svn commit: r1716804 - /tomcat/trunk/java/org/apache/coyote/http2/Http2Parser.java

[kkolinko]

Author: kkolinko
Date: Fri Nov 27 08:21:02 2015
New Revision: 1716804

URL: http://svn.apache.org/viewvc?rev=1716804&view=rev
Log:
Correct a comment typo

Modified:
tomcat/trunk/java/org/apache/coyote/http2/Http2Parser.java

Modified: tomcat/trunk/java/org/apache/coyote/http2/Http2Parser.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/coyote/http2/Http2Parser.java?rev=1716804&r1=1716803&r2=1716804&view=diff
==
--- tomcat/trunk/java/org/apache/coyote/http2/Http2Parser.java (original)
+++ tomcat/trunk/java/org/apache/coyote/http2/Http2Parser.java Fri Nov 27 
08:21:02 2015
@@ -56,7 +56,7 @@ class Http2Parser {
  * Read and process a single frame. Once the start of a frame is read, the
  * remainder will be read using blocking IO.
  *
- * @param block Should this method block until a frame is available is no
+ * @param block Should this method block until a frame is available if no
  *  frame is available immediately?
  *
  * @return true if a frame was read otherwise



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

buildbot success in ASF Buildbot on tomcat-trunk

[buildbot]

The Buildbot has detected a restored build on builder tomcat-trunk while 
building ASF Buildbot. Full details are available at:
http://ci.apache.org/builders/tomcat-trunk/builds/691

Buildbot URL: http://ci.apache.org/

Buildslave for this Build: silvanus_ubuntu

Build Reason: The AnyBranchScheduler scheduler named 'on-tomcat-commit' 
triggered this build
Build Source Stamp: [branch tomcat/trunk] 1716804
Blamelist: kkolinko

Build succeeded!

Sincerely,
 -The Buildbot




-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58659] New: Http2Parser.readFrame() hanging on an unconditional blocking read is necessary (TestHttp2Section_5_3 test)

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58659

Bug ID: 58659
   Summary: Http2Parser.readFrame() hanging on an unconditional
blocking read is necessary (TestHttp2Section_5_3 test)
   Product: Tomcat 9
   Version: 9.0.0.M1
  Hardware: PC
Status: NEW
  Severity: normal
  Priority: P2
 Component: Catalina
  Assignee: dev@tomcat.apache.org
  Reporter: knst.koli...@gmail.com

Trunk at revision 1716783

Buildbot run:
https://ci.apache.org/builders/tomcat-trunk/builds/690

Log file:
https://ci.apache.org/projects/tomcat/tomcat9/logs/logs/1716783/TEST-org.apache.coyote.http2.TestHttp2Section_5_3.NIO.txt

In TestHttp2Section_5_3.java there is a comment on lines 127-144:

// The loop below handles 0, 1 or 2 stream being blocked
<...>
// - If 2 streams are blocked the connection window will be set to one
//   but one byte will be permitted for both streams (due to rounding in
//   the allocation). The window size should be -1 (see below). Two
//   frames (one for each stream will be written) one of which will be
//   consumed by the client. The loop will start again and the Window
//   size incremented to zero. No data will be written by the streams
//   but the second data frame written in the last iteration of the loop
//   will be read. The loop will then exit since frames from both
//   streams will have been observed.

The sequence of events in while(!seen19 || !seen21) loop (line 147) on this
test run was:
iteration 1: a body of stream 21 was read ("21-Body-1")
iteration 2: "parser.readFrame(true);" call blocks until it times out after
waiting for 30 seconds

[[[
Testcase: testWeighting took 35.576 sec
Caused an ERROR
Read timed out
java.net.SocketTimeoutException: Read timed out
at java.net.SocketInputStream.socketRead0(Native Method)
at java.net.SocketInputStream.socketRead(SocketInputStream.java:116)
at java.net.SocketInputStream.read(SocketInputStream.java:170)
at java.net.SocketInputStream.read(SocketInputStream.java:141)
at
org.apache.coyote.http2.Http2TestBase$TestInput.fill(Http2TestBase.java:720)
at org.apache.coyote.http2.Http2Parser$Input.fill(Http2Parser.java:565)
at org.apache.coyote.http2.Http2Parser.readFrame(Http2Parser.java:75)
at org.apache.coyote.http2.Http2Parser.readFrame(Http2Parser.java:68)
at
org.apache.coyote.http2.TestHttp2Section_5_3.testWeighting(TestHttp2Section_5_3.java:149)
]]]

My concern is implementation of Http2Parser.readFrame() method.
It starts with unconditionally calling "input.fill(block, frameHeaderBuffer)"
regardless of whether the frame bytes have already been read. I think it shall
check whether the blocking read is necessary or if enough the data have already
been received.

The comment that I cited says "but the second data frame written in the last
iteration of the loop will be read". I think that because of unconditional call
to input.fill() the thread will block reading for data, regardless of whether
the second data frame has already been received.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58659] Http2Parser.readFrame() hanging on an unconditional blocking read (TestHttp2Section_5_3 test)

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58659

Konstantin Kolinko  changed:

   What|Removed |Added

 OS||All
Summary|Http2Parser.readFrame() |Http2Parser.readFrame()
   |hanging on an unconditional |hanging on an unconditional
   |blocking read is necessary  |blocking read
   |(TestHttp2Section_5_3 test) |(TestHttp2Section_5_3 test)

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58660] New: Different redirect behaviour when accessing path without a /

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58660

Bug ID: 58660
   Summary: Different redirect behaviour when accessing path
without a /
   Product: Tomcat 8
   Version: 8.0.29
  Hardware: PC
Status: NEW
  Severity: normal
  Priority: P2
 Component: Catalina
  Assignee: dev@tomcat.apache.org
  Reporter: per.le...@smhi.se

Hi,

Tomcat 8.0.29 changes the behaviour of requests for paths without a trailing
slash. It seems to be limited to context roots, e.g. /examples instead of
/examples/servlets.

When calling /examples on 8.0.28 it responds with a 302 redirecting to
/examples/, but 8.0.29 responds with a 200.

I would say that people should be more careful with their URL:s, but this
change in default behaviour is probably going to cause problems. It is probably
not correct to respond with /examples/index.html, when accessing /examples.
This changes any relative paths on a website, since there will be a / missing.
This may indeed be verified by clicking any of the links in the 8.0.29
/examples response HTML. Clicking them causes the browser to fetch e.g.
/servlets instead of /examples/servlets.

Accessing /examples/servlets however causes a 302 to /examples/servlets/, just
like 8.0.28.


To reproduce:

1. Download Tomcat 8.0.28 and 8.0.29

% wget
http://archive.apache.org/dist/tomcat/tomcat-8/v8.0.28/bin/apache-tomcat-8.0.28.zip
% wget
http://apache.mirrors.spacedump.net/tomcat/tomcat-8/v8.0.29/bin/apache-tomcat-8.0.29.zip

Unzip the two archives.

2. Access /examples for Tomcat 8.0.28

% curl -vso /dev/null http://localhost:8080/examples
* STATE: INIT => CONNECT handle 0x6000572f0; line 1090 (connection #-5000)
* Added connection 0. The cache now contains 1 members
*   Trying ::1...
* STATE: CONNECT => WAITCONNECT handle 0x6000572f0; line 1143 (connection #0)
* Connected to localhost (::1) port 8080 (#0)
* STATE: WAITCONNECT => SENDPROTOCONNECT handle 0x6000572f0; line 1240
(connection #0)
* STATE: SENDPROTOCONNECT => DO handle 0x6000572f0; line 1258 (connection #0)
> GET /examples HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/7.45.0
> Accept: */*
>
* STATE: DO => DO_DONE handle 0x6000572f0; line 1337 (connection #0)
* STATE: DO_DONE => WAITPERFORM handle 0x6000572f0; line 1464 (connection #0)
* STATE: WAITPERFORM => PERFORM handle 0x6000572f0; line 1474 (connection #0)
* HTTP 1.1 or later with persistent connection, pipelining supported
< HTTP/1.1 302 Found
* Server Apache-Coyote/1.1 is not blacklisted
< Server: Apache-Coyote/1.1
< Location: http://localhost:8080/examples/
< Transfer-Encoding: chunked
< Date: Fri, 27 Nov 2015 08:36:11 GMT
<
{ [5 bytes data]
* STATE: PERFORM => DONE handle 0x6000572f0; line 1632 (connection #0)
* Curl_done
* Connection #0 to host localhost left intact
* Expire cleared


3. Access /examples for Tomcat 8.0.29

* STATE: INIT => CONNECT handle 0x6000572f0; line 1090 (connection #-5000)
* Added connection 0. The cache now contains 1 members
*   Trying ::1...
* STATE: CONNECT => WAITCONNECT handle 0x6000572f0; line 1143 (connection #0)
* Connected to localhost (::1) port 8080 (#0)
* STATE: WAITCONNECT => SENDPROTOCONNECT handle 0x6000572f0; line 1240
(connection #0)
* STATE: SENDPROTOCONNECT => DO handle 0x6000572f0; line 1258 (connection #0)
> GET /examples HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/7.45.0
> Accept: */*
>
* STATE: DO => DO_DONE handle 0x6000572f0; line 1337 (connection #0)
* STATE: DO_DONE => WAITPERFORM handle 0x6000572f0; line 1464 (connection #0)
* STATE: WAITPERFORM => PERFORM handle 0x6000572f0; line 1474 (connection #0)
* HTTP 1.1 or later with persistent connection, pipelining supported
< HTTP/1.1 200 OK
* Server Apache-Coyote/1.1 is not blacklisted
< Server: Apache-Coyote/1.1
< Accept-Ranges: bytes
< ETag: W/"1156-1448007578000"
< Last-Modified: Fri, 20 Nov 2015 08:19:38 GMT
< Content-Type: text/html
< Content-Length: 1156
< Date: Fri, 27 Nov 2015 08:36:38 GMT
<
{ [1156 bytes data]
* STATE: PERFORM => DONE handle 0x6000572f0; line 1632 (connection #0)
* Curl_done
* Connection #0 to host localhost left intact

Cheers, 
Per Lewau

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58660] Different redirect behaviour when accessing path without a /

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58660

Mark Thomas  changed:

   What|Removed |Added

 Resolution|--- |INVALID
 Status|NEW |RESOLVED
 OS||All

--- Comment #1 from Mark Thomas  ---
Read the change log.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1716807 - /tomcat/trunk/java/org/apache/coyote/AbstractProcessorLight.java

[markt]

Author: markt
Date: Fri Nov 27 09:07:40 2015
New Revision: 1716807

URL: http://svn.apache.org/viewvc?rev=1716807&view=rev
Log:
Simplify

Modified:
tomcat/trunk/java/org/apache/coyote/AbstractProcessorLight.java

Modified: tomcat/trunk/java/org/apache/coyote/AbstractProcessorLight.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/coyote/AbstractProcessorLight.java?rev=1716807&r1=1716806&r2=1716807&view=diff
==
--- tomcat/trunk/java/org/apache/coyote/AbstractProcessorLight.java (original)
+++ tomcat/trunk/java/org/apache/coyote/AbstractProcessorLight.java Fri Nov 27 
09:07:40 2015
@@ -52,16 +52,14 @@ public abstract class AbstractProcessorL
 state = dispatch(nextDispatch.getSocketStatus());
 } else if (status == SocketStatus.DISCONNECT) {
 // Do nothing here, just wait for it to get recycled
-} else if (isAsync() || isUpgrade()) {
-state = dispatch(status);
-} else if (state == SocketState.ASYNC_END) {
+} else if (isAsync() || isUpgrade() || state == 
SocketState.ASYNC_END) {
 state = dispatch(status);
 if (state == SocketState.OPEN) {
-// There may be pipe-lined data to read. If the data
-// isn't processed now, execution will exit this
-// loop and call release() which will recycle the
-// processor (and input buffer) deleting any
-// pipe-lined data. To avoid this, process it now.
+// There may be pipe-lined data to read. If the data isn't
+// processed now, execution will exit this loop and call
+// release() which will recycle the processor (and input
+// buffer) deleting any pipe-lined data. To avoid this,
+// process it now.
 state = service(socketWrapper);
 }
 } else if (status == SocketStatus.OPEN_WRITE) {



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58660] Different redirect behaviour when accessing path without a /

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58660

Mark Thomas  changed:

   What|Removed |Added

 Status|RESOLVED|REOPENED
 Resolution|INVALID |---

--- Comment #2 from Mark Thomas  ---
The change in where processing takes place is intentional but the end result
should have been the same. Need to look at what is going on for the context
root.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58660] Different redirect behaviour when accessing path without a /

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58660

--- Comment #3 from Konstantin Kolinko  ---
This is reproducible in Tomcat 7.0.66 (release candidate) as well.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58660] Different redirect behaviour when accessing path without a /

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58660

--- Comment #4 from Konstantin Kolinko  ---
Tomcat 8.0.29 - Workaround:
In conf/context.xml set the following attribute:



Tomcat 7.0.66 (release candidate) - The workaround does not work.

The cause is that MapperListener calls wrong (deprecated) version of
mapper.addContextVersion() method and does not pass the flags to the Mapper.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

Re: [VOTE] Release Apache Tomcat 7.0.66

[Konstantin Kolinko]

2015-11-26 0:25 GMT+03:00 Violeta Georgieva :
> The proposed Apache Tomcat 7.0.66 release is now available for voting.
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-7/v7.0.66/
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1056/
> The svn tag is:
> http://svn.apache.org/repos/asf/tomcat/tc7.0.x/tags/TOMCAT_7_0_66/
>
> The proposed 7.0.66 release is:
> [x] Broken - do not release
> [ ] Stable - go ahead and release as 7.0.66 Stable

1) There are two regressions
https://bz.apache.org/bugzilla/show_bug.cgi?id=58658
https://bz.apache.org/bugzilla/show_bug.cgi?id=58660

The second one is a showstopper, as there is no simple workaround
(configuration option is broken).

2) Testsuite - all OK.
Tested all connectors (BIO, NIO, APR) x JDK 6u45/7u80/8u66 32-bit on Windows 7.

Best regards,
Konstantin Kolinko

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58660] Different redirect behaviour when accessing path without a /

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58660

--- Comment #5 from Remy Maucherat  ---
Specifically for the context root, the default behavior could be to redirect in
the mapper (mapperContextRootRedirectEnabled could be true).

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58660] Different redirect behaviour when accessing path without a /

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58660

--- Comment #6 from Mark Thomas  ---
I'm neutral on the default behaviour for context root redirects but either way
the current issue needs to be fixed. I'm currently working on this.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58660] Different redirect behaviour when accessing path without a /

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58660

--- Comment #7 from Remy Maucherat  ---
Well, I messed up as well, since I was certain this was fine (the code change
in the default servlet should have redirected the root path as far as I am
concerned), although my own patch never removed the "" -> "/" redirect in the
mapper of course.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58660] Different redirect behaviour when accessing path without a /

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58660

--- Comment #8 from Konstantin Kolinko  ---
One more place that fails - a FormAuthenticator if it is configured to a web
application as a whole and if its authentication form uses a relative URL to
j_security_check, like the examples app does.

8.0.29
1. In webapps/examples/WEB-INF/web.xml
In  elements (there are 2 of them) replace 
 /jsp/security/protected/*
with
 /*

2. In conf/tomcat-users.xml uncomment test users.

3. Start Tomcat

4. Go to http://localhost:8080/examples

A login form is displayed.

5. Type in user name and password (as configured in conf/tomcat-users.xml)

6. The login form sends POST request to
http://localhost:8080/j_security_check;jsessionid=<...>

This fails with 404, because request goes to a wrong web application (ROOT, not
examples).


One more area of concern: anything that sets a cookie before a redirect
happens. See "sessionCookiePathUsesTrailingSlash" option on Context. 

(FormAuthenticator is an example here as well, but as I wrote above there is a
more serious issue with it.)

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1716856 - /tomcat/trunk/java/org/apache/catalina/servlets/DefaultServlet.java

[markt]

Author: markt
Date: Fri Nov 27 12:03:06 2015
New Revision: 1716856

URL: http://svn.apache.org/viewvc?rev=1716856&view=rev
Log:
Refactor
- reduce duplication
- use a StringBuilder

Modified:
tomcat/trunk/java/org/apache/catalina/servlets/DefaultServlet.java

Modified: tomcat/trunk/java/org/apache/catalina/servlets/DefaultServlet.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/servlets/DefaultServlet.java?rev=1716856&r1=1716855&r2=1716856&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/servlets/DefaultServlet.java 
(original)
+++ tomcat/trunk/java/org/apache/catalina/servlets/DefaultServlet.java Fri Nov 
27 12:03:06 2015
@@ -337,36 +337,30 @@ public class DefaultServlet extends Http
 // This method must construct a complete context rooted path, although
 // subclasses can change this behaviour.
 
-// Are we being processed by a RequestDispatcher.include()?
-if (request.getAttribute(
-RequestDispatcher.INCLUDE_REQUEST_URI) != null) {
-String result = (String) request.getAttribute(
-RequestDispatcher.INCLUDE_PATH_INFO);
-if (result == null) {
-result = (String) request.getAttribute(
-RequestDispatcher.INCLUDE_SERVLET_PATH);
-} else {
-result = (String) request.getAttribute(
-RequestDispatcher.INCLUDE_SERVLET_PATH) + result;
-}
-if ((result == null) || (result.equals(""))) {
-result = "/";
-}
-return (result);
-}
+String servletPath;
+String pathInfo;
 
-// No, extract the desired path directly from the request
-String result = request.getPathInfo();
-if (result == null) {
-result = request.getServletPath();
+if (request.getAttribute(RequestDispatcher.INCLUDE_REQUEST_URI) != 
null) {
+// For includes, get the info from the attributes
+pathInfo = (String) 
request.getAttribute(RequestDispatcher.INCLUDE_PATH_INFO);
+servletPath = (String) 
request.getAttribute(RequestDispatcher.INCLUDE_SERVLET_PATH);
 } else {
-result = request.getServletPath() + result;
+pathInfo = request.getPathInfo();
+servletPath = request.getServletPath();
+}
+
+StringBuilder result = new StringBuilder();
+if (servletPath != null) {
+result.append(servletPath);
+if (pathInfo != null) {
+result.append(pathInfo);
+}
 }
-if ((result == null) || (result.equals(""))) {
-result = "/";
+if (result.length() == 0) {
+result.append('/');
 }
-return (result);
 
+return result.toString();
 }
 
 



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1716858 - /tomcat/trunk/java/org/apache/catalina/servlets/WebdavServlet.java

[markt]

Author: markt
Date: Fri Nov 27 12:05:27 2015
New Revision: 1716858

URL: http://svn.apache.org/viewvc?rev=1716858&view=rev
Log:
Port refactoring from super class

Modified:
tomcat/trunk/java/org/apache/catalina/servlets/WebdavServlet.java

Modified: tomcat/trunk/java/org/apache/catalina/servlets/WebdavServlet.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/servlets/WebdavServlet.java?rev=1716858&r1=1716857&r2=1716858&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/servlets/WebdavServlet.java (original)
+++ tomcat/trunk/java/org/apache/catalina/servlets/WebdavServlet.java Fri Nov 
27 12:05:27 2015
@@ -375,23 +375,24 @@ public class WebdavServlet
  */
 @Override
 protected String getRelativePath(HttpServletRequest request) {
-// Are we being processed by a RequestDispatcher.include()?
-if (request.getAttribute(
-RequestDispatcher.INCLUDE_REQUEST_URI) != null) {
-String result = (String) request.getAttribute(
-RequestDispatcher.INCLUDE_PATH_INFO);
-if ((result == null) || (result.equals("")))
-result = "/";
-return (result);
+String pathInfo;
+
+if (request.getAttribute(RequestDispatcher.INCLUDE_REQUEST_URI) != 
null) {
+// For includes, get the info from the attributes
+pathInfo = (String) 
request.getAttribute(RequestDispatcher.INCLUDE_PATH_INFO);
+} else {
+pathInfo = request.getPathInfo();
 }
 
-// No, extract the desired path directly from the request
-String result = request.getPathInfo();
-if ((result == null) || (result.equals(""))) {
-result = "/";
+StringBuilder result = new StringBuilder();
+if (pathInfo != null) {
+result.append(pathInfo);
+}
+if (result.length() == 0) {
+result.append('/');
 }
-return (result);
 
+return result.toString();
 }
 
 



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58660] Different redirect behaviour when accessing path without a /

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58660

--- Comment #9 from Remy Maucherat  ---
Well, since we think everything else works, then the easiest/safest is to
unconditionally add back the root path redirect in the mapper.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58660] Different redirect behaviour when accessing path without a /

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58660

--- Comment #10 from Mark Thomas  ---
You say that just as I think I have put together a fix. Happy to change the
default but I'd like to keep the option of having the Default Servlet do the
redirect

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1716860 - /tomcat/tc7.0.x/trunk/java/org/apache/catalina/connector/MapperListener.java

[markt]

Author: markt
Date: Fri Nov 27 12:18:47 2015
New Revision: 1716860

URL: http://svn.apache.org/viewvc?rev=1716860&view=rev
Log:
Fix the issue that meant the work-around for BZ 58660 would not work.

Modified:
tomcat/tc7.0.x/trunk/java/org/apache/catalina/connector/MapperListener.java

Modified: 
tomcat/tc7.0.x/trunk/java/org/apache/catalina/connector/MapperListener.java
URL: 
http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/connector/MapperListener.java?rev=1716860&r1=1716859&r2=1716860&view=diff
==
--- tomcat/tc7.0.x/trunk/java/org/apache/catalina/connector/MapperListener.java 
(original)
+++ tomcat/tc7.0.x/trunk/java/org/apache/catalina/connector/MapperListener.java 
Fri Nov 27 12:18:47 2015
@@ -384,7 +384,8 @@ public class MapperListener extends Life
 
 mapper.addContextVersion(host.getName(), host, contextPath,
 context.getWebappVersion(), context, welcomeFiles, resources,
-wrappers);
+wrappers, context.getMapperContextRootRedirectEnabled(),
+context.getMapperDirectoryRedirectEnabled());
 
 if(log.isDebugEnabled()) {
 log.debug(sm.getString("mapperListener.registerContext",



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58662] New: blacklist some classes in custom ObjectInputStreams

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58662

Bug ID: 58662
   Summary: blacklist some classes in custom ObjectInputStreams
   Product: Tomcat 9
   Version: unspecified
  Hardware: PC
OS: Mac OS X 10.4
Status: NEW
  Severity: normal
  Priority: P2
 Component: Catalina
  Assignee: dev@tomcat.apache.org
  Reporter: rmannibu...@gmail.com

Tomcat (at least 7 to 9) uses custom ObjectInputStream, since the server can't
control the fact a user add one of the vulnerable libraries in the same
classloader as tomcat (aka common.loader), tomcat should blacklist these
classes.

This can be done with
https://github.com/apache/tomee/blob/master/container/openejb-core/src/main/java/org/apache/openejb/core/rmi/BlacklistClassResolver.java
(adapting the config I guess) and calling check(name) here
https://github.com/apache/tomcat/blob/trunk/java/org/apache/catalina/util/CustomObjectInputStream.java#L74
around classDesc.getName() before loading the class

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

Early Access b93 is available for JDK 9 on java.net

[Rory O'Donnell]

Hi Mark/Mladen,

Since my last message about JDK 9 build b88, a number of new JEPs have 
been integrated into JDK 9 b93
available here . I'd like to point you 
to a few that are now available for testing in this JDK 9 Early Access 
build:


JEP 254: Compact Strings (http://openjdk.java.net/jeps/254)

This JEP adopts a more space-efficient internal representation for strings.

We propose to change the internal representation of the String class 
from a UTF-16 char array to a byte array plus an encoding-flag field. 
The new String class will store characters encoded either as 
ISO-8859-1/Latin-1 (one byte per character), or as UTF-16 (two bytes per 
character), based upon the contents of the string. The encoding flag 
will indicate which encoding is used.


JEP 165: Compiler Control (http://openjdk.java.net/jeps/165)

This JEP proposes an improved way to control the JVM compilers. It 
enables runtime manageable, method dependent compiler flags. (Immutable 
for the duration of a compilation.)


Method-context dependent control of the compilation process is a 
powerful tool for writing small contained JVM compiler tests that can be 
run without restarting the entire JVM. It is also very useful for 
creating workarounds for bugs in the JVM compilers.


JEP 243: Java-Level JVM Compiler Interface 
(http://openjdk.java.net/jeps/243)


This JEP instruments the data flows within the JVM which are used by the 
JIT compiler to allow Java code to observe, query, and affect the JVM's 
compilation process and its associated metadata.


JEP 268: XML Catalog API (http://openjdk.java.net/jeps/268)

This JEP develops a standard XML Catalog API that supports the OASIS XML 
Catalogs standard, v1.1. The API will define catalog and 
catalog-resolver abstractions which can be used with the JAXP processors 
that accept resolvers.


Existing libraries or applications that use the internal API will need 
to migrate to the new API in order to take advantage of the new features.



Rgds, Rory

--
Rgds,Rory O'Donnell
Quality Engineering Manager
Oracle EMEA , Dublin, Ireland

Re: Early Access b93 is available for JDK 9 on java.net

[Rémy Maucherat]

2015-11-27 13:43 GMT+01:00 Rory O'Donnell :

> JEP 254: Compact Strings (http://openjdk.java.net/jeps/254)
>
> This JEP adopts a more space-efficient internal representation for strings.
>
> We propose to change the internal representation of the String class from
> a UTF-16 char array to a byte array plus an encoding-flag field. The new
> String class will store characters encoded either as ISO-8859-1/Latin-1
> (one byte per character), or as UTF-16 (two bytes per character), based
> upon the contents of the string. The encoding flag will indicate which
> encoding is used.
>
> I am quite certain there will be a benefit of that with Tomcat.

Rémy

[Bug 58660] Different redirect behaviour when accessing path without a /

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58660

--- Comment #11 from Remy Maucherat  ---
The issue is probably that the mapper rewrites (for mapping purposes I think) a
"no servlet path" as "/", and the default servlet has no way to know this
happened. If I remove this rewrite code, it doesn't work any better though.

If you make the root path redirection in default servlet completely functional,
then I'd say it's fine to keep the option (even enabled by default), but
otherwise ...

If it is acked avoiding the root path redirect in the mapper is not something
mandatory, it should be possible to add it back and remove the configuration
option for now to resolve the regression, and work on it for the next release.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58660] Different redirect behaviour when accessing path without a /

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58660

--- Comment #12 from Mark Thomas  ---
That is exactly the issue I have been working through. I think I have it solved
for the Default Servlet. I'm currently working on issue with FORM login at the
context root that Konstantin highlighted.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1716881 - /tomcat/trunk/java/org/apache/catalina/servlets/DefaultServlet.java

[markt]

Author: markt
Date: Fri Nov 27 14:39:23 2015
New Revision: 1716881

URL: http://svn.apache.org/viewvc?rev=1716881&view=rev
Log:
ServletPath is never null but it might be zero length.

Modified:
tomcat/trunk/java/org/apache/catalina/servlets/DefaultServlet.java

Modified: tomcat/trunk/java/org/apache/catalina/servlets/DefaultServlet.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/servlets/DefaultServlet.java?rev=1716881&r1=1716880&r2=1716881&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/servlets/DefaultServlet.java 
(original)
+++ tomcat/trunk/java/org/apache/catalina/servlets/DefaultServlet.java Fri Nov 
27 14:39:23 2015
@@ -350,11 +350,11 @@ public class DefaultServlet extends Http
 }
 
 StringBuilder result = new StringBuilder();
-if (servletPath != null) {
+if (servletPath.length() > 0) {
 result.append(servletPath);
-if (pathInfo != null) {
-result.append(pathInfo);
-}
+}
+if (pathInfo != null) {
+result.append(pathInfo);
 }
 if (result.length() == 0) {
 result.append('/');



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1716882 - in /tomcat/trunk/java/org/apache/catalina: authenticator/FormAuthenticator.java mapper/Mapper.java servlets/DefaultServlet.java

[markt]

Author: markt
Date: Fri Nov 27 14:52:27 2015
New Revision: 1716882

URL: http://svn.apache.org/viewvc?rev=1716882&view=rev
Log:
Fix https://bz.apache.org/bugzilla/show_bug.cgi?id=58660
With mapperContextRootRedirectEnabled ste to false, the redirect needs to be 
handled elsewhere.
- Ensure the Mapper does not add the '/'
- Handle the redirect in the DefaultServlet
- Add a redirect to FORM auth if auth is occurring at the context root else the 
login page could be submitted to the wrong web application

Modified:
tomcat/trunk/java/org/apache/catalina/authenticator/FormAuthenticator.java
tomcat/trunk/java/org/apache/catalina/mapper/Mapper.java
tomcat/trunk/java/org/apache/catalina/servlets/DefaultServlet.java

Modified: 
tomcat/trunk/java/org/apache/catalina/authenticator/FormAuthenticator.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/authenticator/FormAuthenticator.java?rev=1716882&r1=1716881&r2=1716882&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/authenticator/FormAuthenticator.java 
(original)
+++ tomcat/trunk/java/org/apache/catalina/authenticator/FormAuthenticator.java 
Fri Nov 27 14:52:27 2015
@@ -219,6 +219,20 @@ public class FormAuthenticator
 
 // No -- Save this request and redirect to the form login page
 if (!loginAction) {
+// If this request was to the root of the context without a 
trailing
+// '/', need to redirect to add it else the submit of the login 
form
+// may not go to the correct web application
+if (request.getServletPath().length() == 0 && 
request.getPathInfo() == null) {
+StringBuilder location = new StringBuilder(requestURI);
+location.append('/');
+if (request.getQueryString() != null) {
+location.append('?');
+location.append(request.getQueryString());
+}
+
response.sendRedirect(response.encodeRedirectURL(location.toString()));
+return false;
+}
+
 session = request.getSessionInternal(true);
 if (log.isDebugEnabled()) {
 log.debug("Save request in session '" + 
session.getIdInternal() + "'");

Modified: tomcat/trunk/java/org/apache/catalina/mapper/Mapper.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/mapper/Mapper.java?rev=1716882&r1=1716881&r2=1716882&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/mapper/Mapper.java (original)
+++ tomcat/trunk/java/org/apache/catalina/mapper/Mapper.java Fri Nov 27 
14:52:27 2015
@@ -835,20 +835,13 @@ public final class Mapper {
 
 int pathOffset = path.getOffset();
 int pathEnd = path.getEnd();
-int servletPath = pathOffset;
 boolean noServletPath = false;
 
 int length = contextVersion.path.length();
-if (length != (pathEnd - pathOffset)) {
-servletPath = pathOffset + length;
-} else {
+if (length == (pathEnd - pathOffset)) {
 noServletPath = true;
-path.append('/');
-pathOffset = path.getOffset();
-pathEnd = path.getEnd();
-servletPath = pathOffset+length;
 }
-
+int servletPath = pathOffset + length;
 path.setOffset(servletPath);
 
 // Rule 1 -- Exact Match
@@ -1002,7 +995,13 @@ public final class Mapper {
 char[] buf = path.getBuffer();
 if (contextVersion.resources != null && buf[pathEnd -1 ] != '/') {
 String pathStr = path.toString();
-WebResource file = 
contextVersion.resources.getResource(pathStr);
+WebResource file;
+// Handle context root
+if (pathStr.length() == 0) {
+file = contextVersion.resources.getResource("/");
+} else {
+file = contextVersion.resources.getResource(pathStr);
+}
 if (file != null && file.isDirectory() &&
 
mappingData.context.getMapperDirectoryRedirectEnabled()) {
 // Note: this mutates the path: do not do any processing

Modified: tomcat/trunk/java/org/apache/catalina/servlets/DefaultServlet.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/servlets/DefaultServlet.java?rev=1716882&r1=1716881&r2=1716882&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/servlets/DefaultServlet.java 
(original)
+++ tomcat/trunk/java/org/apache/catalina/servlets/DefaultServlet.java Fri Nov 
27 14:52:27 2015
@@ -331,6 +331,10 @@ public class DefaultServlet extends Http
  * @param request The servlet request we are processing
  */
 

[Bug 58660] Different redirect behaviour when accessing path without a /

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58660

--- Comment #13 from Mark Thomas  ---
I've committed my first pass at a fix for this to 9.0.x. Please test and I'll
work on a 8.0.x release as soon as we are happy with this.

At this point I'm still neutral on what the default should be for
mapperContextRootRedirectEnabled. I think Remy is in favor of it being true.
Any other views?

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

buildbot failure in ASF Buildbot on tomcat-trunk

[buildbot]

The Buildbot has detected a new failure on builder tomcat-trunk while building 
ASF Buildbot. Full details are available at:
http://ci.apache.org/builders/tomcat-trunk/builds/695

Buildbot URL: http://ci.apache.org/

Buildslave for this Build: silvanus_ubuntu

Build Reason: The AnyBranchScheduler scheduler named 'on-tomcat-commit' 
triggered this build
Build Source Stamp: [branch tomcat/trunk] 1716882
Blamelist: markt

BUILD FAILED: failed compile_1

Sincerely,
 -The Buildbot




-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1716886 - /tomcat/trunk/java/org/apache/catalina/servlets/WebdavServlet.java

[markt]

Author: markt
Date: Fri Nov 27 15:25:13 2015
New Revision: 1716886

URL: http://svn.apache.org/viewvc?rev=1716886&view=rev
Log:
Additional fix for BZ 58660
Need to override new method

Modified:
tomcat/trunk/java/org/apache/catalina/servlets/WebdavServlet.java

Modified: tomcat/trunk/java/org/apache/catalina/servlets/WebdavServlet.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/servlets/WebdavServlet.java?rev=1716886&r1=1716885&r2=1716886&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/servlets/WebdavServlet.java (original)
+++ tomcat/trunk/java/org/apache/catalina/servlets/WebdavServlet.java Fri Nov 
27 15:25:13 2015
@@ -375,6 +375,11 @@ public class WebdavServlet
  */
 @Override
 protected String getRelativePath(HttpServletRequest request) {
+return getRelativePath(request, false);
+}
+
+@Override
+protected String getRelativePath(HttpServletRequest request, boolean 
allowEmptyPath) {
 String pathInfo;
 
 if (request.getAttribute(RequestDispatcher.INCLUDE_REQUEST_URI) != 
null) {



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58660] Different redirect behaviour when accessing path without a /

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58660

--- Comment #14 from Remy Maucherat  ---
Testing looks ok (but I probably tested the same things you did). I would have
preferred not adding the root path redirect flag though.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1716894 - /tomcat/trunk/java/org/apache/catalina/mapper/Mapper.java

[markt]

Author: markt
Date: Fri Nov 27 16:11:23 2015
New Revision: 1716894

URL: http://svn.apache.org/viewvc?rev=1716894&view=rev
Log:
Additional fix for BZ 58660
When Mapper root redirect is enabled, ensure '/' is added to path for redirect

Modified:
tomcat/trunk/java/org/apache/catalina/mapper/Mapper.java

Modified: tomcat/trunk/java/org/apache/catalina/mapper/Mapper.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/mapper/Mapper.java?rev=1716894&r1=1716893&r2=1716894&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/mapper/Mapper.java (original)
+++ tomcat/trunk/java/org/apache/catalina/mapper/Mapper.java Fri Nov 27 
16:11:23 2015
@@ -879,8 +879,10 @@ public final class Mapper {
 if(mappingData.wrapper == null && noServletPath &&
 mappingData.context.getMapperContextRootRedirectEnabled()) {
 // The path is empty, redirect to "/"
+path.append('/');
+pathEnd = path.getEnd();
 mappingData.redirectPath.setChars
-(path.getBuffer(), pathOffset, pathEnd-pathOffset);
+(path.getBuffer(), pathOffset, pathEnd - pathOffset);
 path.setEnd(pathEnd - 1);
 return;
 }



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58660] Different redirect behaviour when accessing path without a /

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58660

--- Comment #15 from Mark Thomas  ---
I think there are valid use cases for the flag so I'd like to keep it but I'd
be happy to change the default.

I found a few issues with my first pass which I have now fixed. I'm currently
thinking more testing now and over the weekend with a back-port to 8.0.x
towards the end of the weekend and tag on Monday.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58662] blacklist some classes in custom ObjectInputStreams

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58662

Mark Thomas  changed:

   What|Removed |Added

 Status|NEW |RESOLVED
 Resolution|--- |INVALID

--- Comment #1 from Mark Thomas  ---
If an attacker can add a JAR to that directory then deserialization is likely
to be the least of your worries.

The recent spate of deserialization issues is only of concern if an application
accepts untrusted data and deserializes without validation/sanitization. A
default Tomcat install does not expose any such mechanism. If an application
chooses to accept such input then validation/sanitization is an application
concern.

I'll also note that security concerns should be raised via the security list,
not via a public bug tracker.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1716914 - in /tomcat/tc7.0.x/trunk: build.xml java/org/apache/tomcat/websocket/WsWebSocketContainer.java webapps/docs/changelog.xml

[markt]

Author: markt
Date: Fri Nov 27 20:29:40 2015
New Revision: 1716914

URL: http://svn.apache.org/viewvc?rev=1716914&view=rev
Log:
Fix https://bz.apache.org/bugzilla/show_bug.cgi?id=58658
Correct a regression in 7.0.66 that prevented Tomcat from starting on Java 6 
unless the WebSocket JARs (that require Java 7) were removed.

Modified:
tomcat/tc7.0.x/trunk/build.xml

tomcat/tc7.0.x/trunk/java/org/apache/tomcat/websocket/WsWebSocketContainer.java
tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml

Modified: tomcat/tc7.0.x/trunk/build.xml
URL: 
http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/build.xml?rev=1716914&r1=1716913&r2=1716914&view=diff
==
--- tomcat/tc7.0.x/trunk/build.xml (original)
+++ tomcat/tc7.0.x/trunk/build.xml Fri Nov 27 20:29:40 2015
@@ -675,8 +675,8 @@
 http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/tomcat/websocket/WsWebSocketContainer.java?rev=1716914&r1=1716913&r2=1716914&view=diff
==
--- 
tomcat/tc7.0.x/trunk/java/org/apache/tomcat/websocket/WsWebSocketContainer.java 
(original)
+++ 
tomcat/tc7.0.x/trunk/java/org/apache/tomcat/websocket/WsWebSocketContainer.java 
Fri Nov 27 20:29:40 2015
@@ -350,8 +350,7 @@ public class WsWebSocketContainer
 "wsWebSocketContainer.proxyConnectFail", 
selectedProxy,
 Integer.toString(httpResponse.getStatus(;
 }
-} catch (TimeoutException | InterruptedException | 
ExecutionException |
-EOFException e) {
+} catch (Exception e) {
 if (channel != null) {
 channel.close();
 }

Modified: tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml
URL: 
http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml?rev=1716914&r1=1716913&r2=1716914&view=diff
==
--- tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml (original)
+++ tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml Fri Nov 27 20:29:40 2015
@@ -58,6 +58,15 @@
   issues do not "pop up" wrt. others).
 -->
 
+  
+
+  
+58658: Correct a regression in 7.0.66 that prevented Tomcat
+from starting on Java 6 unless the WebSocket JARs (that require Java 7)
+were removed. (markt) 
+  
+
+  
 
 
   



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58658] 7.0.66 running with Java 6 fails unless unneeded "tomcat7-websocket.jar" is removed from lib/

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58658

Mark Thomas  changed:

   What|Removed |Added

 Resolution|--- |FIXED
 OS||All
 Status|NEW |RESOLVED

--- Comment #1 from Mark Thomas  ---
I've reverted r1715984 and refactored the code that required 1.7 so it compiles
with 1.6. The fix will be in 7.0.67 onwards.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58662] blacklist some classes in custom ObjectInputStreams

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58662

--- Comment #2 from romain.manni-bucau  ---
You dont need to be able to add a jar to lib directory. The point was a user
can do it in its installation and this can have side effects. Or do you mean
that adding a jar to tomcat/lib makes tomcat no more supported?

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58647] After blocking write timeout occurs, WsRemoteEndpointImplBase remains in BINARY_PARTIAL_WRITING state.

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58647

Mark Thomas  changed:

   What|Removed |Added

 Resolution|--- |WONTFIX
 Status|NEW |RESOLVED

--- Comment #3 from Mark Thomas  ---
Sorry, no.

TCP will handle short network outages. It you want to handle an outage longer
than your current timeout, increase the timeout.

After any I/O exception there are multiple unknowns:
- unable to determine what was written successfully to the network and what was
not
- the exception will have caused some of Tomcat's internal processing to be
skipped potentially leaving things like buffers in an unknown state

Without knowing how many bytes of the previous message have been written it is
impossible to recover the connection.

In short, I/O exceptions are fatal to the connection and have to be treated as
such.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58662] blacklist some classes in custom ObjectInputStreams

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58662

romain.manni-bucau  changed:

   What|Removed |Added

 Resolution|INVALID |---
 Status|RESOLVED|REOPENED

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58662] blacklist some classes in custom ObjectInputStreams

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58662

Mark Thomas  changed:

   What|Removed |Added

 Resolution|--- |INVALID
 Status|REOPENED|RESOLVED

--- Comment #3 from Mark Thomas  ---
If a system admin adds a JAR then it is a non-issue. To repeat my previous
comment:

The recent spate of deserialization issues is only of concern if an application
accepts untrusted data and deserializes without validation/sanitization. A
default Tomcat install does not expose any such mechanism.


Therefore, adding one of the known enabling JARs - or some currently unknown
enablign JAR - to Tomcat does not create a security issue that can be exploited
by a remote attacker.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 56917] Create a configuration to write relative 302 responses instead of absolute

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=56917

--- Comment #4 from Mark Thomas  ---
Good news. RFC2616 has been obsoleted by RFC7231 and friends. RFC7231 allows
redirects to be relative. This looks like it could turn into my favourite type
of bug report - one I can fix by deleting code :)

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58655] IllegalStateException: calling HttpServletResponse#sendRedirect() with RemoteIpFilter

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58655

--- Comment #2 from Mark Thomas  ---
Using relative redirects (see bug 56917) should make this fixable.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58647] After blocking write timeout occurs, WsRemoteEndpointImplBase remains in BINARY_PARTIAL_WRITING state.

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58647

--- Comment #4 from Alexander Malyshev  ---
Ok, may be you're right. In case it's unrecoverable, though, I don't see why
the connection is not closed in this case and I is left in this weird state.
It's not an issue for me to close it myself or wait for idle timeout, but,
anyway, it would be much better if container can do it (having in mind I may
have very long idle timeout in some cases).

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 58657] Spring DeferredResult errorResult response not returned in async servlet 3.1 mode

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58657

--- Comment #4 from Mark Thomas  ---
Your test case, while welcome, assumes the Tomcat developers are familiar with
Spring Boot.

A zip or tar.gz of the source tree, a pointer to a github project or similar to
build the WAR would be better. Assuming, of course, the build uses a standard
build tool like Ant, Maven, Gradle etc.

While the offer of the WAR is appreciated, cynical souls that we are, we aren't
too keen on running some random binary we know little about.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[GUMP@vmgump]: Project tomcat-tc8.0.x-test-nio2 (in module tomcat-8.0.x) failed

[Bill Barker]

To whom it may engage...

This is an automated request, but not an unsolicited one. For 
more information please visit http://gump.apache.org/nagged.html, 
and/or contact the folk at gene...@gump.apache.org.

Project tomcat-tc8.0.x-test-nio2 has an issue affecting its community 
integration.
This issue affects 1 projects.
The current state of this project is 'Failed', with reason 'Build Failed'.
For reference only, the following projects are affected by this:
- tomcat-tc8.0.x-test-nio2 :  Tomcat 8.x, a web server implementing the 
Java Servlet 3.1,
...


Full details are available at:

http://vmgump.apache.org/gump/public/tomcat-8.0.x/tomcat-tc8.0.x-test-nio2/index.html

That said, some information snippets are provided here.

The following annotations (debug/informational/warning/error messages) were 
provided:
 -DEBUG- Dependency on commons-daemon exists, no need to add for property 
commons-daemon.native.src.tgz.
 -DEBUG- Dependency on commons-daemon exists, no need to add for property 
tomcat-native.tar.gz.
 -INFO- Failed with reason build failed
 -INFO- Project Reports in: 
/srv/gump/public/workspace/tomcat-8.0.x/output/logs-NIO2
 -INFO- Project Reports in: 
/srv/gump/public/workspace/tomcat-8.0.x/output/test-tmp-NIO2/logs
 -WARNING- No directory 
[/srv/gump/public/workspace/tomcat-8.0.x/output/test-tmp-NIO2/logs]



The following work was performed:
http://vmgump.apache.org/gump/public/tomcat-8.0.x/tomcat-tc8.0.x-test-nio2/gump_work/build_tomcat-8.0.x_tomcat-tc8.0.x-test-nio2.html
Work Name: build_tomcat-8.0.x_tomcat-tc8.0.x-test-nio2 (Type: Build)
Work ended in a state of : Failed
Elapsed: 41 mins 58 secs
Command Line: /usr/lib/jvm/java-8-oracle/bin/java -Djava.awt.headless=true 
-Dbuild.sysclasspath=only org.apache.tools.ant.Main 
-Dgump.merge=/srv/gump/public/gump/work/merge.xml 
-Djunit.jar=/srv/gump/public/workspace/junit/target/junit-4.13-SNAPSHOT.jar 
-Dobjenesis.jar=/srv/gump/public/workspace/objenesis/main/target/objenesis-2.3-SNAPSHOT.jar
 -Dtest.reports=output/logs-NIO2 
-Dtomcat-native.tar.gz=/srv/gump/public/workspace/apache-commons/daemon/dist/bin/commons-daemon-20151128-native-src.tar.gz
 -Dexamples.sources.skip=true 
-Djdt.jar=/srv/gump/packages/eclipse/plugins/R-4.5-201506032000/ecj-4.5.jar 
-Dcommons-daemon.jar=/srv/gump/public/workspace/apache-commons/daemon/dist/commons-daemon-20151128.jar
 
-Dcommons-daemon.native.src.tgz=/srv/gump/public/workspace/apache-commons/daemon/dist/bin/commons-daemon-20151128-native-src.tar.gz
 -Dtest.temp=output/test-tmp-NIO2 -Dtest.accesslog=true 
-Dexecute.test.nio=false 
-Dtest.openssl.path=/srv/gump/public/workspace/openssl-1.0.2/dest-20151128/bin
 /openssl -Dexecute.test.bio=false -Dexecute.test.apr=false 
-Dtest.excludePerformance=true -Dexecute.test.nio2=true 
-Deasymock.jar=/srv/gump/public/workspace/easymock/core/target/easymock-3.5-SNAPSHOT.jar
 -Dhamcrest.jar=/srv/gump/packages/hamcrest/hamcrest-core-1.3.jar 
-Dcglib.jar=/srv/gump/packages/cglib/cglib-nodep-2.2.jar test 
[Working Directory: /srv/gump/public/workspace/tomcat-8.0.x]
CLASSPATH: 
/usr/lib/jvm/java-8-oracle/lib/tools.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/webapps/examples/WEB-INF/classes:/srv/gump/public/workspace/tomcat-8.0.x/output/testclasses:/srv/gump/public/workspace/ant/dist/lib/ant.jar:/srv/gump/public/workspace/ant/dist/lib/ant-launcher.jar:/srv/gump/public/workspace/ant/dist/lib/ant-jmf.jar:/srv/gump/public/workspace/ant/dist/lib/ant-junit.jar:/srv/gump/public/workspace/ant/dist/lib/ant-junit4.jar:/srv/gump/public/workspace/ant/dist/lib/ant-swing.jar:/srv/gump/public/workspace/ant/dist/lib/ant-apache-resolver.jar:/srv/gump/public/workspace/ant/dist/lib/ant-apache-xalan2.jar:/srv/gump/public/workspace/xml-commons/java/build/resolver.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/bin/bootstrap.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/bin/tomcat-juli.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/annotations-api.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/servlet-api.ja
 
r:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/jsp-api.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/el-api.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/websocket-api.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/catalina.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/catalina-ant.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/catalina-storeconfig.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/tomcat-coyote.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/jasper.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/jasper-el.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/catalina-tribes.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/catalina-ha.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/tomcat-api.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/l

[GUMP@vmgump]: Project tomcat-tc8.0.x-test-apr (in module tomcat-8.0.x) failed

[Bill Barker]

To whom it may engage...

This is an automated request, but not an unsolicited one. For 
more information please visit http://gump.apache.org/nagged.html, 
and/or contact the folk at gene...@gump.apache.org.

Project tomcat-tc8.0.x-test-apr has an issue affecting its community 
integration.
This issue affects 1 projects.
The current state of this project is 'Failed', with reason 'Build Failed'.
For reference only, the following projects are affected by this:
- tomcat-tc8.0.x-test-apr :  Tomcat 8.x, a web server implementing the Java 
Servlet 3.1,
...


Full details are available at:

http://vmgump.apache.org/gump/public/tomcat-8.0.x/tomcat-tc8.0.x-test-apr/index.html

That said, some information snippets are provided here.

The following annotations (debug/informational/warning/error messages) were 
provided:
 -DEBUG- Dependency on commons-daemon exists, no need to add for property 
commons-daemon.native.src.tgz.
 -DEBUG- Dependency on commons-daemon exists, no need to add for property 
tomcat-native.tar.gz.
 -INFO- Failed with reason build failed
 -INFO- Project Reports in: 
/srv/gump/public/workspace/tomcat-8.0.x/output/logs-APR
 -INFO- Project Reports in: 
/srv/gump/public/workspace/tomcat-8.0.x/output/test-tmp-APR/logs
 -WARNING- No directory 
[/srv/gump/public/workspace/tomcat-8.0.x/output/test-tmp-APR/logs]



The following work was performed:
http://vmgump.apache.org/gump/public/tomcat-8.0.x/tomcat-tc8.0.x-test-apr/gump_work/build_tomcat-8.0.x_tomcat-tc8.0.x-test-apr.html
Work Name: build_tomcat-8.0.x_tomcat-tc8.0.x-test-apr (Type: Build)
Work ended in a state of : Failed
Elapsed: 38 mins 49 secs
Command Line: /usr/lib/jvm/java-8-oracle/bin/java -Djava.awt.headless=true 
-Dbuild.sysclasspath=only org.apache.tools.ant.Main 
-Dgump.merge=/srv/gump/public/gump/work/merge.xml 
-Djunit.jar=/srv/gump/public/workspace/junit/target/junit-4.13-SNAPSHOT.jar 
-Dobjenesis.jar=/srv/gump/public/workspace/objenesis/main/target/objenesis-2.3-SNAPSHOT.jar
 -Dtest.reports=output/logs-APR 
-Dtomcat-native.tar.gz=/srv/gump/public/workspace/apache-commons/daemon/dist/bin/commons-daemon-20151128-native-src.tar.gz
 -Dexamples.sources.skip=true 
-Djdt.jar=/srv/gump/packages/eclipse/plugins/R-4.5-201506032000/ecj-4.5.jar 
-Dtest.apr.loc=/srv/gump/public/workspace/tomcat-native/dest-20151128/lib 
-Dcommons-daemon.jar=/srv/gump/public/workspace/apache-commons/daemon/dist/commons-daemon-20151128.jar
 
-Dcommons-daemon.native.src.tgz=/srv/gump/public/workspace/apache-commons/daemon/dist/bin/commons-daemon-20151128-native-src.tar.gz
 -Dtest.temp=output/test-tmp-APR -Dtest.accesslog=true -Dexecute.test.nio=false 
-Dtest
 
.openssl.path=/srv/gump/public/workspace/openssl-1.0.2/dest-20151128/bin/openssl
 -Dexecute.test.bio=false -Dexecute.test.apr=true 
-Dtest.excludePerformance=true -Dexecute.test.nio2=false 
-Deasymock.jar=/srv/gump/public/workspace/easymock/core/target/easymock-3.5-SNAPSHOT.jar
 -Dhamcrest.jar=/srv/gump/packages/hamcrest/hamcrest-core-1.3.jar 
-Dcglib.jar=/srv/gump/packages/cglib/cglib-nodep-2.2.jar test 
[Working Directory: /srv/gump/public/workspace/tomcat-8.0.x]
CLASSPATH: 
/usr/lib/jvm/java-8-oracle/lib/tools.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/webapps/examples/WEB-INF/classes:/srv/gump/public/workspace/tomcat-8.0.x/output/testclasses:/srv/gump/public/workspace/ant/dist/lib/ant.jar:/srv/gump/public/workspace/ant/dist/lib/ant-launcher.jar:/srv/gump/public/workspace/ant/dist/lib/ant-jmf.jar:/srv/gump/public/workspace/ant/dist/lib/ant-junit.jar:/srv/gump/public/workspace/ant/dist/lib/ant-junit4.jar:/srv/gump/public/workspace/ant/dist/lib/ant-swing.jar:/srv/gump/public/workspace/ant/dist/lib/ant-apache-resolver.jar:/srv/gump/public/workspace/ant/dist/lib/ant-apache-xalan2.jar:/srv/gump/public/workspace/xml-commons/java/build/resolver.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/bin/bootstrap.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/bin/tomcat-juli.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/annotations-api.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/servlet-api.ja
 
r:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/jsp-api.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/el-api.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/websocket-api.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/catalina.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/catalina-ant.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/catalina-storeconfig.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/tomcat-coyote.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/jasper.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/jasper-el.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/catalina-tribes.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/catalina-ha.jar:/srv/gump/public/workspace/tomcat-8.0.x/output/build/lib/tomc