Modified: tomcat/trunk/webapps/docs/config/http.xml
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/webapps/docs/config/http.xml?rev=885770&r1=885769&r2=885770&view=diff
==
--- tomcat/trunk/webapps/docs/config/http.xml (original)
+++ tomcat/trunk/webapps/docs/config/http.xml Tue Dec  1 14:34:55 2009
@@ -742,7 +742,9 @@
   allowed to use. By default, the default ciphers for the JVM will be used.
   Note that this usually means that the weak export grade ciphers will be
   included in the list of available ciphers. The ciphers are specified 
using
-  the JSSE cipher naming convention.
+  the JSSE cipher naming convention. The special value of ALL
+  will enable all supported ciphers. This will include many that are not
+  secure. ALL is intended for testing purposes only.
 
 
 



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



[Tomcat Wiki] Update of "OutOfMemory" by markt

2009-12-01 Thread Apache Wiki
Dear Wiki user,

You have subscribed to a wiki page or wiki category on "Tomcat Wiki" for change 
notification.

The "OutOfMemory" page has been changed by markt.
The comment on this change is: Remove some nonsense. Replace it with more 
useful content..
http://wiki.apache.org/tomcat/OutOfMemory?action=diff&rev1=9&rev2=10

--

  An Out Of Memory can be thrown by several causes:
  
   * A servlet trying to load a several GBytes file into memory will surely 
kill the server. These kind of errors must be considered a simple bug in our 
program.
-  * To compensate for the data your servlet tries to load, you increase the 
heap size so that there is no room to create the stack size for the threads 
that need to be created.  Each thread takes 2M and in some OS's (like Debian 
Sarge) is not reducible with the -Xss parameter. 
[[http://goobsoft.homeip.net/Wiki.jsp?page=JavaDebianTuning|1]]  Rule of Thumb, 
use no more than 1G for heap space in a 32-bit web application.
+  * To compensate for the data your servlet tries to load, you increase the 
heap size so that there is no room to create the stack size for the threads 
that need to be created.  The memory required by each thread will vary by OS 
but can be as high as 2M by default and in some OS's (like Debian Sarge) is not 
reducible with the -Xss parameter. 
[[http://goobsoft.homeip.net/Wiki.jsp?page=JavaDebianTuning|1]]  Rule of Thumb, 
use no more than 1G for heap space in a 32-bit web application.
   * Deep recursive algorithms can also lead to Out Of Memory problems. In this 
case, the only fixes are increasing the thread stack size ({{{-Xss}}}), or 
refactoring the algorithms to reduce the depth, or the local data size per call.
   * A webapp that uses lots of libraries with many dependencies, or a server 
maintaining lots of webapps could exhauste the JVM PermGen space. This space is 
where the VM stores the classes and methods data. In those cases, the fix is to 
increase this size. The Sun VM has the flag {{{-XX:MaxPermSize}}} that allows 
to set its size (the default value is 64M)
   * Hard references to classes can prevent the garbage collector from 
reclaiming the memory allocated for them when a ClassLoader is discarded. This 
will occur on JSP recompilations, and webapps reloads. If these operations are 
common in a webapp having these kinds of problems, it will be a matter of time, 
until the PermGen space gets full and an Out Of Memory is thrown.
@@ -29, +29 @@

  
  == Threads ==
  
- No other threads started in the servlet must run. Otherwise they keep local 
variables, their classes and the whole class loader hard referenced.
+ Any threads a web application starts, a web application should stop. 
!ServletContextListener is your friend. Note Tomcat 7 will warn you if you do 
this and will also provide a (highly dangerous - use at your own risk) option 
to terminate the threads.
  
  == DriverManager ==
  
- If you load a java.sql.Driver in your own classloader (or servlets), the 
driver should be removed before undeploying. Each driver is registered in 
!DriverManager which is loaded in system classloader and references the local 
driver.
+ If you load a java.sql.Driver in your own classloader (or servlets), the 
driver should be removed before undeploying. Each driver is registered in 
!DriverManager which is loaded in system classloader and references the local 
driver. Note Tomcat will do this for you if you forget.
  
  {{{
  Enumeration drivers = DriverManager.getDrivers();
@@ -49, +49 @@

  }
  }}}
  
- == The Singleton Pattern ==
+ == ThreadLocal ==
  
- This is a VERY used pattern in many java programs. It works safe and sound in 
any standalone application, and it looks something like:
+ The lifecycle of a !ThreadLocal should match that of a request. There is no 
guarantee that a thread will ever be used to process a request again so if a 
!ThreadLocal is left on the thread at the end of the request there may be no 
opportunity for the web application to clean it up. Note Tomcat 7 will do this 
for you.
  
+ == ContextClassLoader ==
- {{{
- public class MyClass {
-   private static final MyClass instance = new MyClass();
  
+ There are various parts of the Java API that retain a permanent reference to 
the context class loader. If this happens to be a web application class loader 
then a memory leak will occur. Tomcat provides 
[[http://svn.apache.org/repos/asf/tomcat/trunk/java/org/apache/catalina/core/JreMemoryLeakPreventionListener.java|workarounds]]
 for these where known but there are undoubtedly others.
-   public static MyClass getInstance() {
- return instance;
-   }
  
+ == Logging Frameworks ==
-   private MyClass() { }
- }
- }}}
  
- The problem with this pattern is that it creates a hard reference to a class 
instance into the class itself. As long as this instance is not released, the 
class will not be unloadable. At the end, this leads t

DO NOT REPLY [Bug 48318] New: WebDAV servlet returns 500 if files not readable

2009-12-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=48318

   Summary: WebDAV servlet returns 500 if files not readable
   Product: Tomcat 6
   Version: 6.0.20
  Platform: All
OS/Version: All
Status: NEW
  Severity: normal
  Priority: P2
 Component: Servlet & JSP API
AssignedTo: dev@tomcat.apache.org
ReportedBy: mcarpen...@free.fr


If a directory contains a file that is not readable by the Tomcat
process (eg file permissions, dangling symlink) then Tomcat throws a
NullPointerException and returns a 500 Internal Server Error to the
client.

Throwing NPE in these circumstances is certainly wrong.  Returning 500
with no further information is unhelpful behavior and should be fixed.
Generally, interfaces of this type at least list inaccessible files
(Windows Explorer, UNIX ls(1), BSD FTP client, ...) and only return an
error when one attempts to access such a file.

markt suggests an alternative of simply ignoring inaccessible files but notes
that "could cause issues if a user tries to upload a file of that name" and
suggests better error reporting.


Stack:

SEVERE: Servlet.service() for servlet webdav threw exception
java.lang.NullPointerException
at
org.apache.catalina.servlets.WebdavServlet.parseProperties(Unknown Source)
at org.apache.catalina.servlets.WebdavServlet.doPropfind(Unknown
Source)
at org.apache.catalina.servlets.WebdavServlet.service(Unknown
Source)
at javax.servlet.http.HttpServlet.service(Unknown Source)
...


Method parseProperties() is in
java/org/apache/catalina/servlets/WebdavServlet.java.org and the NPE
happens when cacheEntry.attributes is null (case FIND_BY_PROPERTY in my
testing and possibly in other cases too).

Following the breadcrumbs via:

cacheEntry = resources.lookupCache(path);

leads eventually to java/org/apache/naming/resources/FileDirContext.java:

public Attributes getAttributes(String name, String[] attrIds)
throws NamingException {
// Building attribute list
File file = file(name);
if (file == null)
throw new NamingException
(sm.getString("resources.notFound", name));
...
protected File file(String name) {
File file = new File(base, name);
if (file.exists() && file.canRead()) {
... // do useful stuff
} else {
return null; // ouch
}

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r885860 - in /tomcat/trunk: java/org/apache/catalina/core/JreMemoryLeakPreventionListener.java java/org/apache/catalina/core/LocalStrings.properties webapps/docs/config/listeners.xml

2009-12-01 Thread markt
Author: markt
Date: Tue Dec  1 18:44:32 2009
New Revision: 885860

URL: http://svn.apache.org/viewvc?rev=885860&view=rev
Log:
More memory leak protection - this time for the GC Daemon thread.

Modified:

tomcat/trunk/java/org/apache/catalina/core/JreMemoryLeakPreventionListener.java
tomcat/trunk/java/org/apache/catalina/core/LocalStrings.properties
tomcat/trunk/webapps/docs/config/listeners.xml

Modified: 
tomcat/trunk/java/org/apache/catalina/core/JreMemoryLeakPreventionListener.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/core/JreMemoryLeakPreventionListener.java?rev=885860&r1=885859&r2=885860&view=diff
==
--- 
tomcat/trunk/java/org/apache/catalina/core/JreMemoryLeakPreventionListener.java 
(original)
+++ 
tomcat/trunk/java/org/apache/catalina/core/JreMemoryLeakPreventionListener.java 
Tue Dec  1 18:44:32 2009
@@ -18,6 +18,8 @@
 package org.apache.catalina.core;
 
 import java.io.IOException;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
 import java.net.MalformedURLException;
 import java.net.URL;
 import java.net.URLConnection;
@@ -80,7 +82,7 @@
 /**
  * XML parsing can pin a web application class loader in memory. This is
  * particularly nasty as profilers (at least YourKit and Eclispe MAT) don't
- * idenitfy any GC roots related to this. 
+ * identify any GC roots related to this. 
  */
 private boolean xmlParsingProtection = true;
 public boolean isXmlParsingProtection() { return xmlParsingProtection; }
@@ -88,6 +90,19 @@
 this.xmlParsingProtection = xmlParsingProtection;
 }
 
+/**
+ * Protect against the memory leak caused when the first call to
+ * sun.misc.GC.requestLatency(long) is triggered by a web
+ * application. This first call will start a GC Daemon thread with the
+ * thread's context class loader configured to be the web application class
+ * loader. Defaults to true.
+ */
+private boolean gcDaemonProtection = true;
+public boolean isGcDaemonProtection() { return gcDaemonProtection; }
+public void setGcDaemonProtection(boolean gcDaemonProtection) {
+this.gcDaemonProtection = gcDaemonProtection;
+}
+
 @Override
 public void lifecycleEvent(LifecycleEvent event) {
 // Initialise these classes when Tomcat starts
@@ -150,8 +165,36 @@
 try {
 factory.newDocumentBuilder();
 } catch (ParserConfigurationException e) {
-log.error(sm.getString(
-"jreLeakListener.xmlParseFail"), e);
+log.error(sm.getString("jreLeakListener.xmlParseFail"), e);
+}
+}
+
+/*
+ * Several components end up calling:
+ * sun.misc.GC.requestLatency(long)
+ * 
+ * Those libraries / components known to trigger memory leaks due 
to
+ * eventual calls to requestLatency(long) are:
+ * - javax.management.remote.rmi.RMIConnectorServer.start()
+ */
+if (gcDaemonProtection) {
+try {
+Class clazz = Class.forName("sun.misc.GC");
+Method method = clazz.getDeclaredMethod("requestLatency",
+new Class[] {long.class});
+method.invoke(null, Long.valueOf(360));
+} catch (ClassNotFoundException e) {
+log.error(sm.getString("jreLeakListener.gcDaemonFail"), e);
+} catch (SecurityException e) {
+log.error(sm.getString("jreLeakListener.gcDaemonFail"), e);
+} catch (NoSuchMethodException e) {
+log.error(sm.getString("jreLeakListener.gcDaemonFail"), e);
+} catch (IllegalArgumentException e) {
+log.error(sm.getString("jreLeakListener.gcDaemonFail"), e);
+} catch (IllegalAccessException e) {
+log.error(sm.getString("jreLeakListener.gcDaemonFail"), e);
+} catch (InvocationTargetException e) {
+log.error(sm.getString("jreLeakListener.gcDaemonFail"), e);
 }
 }
 }

Modified: tomcat/trunk/java/org/apache/catalina/core/LocalStrings.properties
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/core/LocalStrings.properties?rev=885860&r1=885859&r2=885860&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/core/LocalStrings.properties 
(original)
+++ tomcat/trunk/java/org/apache/catalina/core/LocalStrings.properties Tue Dec  
1 18:44:32 2009
@@ -65,6 +65,7 @@
 httpHostMapper.container=This container is not a StandardHost
 interceptorValve.alreadyStarted=InterceptorValv

DO NOT REPLY [Bug 48319] Httpd(version: 2.2.6) process crashed on solaris (under load testing)

2009-12-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=48319

Rainer Jung  changed:

   What|Removed |Added

  Component|APR |mod_jk
 AssignedTo|b...@apr.apache.org |dev@tomcat.apache.org
Product|APR |Tomcat Connectors

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r885889 - in /tomcat/trunk: java/org/apache/catalina/core/ java/org/apache/catalina/loader/ webapps/docs/config/

2009-12-01 Thread markt
Author: markt
Date: Tue Dec  1 19:33:44 2009
New Revision: 885889

URL: http://svn.apache.org/viewvc?rev=885889&view=rev
Log:
Move from a global system property to a per Context attribute for clearing 
static references.
Change the default as this should no longer be an issue with modern JVMs and 
the other memory leak protection provided in Tomcat 7.

Modified:
tomcat/trunk/java/org/apache/catalina/core/StandardContext.java
tomcat/trunk/java/org/apache/catalina/loader/WebappClassLoader.java
tomcat/trunk/java/org/apache/catalina/loader/WebappLoader.java
tomcat/trunk/webapps/docs/config/context.xml
tomcat/trunk/webapps/docs/config/systemprops.xml

Modified: tomcat/trunk/java/org/apache/catalina/core/StandardContext.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/core/StandardContext.java?rev=885889&r1=885888&r2=885889&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/core/StandardContext.java (original)
+++ tomcat/trunk/java/org/apache/catalina/core/StandardContext.java Tue Dec  1 
19:33:44 2009
@@ -711,13 +711,13 @@
 /**
  * Attribute value used to turn on/off XML validation
  */
- private boolean tldValidation = false;
+private boolean tldValidation = false;
 
 
 /**
  * Attribute value used to turn on/off TLD XML namespace validation
  */
- private boolean tldNamespaceAware = false;
+private boolean tldNamespaceAware = false;
 
 
 /**
@@ -736,8 +736,17 @@
  */
 private JarScanner jarScanner = null;
 
-
-
+/**
+ * Should Tomcat attempt to null out any static or final fields from loaded
+ * classes when a web application is stopped as a work around for apparent
+ * garbage collection bugs and application coding errors. There have been
+ * some issues reported with log4j when this option is true. Applications
+ * without memory leaks using recent JVMs should operate correctly with 
this
+ * option set to false. If not specified, the default value of
+ * false will be used. 
+ */
+private boolean clearReferencesStatic = false;
+
 // - Context Properties
 
 
@@ -2069,6 +2078,32 @@
 }
 
 
+/**
+ * Return the clearReferencesStatic flag for this Context.
+ */
+public boolean getClearReferencesStatic() {
+
+return (this.clearReferencesStatic);
+
+}
+
+
+/**
+ * Set the clearReferencesStatic feature for this Context.
+ *
+ * @param clearReferencesStatic The new flag value
+ */
+public void setClearReferencesStatic(boolean clearReferencesStatic) {
+
+boolean oldClearReferencesStatic = this.clearReferencesStatic;
+this.clearReferencesStatic = clearReferencesStatic;
+support.firePropertyChange("clearReferencesStatic",
+   oldClearReferencesStatic,
+   this.clearReferencesStatic);
+
+}
+
+
 //  Context Methods
 
 

Modified: tomcat/trunk/java/org/apache/catalina/loader/WebappClassLoader.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/loader/WebappClassLoader.java?rev=885889&r1=885888&r2=885889&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/loader/WebappClassLoader.java 
(original)
+++ tomcat/trunk/java/org/apache/catalina/loader/WebappClassLoader.java Tue Dec 
 1 19:33:44 2009
@@ -119,9 +119,6 @@
 private static final List JVM_THREAD_GROUP_NAMES =
 new ArrayList();
 
-public static final boolean ENABLE_CLEAR_REFERENCES = 
-
Boolean.valueOf(System.getProperty("org.apache.catalina.loader.WebappClassLoader.ENABLE_CLEAR_REFERENCES",
 "true")).booleanValue();
-
 static {
 JVM_THREAD_GROUP_NAMES.add("system");
 JVM_THREAD_GROUP_NAMES.add("RMI Runtime");
@@ -411,6 +408,17 @@
 protected Permission allPermission = new java.security.AllPermission();
 
 
+/**
+ * Should Tomcat attempt to null out any static or final fields from loaded
+ * classes when a web application is stopped as a work around for apparent
+ * garbage collection bugs and application coding errors. There have been
+ * some issues reported with log4j when this option is true. Applications
+ * without memory leaks using recent JVMs should operate correctly with 
this
+ * option set to false. If not specified, the default value of
+ * false will be used. 
+ */
+private boolean clearReferencesStatic = false;
+
 // - Properties
 
 
@@ -564,6 +572,25 @@
  parent = pcl;
  }
 
+ /**
+  * Return the clearReferencesStatic flag for this Context.
+  */
+ public boolean getClearReferencesStatic() {

DO NOT REPLY [Bug 48322] New: Reading a cookie with an apostrophe in the value is truncated in Tomcat 6.0.20 and 6.0.18

2009-12-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=48322

   Summary: Reading a cookie with an apostrophe in the value is
truncated in Tomcat 6.0.20 and 6.0.18
   Product: Tomcat 6
   Version: 6.0.20
  Platform: PC
OS/Version: Linux
Status: NEW
  Severity: regression
  Priority: P2
 Component: Catalina
AssignedTo: dev@tomcat.apache.org
ReportedBy: rob...@cosmicrealms.com


Created an attachment (id=24654)
 --> (https://issues.apache.org/bugzilla/attachment.cgi?id=24654)
Simple JSP that reproduces the issue

If you set a cookie in a JSP that has an apostrophe in the value, reading that
cookie in subsequent loads truncates at the apostrophe.

Reading the cookie fails even if the cookie was set client side or was
pre-existing.

I've attached a very simple testcase.jsp page

Visit the page more than once.

What you see in 6.0.14:
Server side cookie value [test'ing] 

What you see in 6.0.18 and 6.0.20:
Server side cookie value [test]


In all three tested tomcat versions, if you view your cookies in your browser,
you'll correctly see it has been set to "test'ing"

Likewise if you inspect the HTTP headers being returned you correctly see:
Set-Cookie: testcookie=test'ing



Something changed after 6.0.14 that causes cookies with apostrophes when read
server side to be truncated.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r885901 - in /tomcat/trunk: java/org/apache/catalina/core/ java/org/apache/catalina/loader/ webapps/docs/config/

2009-12-01 Thread markt
Author: markt
Date: Tue Dec  1 20:04:17 2009
New Revision: 885901

URL: http://svn.apache.org/viewvc?rev=885901&view=rev
Log:
More memory leak protection. Adds support for:
 - optionally stopping threads started by a web app - this is dangerous last 
resort option for dev environments - not for production
 - clearing ThreadLocals created buy web apps
 - clearing unintentional references in sun.rmi.transport.Target

Modified:
tomcat/trunk/java/org/apache/catalina/core/StandardContext.java
tomcat/trunk/java/org/apache/catalina/loader/LocalStrings.properties
tomcat/trunk/java/org/apache/catalina/loader/WebappClassLoader.java
tomcat/trunk/java/org/apache/catalina/loader/WebappLoader.java
tomcat/trunk/webapps/docs/config/context.xml

Modified: tomcat/trunk/java/org/apache/catalina/core/StandardContext.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/core/StandardContext.java?rev=885901&r1=885900&r2=885901&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/core/StandardContext.java (original)
+++ tomcat/trunk/java/org/apache/catalina/core/StandardContext.java Tue Dec  1 
20:04:17 2009
@@ -739,7 +739,7 @@
 /**
  * Should Tomcat attempt to null out any static or final fields from loaded
  * classes when a web application is stopped as a work around for apparent
- * garbage collection bugs and application coding errors. There have been
+ * garbage collection bugs and application coding errors? There have been
  * some issues reported with log4j when this option is true. Applications
  * without memory leaks using recent JVMs should operate correctly with 
this
  * option set to false. If not specified, the default value of
@@ -747,6 +747,17 @@
  */
 private boolean clearReferencesStatic = false;
 
+/**
+ * Should Tomcat attempt to termiate threads that have been started by the
+ * web application? Stopping threads is performed via the deprecated (for
+ * good reason) Thread.stop() method and is likely to result 
in
+ * instability. As such, enabling this should be viewed as an option of 
last
+ * resort in a development environment and is not recommended in a
+ * production environment. If not specified, the default value of
+ * false will be used. 
+ */
+private boolean clearReferencesStopThreads = false;
+
 // - Context Properties
 
 
@@ -2104,6 +2115,33 @@
 }
 
 
+/**
+ * Return the clearReferencesStopThreads flag for this Context.
+ */
+public boolean getClearReferencesStopThreads() {
+
+return (this.clearReferencesStopThreads);
+
+}
+
+
+/**
+ * Set the clearReferencesStatic feature for this Context.
+ *
+ * @param clearReferencesStatic The new flag value
+ */
+public void setClearReferencesStopThreads(
+boolean clearReferencesStopThreads) {
+
+boolean oldClearReferencesStopThreads = 
this.clearReferencesStopThreads;
+this.clearReferencesStopThreads = clearReferencesStopThreads;
+support.firePropertyChange("clearReferencesStopThreads",
+   oldClearReferencesStopThreads,
+   this.clearReferencesStopThreads);
+
+}
+
+
 //  Context Methods
 
 

Modified: tomcat/trunk/java/org/apache/catalina/loader/LocalStrings.properties
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/loader/LocalStrings.properties?rev=885901&r1=885900&r2=885901&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/loader/LocalStrings.properties 
(original)
+++ tomcat/trunk/java/org/apache/catalina/loader/LocalStrings.properties Tue 
Dec  1 20:04:17 2009
@@ -34,6 +34,11 @@
 webappClassLoader.stopped=Illegal access: this web application instance has 
been stopped already.  Could not load {0}.  The eventual following stack trace 
is caused by an error thrown for debugging purposes as well as to attempt to 
terminate the thread which caused the illegal access, and has no functional 
impact.
 webappClassLoader.readError=Resource read error: Could not load {0}.
 webappClassLoader.clearJbdc=A web application registered the JBDC driver [{0}] 
but failed to unregister it when the web application was stopped. To prevent a 
memory leak, the JDBC Driver has been forcibly unregistered.
+webappClassLoader.clearRmiInfo=Failed to find class sun.rmi.transport.Target 
to clear context class loader. This is expected on non-Sun JVMs.
+webappClassLoader.clearRmiFail=Failed to clear context class loader referenced 
from sun.rmi.transport.Target 
+webappClassLoader.clearThreadLocal=A web application created a ThreadLocal 
with key of type [{0}] (value [{1}]) and a value of type [{2}] (va

DO NOT REPLY [Bug 48322] Reading a cookie with an apostrophe in the value is truncated in Tomcat 6.0.20 and 6.0.18

2009-12-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=48322

--- Comment #1 from Mark Thomas  2009-12-01 12:12:55 GMT ---
This has already been fixed in trunk and proposed for 6.0.x and 5.5.x

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r885991 - /tomcat/trunk/java/org/apache/jasper/compiler/JspUtil.java

2009-12-01 Thread markt
Author: markt
Date: Tue Dec  1 22:52:55 2009
New Revision: 885991

URL: http://svn.apache.org/viewvc?rev=885991&view=rev
Log:
Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=47453
Handle void return types.
Patch by Tim Funk.

Modified:
tomcat/trunk/java/org/apache/jasper/compiler/JspUtil.java

Modified: tomcat/trunk/java/org/apache/jasper/compiler/JspUtil.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/jasper/compiler/JspUtil.java?rev=885991&r1=885990&r2=885991&view=diff
==
--- tomcat/trunk/java/org/apache/jasper/compiler/JspUtil.java (original)
+++ tomcat/trunk/java/org/apache/jasper/compiler/JspUtil.java Tue Dec  1 
22:52:55 2009
@@ -338,6 +338,8 @@
 c = float.class;
 else if ("double".equals(type))
 c = double.class;
+else if ("void".equals(type))
+c = void.class;
 else if (type.indexOf('[') < 0)
 c = loader.loadClass(type);
 



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r885992 - /tomcat/tc6.0.x/trunk/STATUS.txt

2009-12-01 Thread markt
Author: markt
Date: Tue Dec  1 22:54:46 2009
New Revision: 885992

URL: http://svn.apache.org/viewvc?rev=885992&view=rev
Log:
Proposal

Modified:
tomcat/tc6.0.x/trunk/STATUS.txt

Modified: tomcat/tc6.0.x/trunk/STATUS.txt
URL: 
http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/STATUS.txt?rev=885992&r1=885991&r2=885992&view=diff
==
--- tomcat/tc6.0.x/trunk/STATUS.txt (original)
+++ tomcat/tc6.0.x/trunk/STATUS.txt Tue Dec  1 22:54:46 2009
@@ -462,3 +462,9 @@
   +1: markt
   -1: 
 
+* Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=47453
+  Handle void return types
+  This is Tim's patch
+  http://svn.apache.org/viewvc?rev=885991&view=rev
+  +1: markt
+  -1: 



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



DO NOT REPLY [Bug 47453] JasperException for deferred-method with return type void

2009-12-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=47453

Mark Thomas  changed:

   What|Removed |Added

 Status|NEEDINFO|NEW

--- Comment #3 from Mark Thomas  2009-12-01 14:54:59 GMT ---
I can confirm that Tim's proposed patch does indeed fix the compilation
problem.

I have applied the patch to trunk and proposed it for 6.0.x

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r885996 - /tomcat/trunk/java/org/apache/catalina/manager/ManagerServlet.java

2009-12-01 Thread markt
Author: markt
Date: Tue Dec  1 23:02:36 2009
New Revision: 885996

URL: http://svn.apache.org/viewvc?rev=885996&view=rev
Log:
Remove deprecated commands

Modified:
tomcat/trunk/java/org/apache/catalina/manager/ManagerServlet.java

Modified: tomcat/trunk/java/org/apache/catalina/manager/ManagerServlet.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/manager/ManagerServlet.java?rev=885996&r1=885995&r2=885996&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/manager/ManagerServlet.java (original)
+++ tomcat/trunk/java/org/apache/catalina/manager/ManagerServlet.java Tue Dec  
1 23:02:36 2009
@@ -342,16 +342,10 @@
 } else {
 deploy(writer, path, tag);
 }
-} else if (command.equals("/install")) {
-// Deprecated
-deploy(writer, config, path, war, false);
 } else if (command.equals("/list")) {
 list(writer);
 } else if (command.equals("/reload")) {
 reload(writer, path);
-} else if (command.equals("/remove")) {
-// Deprecated
-undeploy(writer, path);
 } else if (command.equals("/resources")) {
 resources(writer, type);
 } else if (command.equals("/roles")) {



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



DO NOT REPLY [Bug 47467] Deployment of the war file by URL when contextpath is not specified in Manager Application.

2009-12-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=47467

--- Comment #13 from Mark Thomas  2009-12-01 15:04:35 GMT ---
To answer your questions, create separate bugs to do the clean-up and attach
the patches there.

How close are you to having the patch ready for this issue?

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r885999 - in /tomcat/trunk/java/org/apache: catalina/ant/jmx/JMXAccessorTask.java catalina/tribes/membership/Membership.java naming/resources/DirContextURLConnection.java

2009-12-01 Thread markt
Author: markt
Date: Tue Dec  1 23:21:41 2009
New Revision: 885999

URL: http://svn.apache.org/viewvc?rev=885999&view=rev
Log:
Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=48296
Generics and JavaDoc fixes
Patch provided by sebb

Modified:
tomcat/trunk/java/org/apache/catalina/ant/jmx/JMXAccessorTask.java
tomcat/trunk/java/org/apache/catalina/tribes/membership/Membership.java
tomcat/trunk/java/org/apache/naming/resources/DirContextURLConnection.java

Modified: tomcat/trunk/java/org/apache/catalina/ant/jmx/JMXAccessorTask.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/ant/jmx/JMXAccessorTask.java?rev=885999&r1=885998&r2=885999&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/ant/jmx/JMXAccessorTask.java 
(original)
+++ tomcat/trunk/java/org/apache/catalina/ant/jmx/JMXAccessorTask.java Tue Dec  
1 23:21:41 2009
@@ -631,7 +631,7 @@
 TabularDataSupport data = (TabularDataSupport) result;
 for (Iterator iter = data.keySet().iterator(); 
iter.hasNext();) {
 Object key = iter.next();
-for (Iterator iter1 = ((List) key).iterator(); 
iter1.hasNext();) {
+for (Iterator iter1 = ((List) key).iterator(); 
iter1.hasNext();) {
 Object key1 = iter1.next();
 CompositeData valuedata = data.get(new Object[] { key1 });
 Object value = valuedata.get("value");

Modified: 
tomcat/trunk/java/org/apache/catalina/tribes/membership/Membership.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/tribes/membership/Membership.java?rev=885999&r1=885998&r2=885999&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/tribes/membership/Membership.java 
(original)
+++ tomcat/trunk/java/org/apache/catalina/tribes/membership/Membership.java Tue 
Dec  1 23:21:41 2009
@@ -68,7 +68,9 @@
 public Object clone() {
 synchronized (membersLock) {
 Membership clone = new Membership(local, memberComparator);
-clone.map = (HashMap) map.clone();
+@SuppressWarnings("unchecked") // map is correct type already
+final HashMap tmpclone = 
(HashMap) map.clone();
+clone.map = tmpclone;
 clone.members = new MemberImpl[members.length];
 System.arraycopy(members,0,clone.members,0,members.length);
 return clone;
@@ -110,8 +112,8 @@
  * Notify the membership that this member has announced itself.
  *
  * @param member - the member that just pinged us
- * @return - true if this member is new to the cluster, false otherwise.
- * @return - false if this member is the local member or updated.
+ * @return - true if this member is new to the cluster, false 
otherwise.
+ * - false if this member is the local member or updated.
  */
 public synchronized boolean memberAlive(MemberImpl member) {
 boolean result = false;

Modified: 
tomcat/trunk/java/org/apache/naming/resources/DirContextURLConnection.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/naming/resources/DirContextURLConnection.java?rev=885999&r1=885998&r2=885999&view=diff
==
--- tomcat/trunk/java/org/apache/naming/resources/DirContextURLConnection.java 
(original)
+++ tomcat/trunk/java/org/apache/naming/resources/DirContextURLConnection.java 
Tue Dec  1 23:21:41 2009
@@ -256,7 +256,7 @@
   }
 
   if (attributes == null)
-  return (Collections.EMPTY_MAP);
+  return (Collections.emptyMap());
 
   HashMap> headerFields =
   new HashMap>(attributes.size());
@@ -347,6 +347,7 @@
 /**
  * Get object content.
  */
+@SuppressWarnings("unchecked") // overridden method uses raw type Class[]
 @Override
 public Object getContent(Class[] classes)
 throws IOException {



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



DO NOT REPLY [Bug 48296] Generics fixes

2009-12-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=48296

Mark Thomas  changed:

   What|Removed |Added

 Status|NEW |RESOLVED
 Resolution||FIXED

--- Comment #3 from Mark Thomas  2009-12-01 15:21:50 GMT ---
Patch applied. Many thanks.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r886005 - /tomcat/trunk/java/org/apache/catalina/core/mbeans-descriptors.xml

2009-12-01 Thread markt
Author: markt
Date: Tue Dec  1 23:28:49 2009
New Revision: 886005

URL: http://svn.apache.org/viewvc?rev=886005&view=rev
Log:
Better descriptions

Modified:
tomcat/trunk/java/org/apache/catalina/core/mbeans-descriptors.xml

Modified: tomcat/trunk/java/org/apache/catalina/core/mbeans-descriptors.xml
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/core/mbeans-descriptors.xml?rev=886005&r1=886004&r2=886005&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/core/mbeans-descriptors.xml (original)
+++ tomcat/trunk/java/org/apache/catalina/core/mbeans-descriptors.xml Tue Dec  
1 23:28:49 2009
@@ -755,12 +755,12 @@
writeable="false" />
 
 
 
 
 



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



DO NOT REPLY [Bug 48323] New: AccessControlException on AJP connector, in security mode

2009-12-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=48323

   Summary: AccessControlException on AJP connector, in security
mode
   Product: Tomcat 6
   Version: 6.0.20
  Platform: PC
OS/Version: All
Status: NEW
  Severity: normal
  Priority: P2
 Component: Connectors
AssignedTo: dev@tomcat.apache.org
ReportedBy: alexis.hass...@sewatech.fr


I started Tomcat in security mode. Everything is fine when accessing via an
HTTP connector, either directly or via a reverse proxy. If I first access via
an AJP connector, I have the following exception :

java.security.AccessControlException: access denied
(java.lang.RuntimePermission accessClassInPackage.org.apache.coyote)
   
java.security.AccessControlContext.checkPermission(AccessControlContext.java:323)
   
java.security.AccessController.checkPermission(AccessController.java:546)
java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
java.lang.SecurityManager.checkPackageAccess(SecurityManager.java:1512)
sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:298)
java.lang.ClassLoader.loadClass(ClassLoader.java:300)
java.lang.ClassLoader.loadClass(ClassLoader.java:252)
java.lang.ClassLoader.loadClassInternal(ClassLoader.java:320)
org.apache.jk.common.JkInputStream.appendHead(JkInputStream.java:283)
org.apache.jk.core.MsgContext.action(MsgContext.java:266)
org.apache.coyote.Response.action(Response.java:183)
org.apache.coyote.Response.sendHeaders(Response.java:379)
   
org.apache.catalina.connector.OutputBuffer.doFlush(OutputBuffer.java:305)
org.apache.catalina.connector.OutputBuffer.close(OutputBuffer.java:273)
   
org.apache.catalina.connector.CoyoteOutputStream.close(CoyoteOutputStream.java:104)
...

This exception happens only at the first call. The second call is OK.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



DO NOT REPLY [Bug 48324] New: Javadoc fixes for connector.Request.java

2009-12-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=48324

   Summary: Javadoc fixes for connector.Request.java
   Product: Tomcat 7
   Version: trunk
  Platform: PC
OS/Version: Windows XP
Status: NEW
  Severity: normal
  Priority: P2
 Component: Catalina
AssignedTo: dev@tomcat.apache.org
ReportedBy: s...@apache.org


Created an attachment (id=24655)
 --> (https://issues.apache.org/bugzilla/attachment.cgi?id=24655)
Javadoc fixes for connector.Request.java

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



DO NOT REPLY [Bug 48324] Javadoc fixes for connector.Request.java

2009-12-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=48324

Sebb  changed:

   What|Removed |Added

  Attachment #24655|application/octet-stream|text/plain
  mime type||
  Attachment #24655|0   |1
   is patch||

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



DO NOT REPLY [Bug 48323] AccessControlException on AJP connector, in security mode

2009-12-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=48323

--- Comment #1 from Alexis Hassler  2009-12-01 
16:04:40 UTC ---
OK, I fixed it by adding these three lines in catalina.policy :

grant { 
  ...
  permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.coyote";
  permission java.util.PropertyPermission
"org.apache.coyote.USE_CUSTOM_STATUS_MSG_IN_HEADER", "read";
  permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.tomcat.util.buf";
};

Maybe it could be provided by default...

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



DO NOT REPLY [Bug 47500] request.getParameter lead to servlet can't receive READ event in CometProcessor class

2009-12-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=47500

Mark Thomas  changed:

   What|Removed |Added

 Status|NEW |RESOLVED
 Resolution||INVALID

--- Comment #2 from Mark Thomas  2009-12-01 16:18:07 GMT ---
That is as expected.

HttpServletRequest.getParameter() will drain the input stream reading the data
from the form so there is nothing left to generate a read() event.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



DO NOT REPLY [Bug 48258] Creating a session cookie with a specific default domain.

2009-12-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=48258

--- Comment #4 from donn.ai...@gmail.com 2009-12-01 16:25:09 UTC ---
Hello - 

Is there anything else I can do to ask people to look this over for possible
inclusion?  I think the last set of diffs implement the change as requested.  

(SetCookieDomain3.diff is the filename for the attachment, id=24607)

Thanks.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r886019 - /tomcat/trunk/java/org/apache/catalina/ha/session/DeltaSession.java

2009-12-01 Thread markt
Author: markt
Date: Wed Dec  2 00:31:33 2009
New Revision: 886019

URL: http://svn.apache.org/viewvc?rev=886019&view=rev
Log:
Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=47502
Don't try and replicate attributes we know to be non-serializable
Patch by Tim Funk

Modified:
tomcat/trunk/java/org/apache/catalina/ha/session/DeltaSession.java

Modified: tomcat/trunk/java/org/apache/catalina/ha/session/DeltaSession.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/ha/session/DeltaSession.java?rev=886019&r1=886018&r2=886019&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/ha/session/DeltaSession.java 
(original)
+++ tomcat/trunk/java/org/apache/catalina/ha/session/DeltaSession.java Wed Dec  
2 00:31:33 2009
@@ -731,7 +731,7 @@
 for (int i = 0; i < keys.length; i++) {
 Object value = null;
 value = attributes.get(keys[i]);
-if (value == null)
+if (value == null || exclude(keys[i]))
 continue;
 else if (value instanceof Serializable) {
 saveNames.add(keys[i]);



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r886020 - /tomcat/tc6.0.x/trunk/STATUS.txt

2009-12-01 Thread markt
Author: markt
Date: Wed Dec  2 00:33:13 2009
New Revision: 886020

URL: http://svn.apache.org/viewvc?rev=886020&view=rev
Log:
Proposal

Modified:
tomcat/tc6.0.x/trunk/STATUS.txt

Modified: tomcat/tc6.0.x/trunk/STATUS.txt
URL: 
http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/STATUS.txt?rev=886020&r1=886019&r2=886020&view=diff
==
--- tomcat/tc6.0.x/trunk/STATUS.txt (original)
+++ tomcat/tc6.0.x/trunk/STATUS.txt Wed Dec  2 00:33:13 2009
@@ -468,3 +468,10 @@
   http://svn.apache.org/viewvc?rev=885991&view=rev
   +1: markt
   -1: 
+
+* Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=47502
+  Don't try and replicate attributes we know to be non-serializable
+  Patch by Tim Funk
+  http://svn.apache.org/viewvc?rev=886019&view=rev
+  +1: markt
+  -1: 



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



DO NOT REPLY [Bug 47502] clustering fails on serializing javax.security.auth.subject

2009-12-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=47502

Mark Thomas  changed:

   What|Removed |Added

 Status|NEEDINFO|NEW

--- Comment #3 from Mark Thomas  2009-12-01 16:33:25 GMT ---
This session attribute used when running under a security manager.
Authentication is handled separately. The patch looks good to me.

I've applied it to trunk and proposed it for 6.0.x

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



DO NOT REPLY [Bug 48258] Creating a session cookie with a specific default domain.

2009-12-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=48258

--- Comment #5 from Mark Thomas  2009-12-01 16:42:58 GMT ---
The general approach is good.

Some misc comments in no particular order:
- Use 4 spaces rather than tabs
- Remove the changes that just add/remove whitespace at the end of a line
- Some methods are missing JavaDocs
- Provide the spelling corrections as a separate patch (makes things easier to
review)
- The new attribute needs documenting.
- Some thought needs to be given to how this will interact with the session
cookie config that will come in the Tomcat 7.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



DO NOT REPLY [Bug 48258] Creating a session cookie with a specific default domain.

2009-12-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=48258

--- Comment #6 from donn.ai...@gmail.com 2009-12-01 18:37:27 UTC ---
(In reply to comment #5)
> The general approach is good.
> 
> Some misc comments in no particular order:
> - Use 4 spaces rather than tabs
> - Remove the changes that just add/remove whitespace at the end of a line
> - Some methods are missing JavaDocs
> - Provide the spelling corrections as a separate patch (makes things easier to
> review)
> - The new attribute needs documenting.
> - Some thought needs to be given to how this will interact with the session
> cookie config that will come in the Tomcat 7.

Thank you very much for the feedback.  I believe this set of diffs much closer
to what what you're looking for.  I have not looked at the cookie handing in TC
7 yet, however.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



DO NOT REPLY [Bug 48258] Creating a session cookie with a specific default domain.

2009-12-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=48258

--- Comment #7 from donn.ai...@gmail.com 2009-12-01 18:38:32 UTC ---
Created an attachment (id=24656)
 --> (https://issues.apache.org/bugzilla/attachment.cgi?id=24656)
cleaned up diffs, documentation

Thank you very much for the feedback.  I believe this set of diffs much closer
to what what you're looking for.  I have not looked at the cookie handing in TC
7 yet, however.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



Re: svn commit: r885860 - in /tomcat/trunk: java/org/apache/catalina/core/JreMemoryLeakPreventionListener.java java/org/apache/catalina/core/LocalStrings.properties webapps/docs/config/listeners.xml

2009-12-01 Thread Bill Barker

 wrote in message 
news:20091201184432.f01322388...@eris.apache.org...
> Author: markt
> Date: Tue Dec  1 18:44:32 2009
> New Revision: 885860
>
> URL: http://svn.apache.org/viewvc?rev=885860&view=rev
> Log:
> More memory leak protection - this time for the GC Daemon thread.
>
> Modified:
> 
> tomcat/trunk/java/org/apache/catalina/core/JreMemoryLeakPreventionListener.java
>tomcat/trunk/java/org/apache/catalina/core/LocalStrings.properties
>tomcat/trunk/webapps/docs/config/listeners.xml
>
> Modified: 
> tomcat/trunk/java/org/apache/catalina/core/JreMemoryLeakPreventionListener.java
> URL: 
> http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/core/JreMemoryLeakPreventionListener.java?rev=885860&r1=885859&r2=885860&view=diff
> ==
> ---  
> tomcat/trunk/java/org/apache/catalina/core/JreMemoryLeakPreventionListener.java
>  
> (original)
> +++ 
> tomcat/trunk/java/org/apache/catalina/core/JreMemoryLeakPreventionListener.java
>  
> Tue Dec  1 18:44:32 2009
> @@ -18,6 +18,8 @@
> package org.apache.catalina.core;
>
> import java.io.IOException;
> +import java.lang.reflect.InvocationTargetException;
> +import java.lang.reflect.Method;
> import java.net.MalformedURLException;
> import java.net.URL;
> import java.net.URLConnection;
> @@ -80,7 +82,7 @@
> /**
>  * XML parsing can pin a web application class loader in memory. This 
> is
>  * particularly nasty as profilers (at least YourKit and Eclispe MAT) 
> don't
> - * idenitfy any GC roots related to this.
> + * identify any GC roots related to this.
>  */
> private boolean xmlParsingProtection = true;
> public boolean isXmlParsingProtection() { return 
> xmlParsingProtection; }
> @@ -88,6 +90,19 @@
> this.xmlParsingProtection = xmlParsingProtection;
> }
>
> +/**
> + * Protect against the memory leak caused when the first call to
> + * sun.misc.GC.requestLatency(long) is triggered by a 
> web
> + * application. This first call will start a GC Daemon thread with 
> the
> + * thread's context class loader configured to be the web application 
> class
> + * loader. Defaults to true.
> + */
> +private boolean gcDaemonProtection = true;
> +public boolean isGcDaemonProtection() { return gcDaemonProtection; }
> +public void setGcDaemonProtection(boolean gcDaemonProtection) {
> +this.gcDaemonProtection = gcDaemonProtection;
> +}
> +
> @Override
> public void lifecycleEvent(LifecycleEvent event) {
> // Initialise these classes when Tomcat starts
> @@ -150,8 +165,36 @@
> try {
> factory.newDocumentBuilder();
> } catch (ParserConfigurationException e) {
> -log.error(sm.getString(
> -"jreLeakListener.xmlParseFail"), e);
> + 
> log.error(sm.getString("jreLeakListener.xmlParseFail"), e);
> +}
> +}
> +
> +/*
> + * Several components end up calling:
> + * sun.misc.GC.requestLatency(long)
> + *
> + * Those libraries / components known to trigger memory leaks 
> due to
> + * eventual calls to requestLatency(long) are:
> + * - javax.management.remote.rmi.RMIConnectorServer.start()
> + */
> +if (gcDaemonProtection) {
> +try {
> +Class clazz = Class.forName("sun.misc.GC");
> +Method method = 
> clazz.getDeclaredMethod("requestLatency",
> +new Class[] {long.class});
> +method.invoke(null, Long.valueOf(360));
> +} catch (ClassNotFoundException e) {
> + 
> log.error(sm.getString("jreLeakListener.gcDaemonFail"), e);

This should be no higher than INFO (and, personally, would go for DEBUG). 
It just means that you are not running a Sun JVM.  IMHO, having this one at 
ERROR just produces messages on the user list of the form "I got this big 
scary message in my log file while running Tomcat on the latest IBM JVM. 
What do I do about it?".

> +} catch (SecurityException e) {
> + 
> log.error(sm.getString("jreLeakListener.gcDaemonFail"), e);
> +} catch (NoSuchMethodException e) {
> + 
> log.error(sm.getString("jreLeakListener.gcDaemonFail"), e);
> +} catch (IllegalArgumentException e) {
> + 
> log.error(sm.getString("jreLeakListener.gcDaemonFail"), e);
> +} catch (IllegalAccessException e) {
> + 
> log.error(sm.getString("jreLeakListener.gcDaemonFail"), e);
> +} catch (InvocationTargetException e) {
> + 
> log.error(sm.getString("jreLeakListener.gcDaemonFail"), e);
> }
> }
> }
>
> Modified: 
> tomcat/trunk/java/org/apache/catalina/core/LocalStrings.properties
> URL: 
> http://svn.apache.org/viewvc/tomcat/trunk/java/org/