[Bug 62150] Relative Paths have changd

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=62150

--- Comment #1 from Remy Maucherat  ---
Created attachment 35750
  --> https://bz.apache.org/bugzilla/attachment.cgi?id=35750&action=edit
Patch

Ok, I think it is risky to not use the normalized path instead. r1799115 which
changed this is still kind of odd to me, so I'll let Mark review the thing.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

JDK 10: Release Candidate & JDK 11 Early Access builds available

[Rory O'Donnell]

Hi Mark,

Can you confirm the fix in JDK 11

 * JDK-8195096 -
   Apache Tomcat
 o Exception with custom LogManager on starting Apache Tomcat


*JDK 10 build 45 is our JDK 10 Release Candidate and now available at 
http://jdk.java.net/10/*


 * Schedule, status & features
 o http://openjdk.java.net/projects/jdk/10/
 * Release Notes
 o http://jdk.java.net/10/release-notes
 * Summary of changes in b45:
 o JDK-8198658  -
   Docs still point to JDK 9 docs

*JDK 11 EA build 3, under both the GPL and Oracle EA licenses, are now 
available at **http://jdk.java.net/11**.*


 * Schedule, status & features
 o http://openjdk.java.net/projects/jdk/11/
 * Release Notes:
 o http://jdk.java.net/11/release-notes
 * Summary of changes
 o https://download.java.net/java/early_access/jdk11/2/jdk-11+2.html
 * JEPs targeted to JDK 11, so far
 o 309: Dynamic Class-File Constants 
 o 318: Epsilon: An Arbitrarily Low-Overhead Garbage Collector
   
 o *320: **Remove the Java EE and CORBA Modules
   *
   **
 + ** *This build includes JEP 320, so build is significantly
   smaller (nine fewer modules, 22 fewer megabyteson Linux/x64).*
 o 323: Local-Variable Syntax for Lambda Parameters
   
 * Open Source Project fixes in JDK 11 build 1
 o JDK-8195096 -
   Apache Tomcat
 + Exception with custom LogManager on starting Apache Tomcat
 o JDK-8193802 -
   Apache Maven
 + NullPointerException from JarFileSystem.getVersionMap()
 o JDK-8191842  -
   jOOQ
 + JShell: Inferred type information is lost when assigning
   types to a "var"

Finally, the Crypto roadmap 
 was updated - 
23-Feb-2018**

**

 * Add support for AEAD TLS Cipher Suites
 o Target date changed from 2018-04-17 to 2018-07-17


Regards,
Rory

--
Rgds,Rory O'Donnell
Quality Engineering Manager
Oracle EMEA , Dublin, Ireland

svn commit: r1825713 - in /tomcat/trunk: java/org/apache/catalina/manager/JMXProxyServlet.java webapps/docs/changelog.xml

[markt]

Author: markt
Date: Fri Mar  2 11:51:19 2018
New Revision: 1825713

URL: http://svn.apache.org/viewvc?rev=1825713&view=rev
Log:
Work-around a known, non-specification compliant behaviour in some versions of 
IE that can allow XSS when using the JMX proxy feature of the Manager 
application.
Based on a suggestion from Muthukumar Marikani.

Modified:
tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java
tomcat/trunk/webapps/docs/changelog.xml

Modified: tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java?rev=1825713&r1=1825712&r2=1825713&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java 
(original)
+++ tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java Fri Mar  
2 11:51:19 2018
@@ -84,6 +84,10 @@ public class JMXProxyServlet extends Htt
 public void doGet(HttpServletRequest request, HttpServletResponse response)
 throws IOException, ServletException {
 response.setContentType("text/plain");
+// Stop older versions of IE thinking they know best. We set text/plain
+// in the line above for a reason. IE's behaviour is unwanted at best
+// and dangerous at worst.
+response.setHeader("X-Content-Type-Options", "nosniff");
 
 PrintWriter writer = response.getWriter();
 

Modified: tomcat/trunk/webapps/docs/changelog.xml
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/webapps/docs/changelog.xml?rev=1825713&r1=1825712&r2=1825713&view=diff
==
--- tomcat/trunk/webapps/docs/changelog.xml (original)
+++ tomcat/trunk/webapps/docs/changelog.xml Fri Mar  2 11:51:19 2018
@@ -157,6 +157,12 @@
 Add support for specifying the application version when deploying an
 application via the Manager application HTML interface. (markt)
   
+  
+Work-around a known, non-specification compliant behaviour in some
+versions of IE that can allow XSS when using the JMX proxy feature of
+the Manager application. Based on a suggestion from Muthukumar 
Marikani.
+(markt)
+  
 
   
 



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1825714 - in /tomcat/tc8.5.x/trunk: ./ java/org/apache/catalina/manager/JMXProxyServlet.java webapps/docs/changelog.xml

[markt]

Author: markt
Date: Fri Mar  2 11:51:56 2018
New Revision: 1825714

URL: http://svn.apache.org/viewvc?rev=1825714&view=rev
Log:
Work-around a known, non-specification compliant behaviour in some versions of 
IE that can allow XSS when using the JMX proxy feature of the Manager 
application.
Based on a suggestion from Muthukumar Marikani.

Modified:
tomcat/tc8.5.x/trunk/   (props changed)
tomcat/tc8.5.x/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java
tomcat/tc8.5.x/trunk/webapps/docs/changelog.xml

Propchange: tomcat/tc8.5.x/trunk/
--
--- svn:mergeinfo (original)
+++ svn:mergeinfo Fri Mar  2 11:51:56 2018
@@ -1,2 +1,2 @@
 /tomcat/tc8.0.x/trunk:1809644
-/tomcat/trunk:1734785,1734799,1734845,1734928,1735041,1735044,1735480,1735577,1735597,1735599-1735600,1735615,1736145,1736162,1736209,1736280,1736297,1736299,1736489,1736646,1736703,1736836,1736849,1737104-1737105,1737112,1737117,1737119-1737120,1737155,1737157,1737192,1737280,1737339,1737632,1737664,1737715,1737748,1737785,1737834,1737860,1737903,1737959,1738005,1738007,1738014-1738015,1738018,1738022,1738039,1738043,1738059-1738060,1738147,1738149,1738174-1738175,1738261,1738589,1738623-1738625,1738643,1738816,1738850,1738855,1738946-1738948,1738953-1738954,1738979,1738982,1739079-1739081,1739087,1739113,1739153,1739172,1739176,1739191,1739474,1739492,1739726,1739762,1739775,1739814,1739817-1739818,1739975,1740131,1740324,1740465,1740495,1740508-1740509,1740520,1740535,1740707,1740803,1740810,1740969,1740980,1740991,1740997,1741015,1741033,1741036,1741058,1741060,1741080,1741147,1741159,1741164,1741173,1741181,1741190,1741197,1741202,1741208,1741213,1741221,1741225,1741232,1741409
 
,1741501,1741677,1741892,1741896,1741984,1742023,1742042,1742071,1742090,1742093,1742101,1742105,1742111,1742139,1742146,1742148,1742166,1742181,1742184,1742187,1742246,1742248-1742251,1742263-1742264,1742268,1742276,1742369,1742387,1742448,1742509-1742512,1742917,1742919,1742933,1742975-1742976,1742984,1742986,1743019,1743115,1743117,1743124-1743125,1743134,1743425,1743554,1743679,1743696-1743698,1743700-1743701,1744058,1744064-1744065,1744125,1744149,1744194,1744229,1744270,1744323,1744432,1744684,1744697,1744705,1744713,1744760,1744786,1745083,1745142-1745143,1745145,1745177,1745179-1745180,1745227,1745248,1745254,1745337,1745467,1745473,1745535,1745576,1745735,1745744,1746304,1746306-1746307,1746319,1746327,1746338,1746340-1746341,1746344,1746427,1746441,1746473,1746490,1746492,1746495-1746496,1746499-1746501,1746503-1746507,1746509,1746549,1746551,1746554,1746556,1746558,1746584,1746620,1746649,1746724,1746939,1746989,1747014,1747028,1747035,1747210,1747225,1747234,1747253,1747
 
404,1747506,1747536,1747924,1747980,1747993,1748001,1748253,1748452,1748547,1748629,1748676,1748715,1749287,1749296,1749328,1749373,1749465,1749506,1749508,1749665-1749666,1749763,1749865-1749866,1749898,1749978,1749980,1750011,1750015,1750056,1750480,1750617,1750634,1750692,1750697,1750700,1750703,1750707,1750714,1750718,1750723,1750774,1750899,1750975,1750995,1751061,1751097,1751173,1751438,1751447,1751463,1751702,1752212,1752737,1752745,1753078,1753080,1753358,1753363,1754111,1754140-1754141,1754281,1754310,1754445,1754467,1754494,1754496,1754528,1754532-1754533,1754613,1754714,1754874,1754941,1754944,1754950-1754951,1755005,1755007,1755009,1755132,1755180-1755181,1755185,1755190,1755204-1755206,1755208,1755214,1755224,1755227,1755230,1755629,1755646-1755647,1755650,1755653,1755675,1755680,1755683,1755693,1755717,1755731-1755737,1755812,1755828,1755884,1755890,1755918-1755919,1755942,1755958,1755960,1755970,1755993,1756013,1756019,1756039,1756056,1756083-1756114,1756175,1756288-1
 
756289,1756408-1756410,1756778,1756798,1756878,1756898,1756939,1757123-1757124,1757126,1757128,1757132-1757133,1757136,1757145,1757167-1757168,1757175,1757180,1757182,1757195,1757271,1757278,1757347,1757353-1757354,1757363,1757374,1757399,1757406,1757408,1757485,1757495,1757499,1757527,1757578,1757684,1757722,1757727,1757790,1757799,1757813,1757853,1757883,1757903,1757976,1757997,1758000,1758058,1758072-1758075,1758078-1758079,1758223,1758257,1758261,1758276,1758292,1758369,1758378-1758383,1758421,1758423,1758425-1758427,1758430,1758443,1758448,1758459,1758483,1758486-1758487,1758499,1758525,1758556,1758580,1758582,1758584,1758588,1758842,1759019,1759212,1759224,1759227,1759252,1759274,1759513-1759516,1759611,1759757,1759785-1759790,1760005,1760022,1760109-1760110,1760135,1760200-1760201,1760227,1760300,1760397,1760446,1760454,1760640,1760648,1761057,1761422,1761491,1761498,1761500-1761501,1761550,1761553,1761572,1761574,1761625-1761626,1761628,1761682,1761740,1761752,1762051-176205
 
3,1762123,1762168,1762172,1762182,1762201-1762202,1762204,1762208,1762288,1762296,1762324,1762348,1762353,1762362,1762374,1762492,1762503,1762505,1762541,1762608,1762710,1762753,1762766,1762769,1762944,1762947,1762953,1763167,1763179,17632

svn commit: r1825715 - in /tomcat/tc8.0.x/trunk: ./ java/org/apache/catalina/manager/JMXProxyServlet.java webapps/docs/changelog.xml

[markt]

Author: markt
Date: Fri Mar  2 11:54:18 2018
New Revision: 1825715

URL: http://svn.apache.org/viewvc?rev=1825715&view=rev
Log:
Work-around a known, non-specification compliant behaviour in some versions of 
IE that can allow XSS when using the JMX proxy feature of the Manager 
application.
Based on a suggestion from Muthukumar Marikani.

Modified:
tomcat/tc8.0.x/trunk/   (props changed)
tomcat/tc8.0.x/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java
tomcat/tc8.0.x/trunk/webapps/docs/changelog.xml

Propchange: tomcat/tc8.0.x/trunk/
--
--- svn:mergeinfo (original)
+++ svn:mergeinfo Fri Mar  2 11:54:18 2018
@@ -1,2 +1,2 @@
 
/tomcat/tc8.5.x/trunk:1735042,1737966,1743139-1743140,1744151,1747537,1747925,1748002,1754614,1754643,1762124,1762183,1762203,1763792,1772948,1777014,1779719,1782037,1782240,1782386-1782387,1785669,1786845,1788249,1788324,1788905,1789216,1789335,1791528,1791558,1796697-1796698,1797521,1798543,1799162,1800143,1801693,1802805,1806799,1807079-1807080,1808880,1809831,1812093,1812143,1812145,1812319,1814975,1815945,1815956,1820207,1822186,1823164,1823497,1824960
-/tomcat/trunk:1636524,1637156,1637176,1637188,1637331,1637684,1637695,1637890,1637892,1638720-1638725,1639653,1640010,1640083-1640084,1640088,1640275,1640322,1640347,1640361,1640365,1640403,1640410,1640652,1640655-1640658,1640688,1640700-1640883,1640903,1640976,1640978,1641000,1641026,1641038-1641039,1641051-1641052,1641058,1641064,1641300,1641369,1641374,1641380,1641486,1641634,1641656-1641692,1641704,1641707-1641718,1641720-1641722,1641735,1641981,1642233,1642280,1642554,1642564,1642595,1642606,1642668,1642679,1642697,1642699,1642766,1643002,1643045,1643054-1643055,1643066,1643121,1643128,1643206,1643209-1643210,1643216,1643249,1643270,1643283,1643309-1643310,1643323,1643365-1643366,1643370-1643371,1643465,1643474,1643536,1643570,1643634,1643649,1643651,1643654,1643675,1643731,1643733-1643734,1643761,1643766,1643814,1643937,1643963,1644017,1644169,1644201-1644203,1644321,1644323,1644516,1644523,1644529,1644535,1644730,1644768,1644784-1644785,1644790,1644793,1644815,1644884,1644886
 
,1644890,1644892,1644910,1644924,1644929-1644930,1644935,1644989,1645011,1645247,1645355,1645357-1645358,1645455,1645465,1645469,1645471,1645473,1645475,1645486-1645488,1645626,1645641,1645685,1645743,1645763,1645951-1645953,1645955,1645993,1646098-1646106,1646178,1646220,1646302,1646304,1646420,1646470-1646471,1646476,1646559,1646717-1646723,1646773,1647026,1647042,1647530,1647655,1648304,1648815,1648907,1649973,1650081,1650365,1651116,1651120,1651280,1651470,1652938,1652970,1653041,1653471,1653550,1653574,1653797,1653815-1653816,1653819,1653840,1653857,1653888,1653972,1654013,1654030,1654050,1654123,1654148,1654159,1654513,1654515,1654517,1654522,1654524,1654725,1654735,1654766,1654785,1654851-1654852,1654978,1655122-1655124,1655126-1655127,1655129-1655130,1655132-1655133,1655312,1655351,1655438,1655441,1655454,168,1656087,1656299,1656319,1656331,1656345,1656350,1656590,1656648-1656650,1656657,1657041,1657054,1657374,1657492,1657510,1657565,1657580,1657584,1657586,1657589,1657
 
592,1657607,1657609,1657682,1657907,1658207,1658734,1658781,1658790,1658799,1658802,1658804,1658833,1658840,1658966,1659043,1659053,1659059,1659174,1659184,1659188-1659189,1659216,1659263,1659293,1659304,1659306-1659307,1659382,1659384,1659428,1659471,1659486,1659505,1659516,1659521,1659524,1659559,1659562,1659803,1659806,1659814,1659833,1659862,1659905,1659919,1659948,1659967,1659983-1659984,1660060,1660074,1660077,1660133,1660168,1660331-1660332,1660353,1660358,1660924,1661386,1661770,1661867,1661972,1661990,1662200,1662308-1662309,1662548,1662614,1662696,1662736,1662985,1662988-1662989,1663264,1663277,1663298,1663534,1663562,1663676,1663715,1663754,1663768,1663772,1663781,1663893,1663995,1664143,1664163,1664174,1664301,1664317,1664347,1664657,1664659,1664710,1664863-1664864,1664866,1665085,1665292,1665559,1665653,1665661,1665672,1665694,1665697,1665736,1665779,1665976-1665977,1665980-1665981,1665985-1665986,1665989,1665998,1666004,1666008,1666013,1666017,1666024,1666116,1666386-1
 
666387,1666494,1666496,1666552,1666569,1666579,137,149,1666757,1666966,1666972,1666985,1666995,1666997,1667292,1667402,1667406,1667546,1667615,1667630,1667636,1667688,1667764,1667871,1668026,1668135,1668193,1668593,1668596,1668630,1668639,1668843,1669353,1669370,1669451,1669800,1669838,1669876,1669882,1670394,1670433,1670591,1670598-1670600,1670610,1670631,1670719,1670724,1670726,1670730,1670940,1671112,1672272,1672284,1673754,1674294,1675461,1675486,1675594,1675830,1676231,1676250-1676251,1676364,1676381,1676393,1676479,1676525,1676552,1676615,1676630,1676634,1676721,1676926,1676943,1677140,1677802,1678011,1678162,1678174,1678339,1678426-1678427,1678694,1678701,1679534,1679708,1679710,1679716,1680034,1680246,1681056,1681123,1681138,1681280,1681283,1681286,1681450,1681697,1681699,1681701

svn commit: r1825716 - in /tomcat/tc7.0.x/trunk: ./ java/org/apache/catalina/manager/JMXProxyServlet.java webapps/docs/changelog.xml

[markt]

Author: markt
Date: Fri Mar  2 11:54:54 2018
New Revision: 1825716

URL: http://svn.apache.org/viewvc?rev=1825716&view=rev
Log:
Work-around a known, non-specification compliant behaviour in some versions of 
IE that can allow XSS when using the JMX proxy feature of the Manager 
application.
Based on a suggestion from Muthukumar Marikani.

Modified:
tomcat/tc7.0.x/trunk/   (props changed)
tomcat/tc7.0.x/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java
tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml

Propchange: tomcat/tc7.0.x/trunk/
--
--- svn:mergeinfo (original)
+++ svn:mergeinfo Fri Mar  2 11:54:54 2018
@@ -1,3 +1,3 @@
-/tomcat/tc8.0.x/trunk:1636525,1637336,1637685,1637709,1638726,1640089,1640276,1640349,1640363,1640366,1640642,1640672,1640674,1640689,1640884,1641001,1641065,1641067,1641375,1641638,1641723,1641726,1641729-1641730,1641736,1641988,1642669-1642670,1642698,1642701,1643205,1643215,1643217,1643230,1643232,1643273,1643285,1643329-1643330,1643511,1643513,1643521,1643539,1643571,1643581-1643582,1643635,1643655,1643738,1643964,1644018,1644333,1644525,1644954,1644992,1645014,1645360,1645456,1645627,1645642,1645686,1645903-1645904,1645908-1645909,1645913,1645920,1646458,1646460-1646462,1646735,1646738-1646741,1646744,1646746,1646748-1646755,1646757,1646759-1646760,1647043,1648816,1651420-1651422,1651844,1652926,1652939-1652940,1652973,1653798,1653817,1653841,1654042,1654161,1654736,1654767,1654787,1656592,1659907,1662986,1663265,1663278,1663325,1663535,1663567,1663679,1663997,1664175,1664321,1664872,1665061,1665086,1666027,1666395,1666503,1666506,1666560,1666570,1666581,1666759,1666967,1666988
 
,1667553-1667555,1667558,1667617,1667633,1667637,1667747,1667767,1667873,1668028,1668137,1668634,1669432,1669801,1669840,1669895-1669896,1670398,1670435,1670592,1670605-1670607,1670609,1670632,1670720,1670725,1670727,1670731,1671114,1672273,1672285,1673759,1674220,1674295,1675469,1675488,1675595,1675831,1676232,1676367-1676369,1676382,1676394,1676483,1676556,1676635,1678178,1679536,1679988,1680256,1681124,1681182,1681703,1681730,1681840,1681864,1681869,1682010,1682034,1682047,1682052-1682053,1682062,1682064,1682070,1682312,1682325,1682331,1682386,1684367,1684385,1685759,1685774,1685827,1685892,1687341,1688904,1689358,1689657,1689921,1692850,1693093,1693108,1693324,1694060,1694115,1694291,1694427,1694431,1694503,1694549,1694789,1694873,1694881,1695356,1695372,1695823-1695825,1696200,1696281,1696379,1696468,1700608,1700871,1700897,1700978,1701094,1701124,1701608,1701668,1701676,1701766,1701944,1702248,1702252,1702314,1702390,1702723,1702725,1702728,1702730,1702733,1702735,1702737,1702
 
739,1702742,1702744,1702748,1702751,1702754,1702758,1702760,1702763,1702766,1708779,1708782,1708806,1709314,1709670,1710347,1710442,1710448,1710490,1710574,1710578,1712226,1712229,1712235,1712255,1712618,1712649,1712655,1712860,1712899,1712903,1712906,1712913,1712926,1712975,1713185,1713262,1713287,1713613,1713621,1713872,1713976,1713994,1713998,1714004,1714013,1714059,1714538,1714580,1715189,1715207,1715544,1715549,1715637,1715639-1715645,1715667,1715683,1715866,1715978,1715981,1716216-1716217,1716355,1716414,1716421,1717208-1717209,1717257,1717283,1717288,1717291,1717421,1717517,1717529,1718797,1718840-1718843,1719348,1719357-1719358,1719400,1719491,1719737,1720235,1720396,1720442,1720446,1720450,1720463,1720658-1720660,1720756,1720816,1721813,1721818,1721831,1721861,1721867,1721882,1722523,1722527,1722800,1722926,1722941,1722997,1723130,1723440,1723488,1723890,1724434,1724674,1724792,1724803,1724902,1725128,1725131,1725154,1725167,1725911,1725921,1725929,1725963-1725965,1725970,1
 
725974,1726171-1726173,1726175,1726179-1726182,1726190-1726191,1726195-1726200,1726203,1726226,1726576,1726630,1726992,1727029,1727037,1727671,1727676,1727900,1728028,1728092,1728439,1728449,1729186,1729362,1731009,1731303,1731867,1731872,1731874,1731876,1731885,1731947,1731955,1731959,1731977,1731984,1732360,1732490,1732672,1732902,1733166,1733603,1733619,1733735,1733752,1733764,1733915,1733941,1733964,1734115,1734133,1734261,1734421,1734531,1736286,1737967,1738173,1738182,1738992,1739039,1739089-1739091,1739294,1739777,1739821,1739981,1740513,1740726,1741019,1741162,1741217,1743647,1743681,1744152,1744272,1746732,1746750,1752739,1754615,1755886,1756018,1758563,1759565,1761686,1762173,1762206,1766280,1767507-1767508,1767653,1767656,1769267,1772949,1773521,1773527,1774104,1777015,1777213,1779330,1783151,1784188,1784966,1785670,1786846,1788260,1788999,1789140,1789402,1791529,1791559,1795291,1796906,1797523,1799214,1800998-1800999,1801003,1801007-1801008,1801017,1801020,1802808,180281
 
4,1803618,1806107,1806733,1807082-1807083,1808707,1808884,1809267,1809644,1809832,1809904,1809915,1809924,1810283,1810328,1810574,1810576-1810577,1810584,1810588,1811141,1811842,1812090,1812096,1812150,1812511,1814976,1814983,1815072,1815453,1815946,1815957,1816143,1816

[Bug 62150] Relative Paths have changd

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=62150

Mark Thomas  changed:

   What|Removed |Added

 OS||All

--- Comment #2 from Mark Thomas  ---
It maybe that the scope of r1799115 that was intended to fix Bug 61185 was a
little too wide. I'll take a look.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 62150] Relative Paths have changd

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=62150

--- Comment #3 from Myron Uecker  ---
It was one of those questionable decisions somebody made years ago in our code
to use relative paths for navigation that no longer works after that change.
Thank you for looking at this.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 62150] Relative Paths have changd

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=62150

--- Comment #4 from Remy Maucherat  ---
Using a relative path to get the RD is not bad. However, far more unusual is
using the requestURI, since you have to deal with annoying stuff when you do
that (URL encoding ...).

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

Re: svn commit: r1825713 - in /tomcat/trunk: java/org/apache/catalina/manager/JMXProxyServlet.java webapps/docs/changelog.xml

[Konstantin Kolinko]

2018-03-02 14:51 GMT+03:00  :
> Author: markt
> Date: Fri Mar  2 11:51:19 2018
> New Revision: 1825713
>
> URL: http://svn.apache.org/viewvc?rev=1825713&view=rev
> Log:
> Work-around a known, non-specification compliant behaviour in some versions 
> of IE that can allow XSS when using the JMX proxy feature of the Manager 
> application.
> Based on a suggestion from Muthukumar Marikani.

It may be worth to add the same to ManagerServlet, HostManagerServlet
that use text/plain as well.

Also ManagerServlet, HostManagerServlet have an explicit charset in
their mime-type,
response.setContentType("text/plain;charset="+Constants.CHARSET);


> Modified:
> tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java
> tomcat/trunk/webapps/docs/changelog.xml
>
> Modified: tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java
> URL: 
> http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java?rev=1825713&r1=1825712&r2=1825713&view=diff
> ==
> --- tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java 
> (original)
> +++ tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java Fri 
> Mar  2 11:51:19 2018
> @@ -84,6 +84,10 @@ public class JMXProxyServlet extends Htt
>  public void doGet(HttpServletRequest request, HttpServletResponse 
> response)
>  throws IOException, ServletException {
>  response.setContentType("text/plain");
> +// Stop older versions of IE thinking they know best. We set 
> text/plain
> +// in the line above for a reason. IE's behaviour is unwanted at best
> +// and dangerous at worst.
> +response.setHeader("X-Content-Type-Options", "nosniff");
>
>  PrintWriter writer = response.getWriter();
>
>
> Modified: tomcat/trunk/webapps/docs/changelog.xml
> URL: 
> http://svn.apache.org/viewvc/tomcat/trunk/webapps/docs/changelog.xml?rev=1825713&r1=1825712&r2=1825713&view=diff
> ==
> --- tomcat/trunk/webapps/docs/changelog.xml (original)
> +++ tomcat/trunk/webapps/docs/changelog.xml Fri Mar  2 11:51:19 2018
> @@ -157,6 +157,12 @@
>  Add support for specifying the application version when deploying an
>  application via the Manager application HTML interface. (markt)
>
> +  
> +Work-around a known, non-specification compliant behaviour in some
> +versions of IE that can allow XSS when using the JMX proxy feature of
> +the Manager application. Based on a suggestion from Muthukumar 
> Marikani.
> +(markt)
> +  
>  
>
>  
>
>
>
> -
> To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: dev-h...@tomcat.apache.org
>

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 62150] Relative Paths have changd

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=62150

--- Comment #5 from Mark Thomas  ---
Indeed. The behaviour of getRequestURI() is at the root of this bug report and
bug 61185.

In terms of guidance from the spec, what we have is:

- getRequestURI() Returns the part of this request's URL from the protocol name
up to the query string in the first line of the HTTP request. The web container
does not decode this String.

- For forward(), the path elements of the request object exposed to the target
servlet must reflect the path used to obtain the RequestDispatcher.


The implication that the value returned by getRequestURI() is unencoded is that
it is also not normalized. This is because, for untrusted URIs, you have to
decode first to ensure any encoded '.' or '/' characters are correctly handled.

Note that for a RequestDispatcher we have a little more leeway because the
paths are trusted.

Bug 61185 was, essentially, that if an encoded path was used to obtain a
RequestDispatcher then when getRequestURI() was called it should return that
original, encoded path.

By extension, if a non-normalized absolute path is used to obtain a request
dispatcher then the expectation is that, for a forward(), getRequestURI()
should return that original, non-normalized path.

Where things get tricky is when a RequestDispatcher is obtained via a relative
path. Which path should the relative path be resolved against (original or
decoded + normalized) and should the path be normalized after it has been made
absolute?

Maybe some examples will help:

Original RD Path URI after forward()
/aaa/bbb zzz /aaa/zzz
/aaa/../bbb  zzz /zzz
 /aaa/../zzz
/aaa/bbb ../zzz  /zzz
 /aaa/../zzz
/aaa/bbb/../ccc  zzz/xxx/../yyy  /aaa/bbb/../zzz/xxx/../yyy
 /aaa/zzz/xxx/../yyy
 /aaa/zzz/yyy

Looking at these I'm leaning towards the current behaviour as being closest to
the intention of the spec but I confess that is a purely subjective judgement.

Feedback and further thoughts on the above welcome.

If we do want to normalize something here, I do think the proposed patch isn't
quite right as a RequestDispatcher obtained with a non-normalized path would
not then return that non-normalized path for getRequestURI() after a forward.
If we go this route I think the normalization would need to be earlier.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 62150] Relative Paths have changd

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=62150

Remy Maucherat  changed:

   What|Removed |Added

   Severity|normal  |enhancement

--- Comment #6 from Remy Maucherat  ---
Ok, so the option is to put a normalize step in Request.getRequestDispatcher if
this is a relative path. The problem is it's a bit more annoying to do it
earlier as it needs splitting the query string before putting it back.

If you think it is compliant, let's do nothing. Or it could be something
optional with a config setting (there's context.getDispatchersUseEncodedPaths
too). I'll update the bug to be a possible enhancement.

Overall, the spec provides requestURI, but it's mostly useless as you have to
replicate the same complex processing on it that the container does to avoid
security problems.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1825734 - /tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java

[markt]

Author: markt
Date: Fri Mar  2 17:01:35 2018
New Revision: 1825734

URL: http://svn.apache.org/viewvc?rev=1825734&view=rev
Log:
Add a characterset to the JMX text output

Modified:
tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java

Modified: tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java?rev=1825734&r1=1825733&r2=1825734&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java 
(original)
+++ tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java Fri Mar  
2 17:01:35 2018
@@ -83,7 +83,7 @@ public class JMXProxyServlet extends Htt
 @Override
 public void doGet(HttpServletRequest request, HttpServletResponse response)
 throws IOException, ServletException {
-response.setContentType("text/plain");
+response.setContentType("text/plain;charset=" + Constants.CHARSET);
 // Stop older versions of IE thinking they know best. We set text/plain
 // in the line above for a reason. IE's behaviour is unwanted at best
 // and dangerous at worst.



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

Re: svn commit: r1825713 - in /tomcat/trunk: java/org/apache/catalina/manager/JMXProxyServlet.java webapps/docs/changelog.xml

[Mark Thomas]

On 02/03/18 15:33, Konstantin Kolinko wrote:
> 2018-03-02 14:51 GMT+03:00  :
>> Author: markt
>> Date: Fri Mar  2 11:51:19 2018
>> New Revision: 1825713
>>
>> URL: http://svn.apache.org/viewvc?rev=1825713&view=rev
>> Log:
>> Work-around a known, non-specification compliant behaviour in some versions 
>> of IE that can allow XSS when using the JMX proxy feature of the Manager 
>> application.
>> Based on a suggestion from Muthukumar Marikani.
> 
> It may be worth to add the same to ManagerServlet, HostManagerServlet
> that use text/plain as well.

I'm not sure. I'll take a closer look but the first one I looked at was
HTML escaped because it is used by both Manager and HTMLManager.

> Also ManagerServlet, HostManagerServlet have an explicit charset in
> their mime-type,
> response.setContentType("text/plain;charset="+Constants.CHARSET);

Good catch. I've added that the JMX text output.

Mark

> 
> 
>> Modified:
>> tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java
>> tomcat/trunk/webapps/docs/changelog.xml
>>
>> Modified: tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java
>> URL: 
>> http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java?rev=1825713&r1=1825712&r2=1825713&view=diff
>> ==
>> --- tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java 
>> (original)
>> +++ tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java Fri 
>> Mar  2 11:51:19 2018
>> @@ -84,6 +84,10 @@ public class JMXProxyServlet extends Htt
>>  public void doGet(HttpServletRequest request, HttpServletResponse 
>> response)
>>  throws IOException, ServletException {
>>  response.setContentType("text/plain");
>> +// Stop older versions of IE thinking they know best. We set 
>> text/plain
>> +// in the line above for a reason. IE's behaviour is unwanted at 
>> best
>> +// and dangerous at worst.
>> +response.setHeader("X-Content-Type-Options", "nosniff");
>>
>>  PrintWriter writer = response.getWriter();
>>
>>
>> Modified: tomcat/trunk/webapps/docs/changelog.xml
>> URL: 
>> http://svn.apache.org/viewvc/tomcat/trunk/webapps/docs/changelog.xml?rev=1825713&r1=1825712&r2=1825713&view=diff
>> ==
>> --- tomcat/trunk/webapps/docs/changelog.xml (original)
>> +++ tomcat/trunk/webapps/docs/changelog.xml Fri Mar  2 11:51:19 2018
>> @@ -157,6 +157,12 @@
>>  Add support for specifying the application version when deploying an
>>  application via the Manager application HTML interface. (markt)
>>
>> +  
>> +Work-around a known, non-specification compliant behaviour in some
>> +versions of IE that can allow XSS when using the JMX proxy feature 
>> of
>> +the Manager application. Based on a suggestion from Muthukumar 
>> Marikani.
>> +(markt)
>> +  
>>  
>>
>>  
>>
>>
>>
>> -
>> To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
>> For additional commands, e-mail: dev-h...@tomcat.apache.org
>>
> 
> -
> To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: dev-h...@tomcat.apache.org
> 


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

Re: svn commit: r1825713 - in /tomcat/trunk: java/org/apache/catalina/manager/JMXProxyServlet.java webapps/docs/changelog.xml

[Mark Thomas]

On 02/03/18 17:05, Mark Thomas wrote:
> On 02/03/18 15:33, Konstantin Kolinko wrote:
>> 2018-03-02 14:51 GMT+03:00  :
>>> Author: markt
>>> Date: Fri Mar  2 11:51:19 2018
>>> New Revision: 1825713
>>>
>>> URL: http://svn.apache.org/viewvc?rev=1825713&view=rev
>>> Log:
>>> Work-around a known, non-specification compliant behaviour in some versions 
>>> of IE that can allow XSS when using the JMX proxy feature of the Manager 
>>> application.
>>> Based on a suggestion from Muthukumar Marikani.
>>
>> It may be worth to add the same to ManagerServlet, HostManagerServlet
>> that use text/plain as well.
> 
> I'm not sure. I'll take a closer look but the first one I looked at was
> HTML escaped because it is used by both Manager and HTMLManager.

It didn't take me long to find a route to an unescaped value. I'll
expand this work-around to cover all the Manger and Host Manager
servlets that return text/plain.

Mark

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1825738 - in /tomcat/trunk: java/org/apache/catalina/manager/JMXProxyServlet.java java/org/apache/catalina/manager/ManagerServlet.java java/org/apache/catalina/manager/host/HostManagerSer

[markt]

Author: markt
Date: Fri Mar  2 18:45:28 2018
New Revision: 1825738

URL: http://svn.apache.org/viewvc?rev=1825738&view=rev
Log:
Extend work-around to all text/plain responses from Manager and Host Manager.

Modified:
tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java
tomcat/trunk/java/org/apache/catalina/manager/ManagerServlet.java
tomcat/trunk/java/org/apache/catalina/manager/host/HostManagerServlet.java
tomcat/trunk/webapps/docs/changelog.xml

Modified: tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java?rev=1825738&r1=1825737&r2=1825738&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java 
(original)
+++ tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java Fri Mar  
2 18:45:28 2018
@@ -88,7 +88,6 @@ public class JMXProxyServlet extends Htt
 // in the line above for a reason. IE's behaviour is unwanted at best
 // and dangerous at worst.
 response.setHeader("X-Content-Type-Options", "nosniff");
-
 PrintWriter writer = response.getWriter();
 
 if (mBeanServer == null) {

Modified: tomcat/trunk/java/org/apache/catalina/manager/ManagerServlet.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/manager/ManagerServlet.java?rev=1825738&r1=1825737&r2=1825738&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/manager/ManagerServlet.java (original)
+++ tomcat/trunk/java/org/apache/catalina/manager/ManagerServlet.java Fri Mar  
2 18:45:28 2018
@@ -340,6 +340,10 @@ public class ManagerServlet extends Http
 
 // Prepare our output writer to generate the response message
 response.setContentType("text/plain; charset=" + Constants.CHARSET);
+// Stop older versions of IE thinking they know best. We set text/plain
+// in the line above for a reason. IE's behaviour is unwanted at best
+// and dangerous at worst.
+response.setHeader("X-Content-Type-Options", "nosniff");
 PrintWriter writer = response.getWriter();
 
 // Process the requested command
@@ -435,6 +439,10 @@ public class ManagerServlet extends Http
 
 // Prepare our output writer to generate the response message
 response.setContentType("text/plain;charset="+Constants.CHARSET);
+// Stop older versions of IE thinking they know best. We set text/plain
+// in the line above for a reason. IE's behaviour is unwanted at best
+// and dangerous at worst.
+response.setHeader("X-Content-Type-Options", "nosniff");
 PrintWriter writer = response.getWriter();
 
 // Process the requested command

Modified: 
tomcat/trunk/java/org/apache/catalina/manager/host/HostManagerServlet.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/manager/host/HostManagerServlet.java?rev=1825738&r1=1825737&r2=1825738&view=diff
==
--- tomcat/trunk/java/org/apache/catalina/manager/host/HostManagerServlet.java 
(original)
+++ tomcat/trunk/java/org/apache/catalina/manager/host/HostManagerServlet.java 
Fri Mar  2 18:45:28 2018
@@ -205,6 +205,10 @@ public class HostManagerServlet
 
 // Prepare our output writer to generate the response message
 response.setContentType("text/plain; charset=" + Constants.CHARSET);
+// Stop older versions of IE thinking they know best. We set text/plain
+// in the line above for a reason. IE's behaviour is unwanted at best
+// and dangerous at worst.
+response.setHeader("X-Content-Type-Options", "nosniff");
 PrintWriter writer = response.getWriter();
 
 // Process the requested command

Modified: tomcat/trunk/webapps/docs/changelog.xml
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/webapps/docs/changelog.xml?rev=1825738&r1=1825737&r2=1825738&view=diff
==
--- tomcat/trunk/webapps/docs/changelog.xml (original)
+++ tomcat/trunk/webapps/docs/changelog.xml Fri Mar  2 18:45:28 2018
@@ -159,8 +159,8 @@
   
   
 Work-around a known, non-specification compliant behaviour in some
-versions of IE that can allow XSS when using the JMX proxy feature of
-the Manager application. Based on a suggestion from Muthukumar 
Marikani.
+versions of IE that can allow XSS when the Manager application 
generates
+a plain text response. Based on a suggestion from Muthukumar Marikani.
 (markt)
   
 



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev

[Bug 62150] Behavior of relative paths with RequestDispatcher has changed

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=62150

Christopher Schultz  changed:

   What|Removed |Added

Summary|Relative Paths have changd  |Behavior of relative paths
   ||with RequestDispatcher has
   ||changed

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

Re: svn commit: r1825734 - /tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java

[Christopher Schultz]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Mark,

On 3/2/18 12:01 PM, ma...@apache.org wrote:
> Author: markt Date: Fri Mar  2 17:01:35 2018 New Revision: 1825734
> 
> URL: http://svn.apache.org/viewvc?rev=1825734&view=rev Log: Add a
> characterset to the JMX text output
> 
> Modified: 
> tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java
> 
> Modified:
> tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java 
> URL:
> http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/man
ager/JMXProxyServlet.java?rev=1825734&r1=1825733&r2=1825734&view=diff
>
> 

==
> ---
> tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java
> (original) +++
> tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java
> Fri Mar  2 17:01:35 2018 @@ -83,7 +83,7 @@ public class
> JMXProxyServlet extends Htt @Override public void
> doGet(HttpServletRequest request, HttpServletResponse response) 
> throws IOException, ServletException { -
> response.setContentType("text/plain"); +
> response.setContentType("text/plain;charset=" +
> Constants.CHARSET);

Would it be better to do this instead:

 response.setContentType("text/plain;charset="
  + response.getCharacterEncoding());

Even if the encoding is *supposed* to be UTF-8 (like the constant
suggests), in case it isn't for whatever reason, we should use the
encoding that is actually being used, instead of what we expect to be
used.

- -chris
-BEGIN PGP SIGNATURE-
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQJRBAEBCAA7FiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlqZn4kdHGNocmlzQGNo
cmlzdG9waGVyc2NodWx0ei5uZXQACgkQHPApP6U8pFgyKQ//RVH1zS19GHdPTnWq
0E4Q5y4Ifs2So2VIWzbypmgjHeSnfmlMsXM2/dI4SxdD8G3mOqruTF8NsSxbvya6
aS7jlywLeHNXgJ97NwK4ze9/FjJJTQi8khr1B5sVZzTgL9ZAH4JW2P5/l5Oh2ETm
8IRJgR75MKm21VvmOwgakYDr2SQJckyORDbAHdtPT1NtYJ93WhnLTEmBhT7+t46n
b0zaSfYmusk/OPPimJljguXbkw0ydmirlpGXocEk9GFy59AdRmjNTCLSM/jQlzHx
h94M29UxdIbf0/UNF/+sSTUyxrDtc8GHWTLUaCSiS7tFk/2fV8UnmQRNna/ZSZHF
1yiG1PDFQW+UXlx7JkUp7KUSM/bZgW64SI9Zvqu659VJ2xAcG70qk0VytTQA8CHO
QXVTHrWn/6DuZ892JDPxafLeoWBA8DfGhZeVcSzGbXb5wFFRErZ0+OaiVe+OTTTD
l4fyrDlH69x20fvIObt9twte2Da6dUMzA+FxxubEpORuGf9nKdl11EON9ot0B8LL
EYay3E7isdMST2KeQVh0mVNxPW3qpStjxtF4p2Dwwke7h77gJp+1MXirUKrHmvGH
8azRKHdcVOd+8NeWLK34uQwDz30NH/X1SJmlySQ/hnyKN2udQTn7NEREfLk2AYbp
sJL/URUtyE2X+PdaqpEHVwWAUWc=
=4xK/
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

Re: svn commit: r1825734 - /tomcat/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java

[Mark Thomas]

On 02/03/18 19:01, Christopher Schultz wrote:



> Would it be better to do this instead:
> 
>  response.setContentType("text/plain;charset="
>   + response.getCharacterEncoding());
> 
> Even if the encoding is *supposed* to be UTF-8 (like the constant
> suggests), in case it isn't for whatever reason, we should use the
> encoding that is actually being used, instead of what we expect to be
> used.

We should be in full control of the response so it can be any encoding
we want. Can't it?

Mark

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1825743 - in /tomcat/tc8.5.x/trunk: ./ java/org/apache/catalina/manager/JMXProxyServlet.java java/org/apache/catalina/manager/ManagerServlet.java java/org/apache/catalina/manager/host/Hos

[markt]

Author: markt
Date: Fri Mar  2 19:18:30 2018
New Revision: 1825743

URL: http://svn.apache.org/viewvc?rev=1825743&view=rev
Log:
Extend work-around to all text/plain responses from Manager and Host Manager.

Modified:
tomcat/tc8.5.x/trunk/   (props changed)
tomcat/tc8.5.x/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java
tomcat/tc8.5.x/trunk/java/org/apache/catalina/manager/ManagerServlet.java

tomcat/tc8.5.x/trunk/java/org/apache/catalina/manager/host/HostManagerServlet.java
tomcat/tc8.5.x/trunk/webapps/docs/changelog.xml

Propchange: tomcat/tc8.5.x/trunk/
--
--- svn:mergeinfo (original)
+++ svn:mergeinfo Fri Mar  2 19:18:30 2018
@@ -1,2 +1,2 @@
 /tomcat/tc8.0.x/trunk:1809644
-/tomcat/trunk:1734785,1734799,1734845,1734928,1735041,1735044,1735480,1735577,1735597,1735599-1735600,1735615,1736145,1736162,1736209,1736280,1736297,1736299,1736489,1736646,1736703,1736836,1736849,1737104-1737105,1737112,1737117,1737119-1737120,1737155,1737157,1737192,1737280,1737339,1737632,1737664,1737715,1737748,1737785,1737834,1737860,1737903,1737959,1738005,1738007,1738014-1738015,1738018,1738022,1738039,1738043,1738059-1738060,1738147,1738149,1738174-1738175,1738261,1738589,1738623-1738625,1738643,1738816,1738850,1738855,1738946-1738948,1738953-1738954,1738979,1738982,1739079-1739081,1739087,1739113,1739153,1739172,1739176,1739191,1739474,1739492,1739726,1739762,1739775,1739814,1739817-1739818,1739975,1740131,1740324,1740465,1740495,1740508-1740509,1740520,1740535,1740707,1740803,1740810,1740969,1740980,1740991,1740997,1741015,1741033,1741036,1741058,1741060,1741080,1741147,1741159,1741164,1741173,1741181,1741190,1741197,1741202,1741208,1741213,1741221,1741225,1741232,1741409
 
,1741501,1741677,1741892,1741896,1741984,1742023,1742042,1742071,1742090,1742093,1742101,1742105,1742111,1742139,1742146,1742148,1742166,1742181,1742184,1742187,1742246,1742248-1742251,1742263-1742264,1742268,1742276,1742369,1742387,1742448,1742509-1742512,1742917,1742919,1742933,1742975-1742976,1742984,1742986,1743019,1743115,1743117,1743124-1743125,1743134,1743425,1743554,1743679,1743696-1743698,1743700-1743701,1744058,1744064-1744065,1744125,1744149,1744194,1744229,1744270,1744323,1744432,1744684,1744697,1744705,1744713,1744760,1744786,1745083,1745142-1745143,1745145,1745177,1745179-1745180,1745227,1745248,1745254,1745337,1745467,1745473,1745535,1745576,1745735,1745744,1746304,1746306-1746307,1746319,1746327,1746338,1746340-1746341,1746344,1746427,1746441,1746473,1746490,1746492,1746495-1746496,1746499-1746501,1746503-1746507,1746509,1746549,1746551,1746554,1746556,1746558,1746584,1746620,1746649,1746724,1746939,1746989,1747014,1747028,1747035,1747210,1747225,1747234,1747253,1747
 
404,1747506,1747536,1747924,1747980,1747993,1748001,1748253,1748452,1748547,1748629,1748676,1748715,1749287,1749296,1749328,1749373,1749465,1749506,1749508,1749665-1749666,1749763,1749865-1749866,1749898,1749978,1749980,1750011,1750015,1750056,1750480,1750617,1750634,1750692,1750697,1750700,1750703,1750707,1750714,1750718,1750723,1750774,1750899,1750975,1750995,1751061,1751097,1751173,1751438,1751447,1751463,1751702,1752212,1752737,1752745,1753078,1753080,1753358,1753363,1754111,1754140-1754141,1754281,1754310,1754445,1754467,1754494,1754496,1754528,1754532-1754533,1754613,1754714,1754874,1754941,1754944,1754950-1754951,1755005,1755007,1755009,1755132,1755180-1755181,1755185,1755190,1755204-1755206,1755208,1755214,1755224,1755227,1755230,1755629,1755646-1755647,1755650,1755653,1755675,1755680,1755683,1755693,1755717,1755731-1755737,1755812,1755828,1755884,1755890,1755918-1755919,1755942,1755958,1755960,1755970,1755993,1756013,1756019,1756039,1756056,1756083-1756114,1756175,1756288-1
 
756289,1756408-1756410,1756778,1756798,1756878,1756898,1756939,1757123-1757124,1757126,1757128,1757132-1757133,1757136,1757145,1757167-1757168,1757175,1757180,1757182,1757195,1757271,1757278,1757347,1757353-1757354,1757363,1757374,1757399,1757406,1757408,1757485,1757495,1757499,1757527,1757578,1757684,1757722,1757727,1757790,1757799,1757813,1757853,1757883,1757903,1757976,1757997,1758000,1758058,1758072-1758075,1758078-1758079,1758223,1758257,1758261,1758276,1758292,1758369,1758378-1758383,1758421,1758423,1758425-1758427,1758430,1758443,1758448,1758459,1758483,1758486-1758487,1758499,1758525,1758556,1758580,1758582,1758584,1758588,1758842,1759019,1759212,1759224,1759227,1759252,1759274,1759513-1759516,1759611,1759757,1759785-1759790,1760005,1760022,1760109-1760110,1760135,1760200-1760201,1760227,1760300,1760397,1760446,1760454,1760640,1760648,1761057,1761422,1761491,1761498,1761500-1761501,1761550,1761553,1761572,1761574,1761625-1761626,1761628,1761682,1761740,1761752,1762051-176205
 
3,1762123,1762168,1762172,1762182,1762201-1762202,1762204,1762208,1762288,1762296,1762324,1762348,1762353,1762362,1762374,1762492,1762503,1762505,1762541,1762608,1762710,1762753,1762766,1762769,1762944,17629

svn commit: r1825744 - in /tomcat/tc8.0.x/trunk: ./ java/org/apache/catalina/manager/JMXProxyServlet.java java/org/apache/catalina/manager/ManagerServlet.java java/org/apache/catalina/manager/host/Hos

[markt]

Author: markt
Date: Fri Mar  2 19:19:01 2018
New Revision: 1825744

URL: http://svn.apache.org/viewvc?rev=1825744&view=rev
Log:
Extend work-around to all text/plain responses from Manager and Host Manager.

Modified:
tomcat/tc8.0.x/trunk/   (props changed)
tomcat/tc8.0.x/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java
tomcat/tc8.0.x/trunk/java/org/apache/catalina/manager/ManagerServlet.java

tomcat/tc8.0.x/trunk/java/org/apache/catalina/manager/host/HostManagerServlet.java
tomcat/tc8.0.x/trunk/webapps/docs/changelog.xml

Propchange: tomcat/tc8.0.x/trunk/
--
--- svn:mergeinfo (original)
+++ svn:mergeinfo Fri Mar  2 19:19:01 2018
@@ -1,2 +1,2 @@
 
/tomcat/tc8.5.x/trunk:1735042,1737966,1743139-1743140,1744151,1747537,1747925,1748002,1754614,1754643,1762124,1762183,1762203,1763792,1772948,1777014,1779719,1782037,1782240,1782386-1782387,1785669,1786845,1788249,1788324,1788905,1789216,1789335,1791528,1791558,1796697-1796698,1797521,1798543,1799162,1800143,1801693,1802805,1806799,1807079-1807080,1808880,1809831,1812093,1812143,1812145,1812319,1814975,1815945,1815956,1820207,1822186,1823164,1823497,1824960
-/tomcat/trunk:1636524,1637156,1637176,1637188,1637331,1637684,1637695,1637890,1637892,1638720-1638725,1639653,1640010,1640083-1640084,1640088,1640275,1640322,1640347,1640361,1640365,1640403,1640410,1640652,1640655-1640658,1640688,1640700-1640883,1640903,1640976,1640978,1641000,1641026,1641038-1641039,1641051-1641052,1641058,1641064,1641300,1641369,1641374,1641380,1641486,1641634,1641656-1641692,1641704,1641707-1641718,1641720-1641722,1641735,1641981,1642233,1642280,1642554,1642564,1642595,1642606,1642668,1642679,1642697,1642699,1642766,1643002,1643045,1643054-1643055,1643066,1643121,1643128,1643206,1643209-1643210,1643216,1643249,1643270,1643283,1643309-1643310,1643323,1643365-1643366,1643370-1643371,1643465,1643474,1643536,1643570,1643634,1643649,1643651,1643654,1643675,1643731,1643733-1643734,1643761,1643766,1643814,1643937,1643963,1644017,1644169,1644201-1644203,1644321,1644323,1644516,1644523,1644529,1644535,1644730,1644768,1644784-1644785,1644790,1644793,1644815,1644884,1644886
 
,1644890,1644892,1644910,1644924,1644929-1644930,1644935,1644989,1645011,1645247,1645355,1645357-1645358,1645455,1645465,1645469,1645471,1645473,1645475,1645486-1645488,1645626,1645641,1645685,1645743,1645763,1645951-1645953,1645955,1645993,1646098-1646106,1646178,1646220,1646302,1646304,1646420,1646470-1646471,1646476,1646559,1646717-1646723,1646773,1647026,1647042,1647530,1647655,1648304,1648815,1648907,1649973,1650081,1650365,1651116,1651120,1651280,1651470,1652938,1652970,1653041,1653471,1653550,1653574,1653797,1653815-1653816,1653819,1653840,1653857,1653888,1653972,1654013,1654030,1654050,1654123,1654148,1654159,1654513,1654515,1654517,1654522,1654524,1654725,1654735,1654766,1654785,1654851-1654852,1654978,1655122-1655124,1655126-1655127,1655129-1655130,1655132-1655133,1655312,1655351,1655438,1655441,1655454,168,1656087,1656299,1656319,1656331,1656345,1656350,1656590,1656648-1656650,1656657,1657041,1657054,1657374,1657492,1657510,1657565,1657580,1657584,1657586,1657589,1657
 
592,1657607,1657609,1657682,1657907,1658207,1658734,1658781,1658790,1658799,1658802,1658804,1658833,1658840,1658966,1659043,1659053,1659059,1659174,1659184,1659188-1659189,1659216,1659263,1659293,1659304,1659306-1659307,1659382,1659384,1659428,1659471,1659486,1659505,1659516,1659521,1659524,1659559,1659562,1659803,1659806,1659814,1659833,1659862,1659905,1659919,1659948,1659967,1659983-1659984,1660060,1660074,1660077,1660133,1660168,1660331-1660332,1660353,1660358,1660924,1661386,1661770,1661867,1661972,1661990,1662200,1662308-1662309,1662548,1662614,1662696,1662736,1662985,1662988-1662989,1663264,1663277,1663298,1663534,1663562,1663676,1663715,1663754,1663768,1663772,1663781,1663893,1663995,1664143,1664163,1664174,1664301,1664317,1664347,1664657,1664659,1664710,1664863-1664864,1664866,1665085,1665292,1665559,1665653,1665661,1665672,1665694,1665697,1665736,1665779,1665976-1665977,1665980-1665981,1665985-1665986,1665989,1665998,1666004,1666008,1666013,1666017,1666024,1666116,1666386-1
 
666387,1666494,1666496,1666552,1666569,1666579,137,149,1666757,1666966,1666972,1666985,1666995,1666997,1667292,1667402,1667406,1667546,1667615,1667630,1667636,1667688,1667764,1667871,1668026,1668135,1668193,1668593,1668596,1668630,1668639,1668843,1669353,1669370,1669451,1669800,1669838,1669876,1669882,1670394,1670433,1670591,1670598-1670600,1670610,1670631,1670719,1670724,1670726,1670730,1670940,1671112,1672272,1672284,1673754,1674294,1675461,1675486,1675594,1675830,1676231,1676250-1676251,1676364,1676381,1676393,1676479,1676525,1676552,1676615,1676630,1676634,1676721,1676926,1676943,1677140,1677802,1678011,1678162,1678174,1678339,1678426-1678427,1678694,1678701,1679534,1679708,1679710,1679716,1680034,1680246,1681056,1681123,1681138,1681280,1681283,1681286

svn commit: r1825745 - in /tomcat/tc7.0.x/trunk: ./ java/org/apache/catalina/manager/JMXProxyServlet.java java/org/apache/catalina/manager/ManagerServlet.java java/org/apache/catalina/manager/host/Hos

[markt]

Author: markt
Date: Fri Mar  2 19:19:34 2018
New Revision: 1825745

URL: http://svn.apache.org/viewvc?rev=1825745&view=rev
Log:
Extend work-around to all text/plain responses from Manager and Host Manager.

Modified:
tomcat/tc7.0.x/trunk/   (props changed)
tomcat/tc7.0.x/trunk/java/org/apache/catalina/manager/JMXProxyServlet.java
tomcat/tc7.0.x/trunk/java/org/apache/catalina/manager/ManagerServlet.java

tomcat/tc7.0.x/trunk/java/org/apache/catalina/manager/host/HostManagerServlet.java
tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml

Propchange: tomcat/tc7.0.x/trunk/
--
--- svn:mergeinfo (original)
+++ svn:mergeinfo Fri Mar  2 19:19:34 2018
@@ -1,3 +1,3 @@
 
/tomcat/tc8.0.x/trunk:1636525,1637336,1637685,1637709,1638726,1640089,1640276,1640349,1640363,1640366,1640642,1640672,1640674,1640689,1640884,1641001,1641065,1641067,1641375,1641638,1641723,1641726,1641729-1641730,1641736,1641988,1642669-1642670,1642698,1642701,1643205,1643215,1643217,1643230,1643232,1643273,1643285,1643329-1643330,1643511,1643513,1643521,1643539,1643571,1643581-1643582,1643635,1643655,1643738,1643964,1644018,1644333,1644525,1644954,1644992,1645014,1645360,1645456,1645627,1645642,1645686,1645903-1645904,1645908-1645909,1645913,1645920,1646458,1646460-1646462,1646735,1646738-1646741,1646744,1646746,1646748-1646755,1646757,1646759-1646760,1647043,1648816,1651420-1651422,1651844,1652926,1652939-1652940,1652973,1653798,1653817,1653841,1654042,1654161,1654736,1654767,1654787,1656592,1659907,1662986,1663265,1663278,1663325,1663535,1663567,1663679,1663997,1664175,1664321,1664872,1665061,1665086,1666027,1666395,1666503,1666506,1666560,1666570,1666581,1666759,1666967,1666988
 
,1667553-1667555,1667558,1667617,1667633,1667637,1667747,1667767,1667873,1668028,1668137,1668634,1669432,1669801,1669840,1669895-1669896,1670398,1670435,1670592,1670605-1670607,1670609,1670632,1670720,1670725,1670727,1670731,1671114,1672273,1672285,1673759,1674220,1674295,1675469,1675488,1675595,1675831,1676232,1676367-1676369,1676382,1676394,1676483,1676556,1676635,1678178,1679536,1679988,1680256,1681124,1681182,1681703,1681730,1681840,1681864,1681869,1682010,1682034,1682047,1682052-1682053,1682062,1682064,1682070,1682312,1682325,1682331,1682386,1684367,1684385,1685759,1685774,1685827,1685892,1687341,1688904,1689358,1689657,1689921,1692850,1693093,1693108,1693324,1694060,1694115,1694291,1694427,1694431,1694503,1694549,1694789,1694873,1694881,1695356,1695372,1695823-1695825,1696200,1696281,1696379,1696468,1700608,1700871,1700897,1700978,1701094,1701124,1701608,1701668,1701676,1701766,1701944,1702248,1702252,1702314,1702390,1702723,1702725,1702728,1702730,1702733,1702735,1702737,1702
 
739,1702742,1702744,1702748,1702751,1702754,1702758,1702760,1702763,1702766,1708779,1708782,1708806,1709314,1709670,1710347,1710442,1710448,1710490,1710574,1710578,1712226,1712229,1712235,1712255,1712618,1712649,1712655,1712860,1712899,1712903,1712906,1712913,1712926,1712975,1713185,1713262,1713287,1713613,1713621,1713872,1713976,1713994,1713998,1714004,1714013,1714059,1714538,1714580,1715189,1715207,1715544,1715549,1715637,1715639-1715645,1715667,1715683,1715866,1715978,1715981,1716216-1716217,1716355,1716414,1716421,1717208-1717209,1717257,1717283,1717288,1717291,1717421,1717517,1717529,1718797,1718840-1718843,1719348,1719357-1719358,1719400,1719491,1719737,1720235,1720396,1720442,1720446,1720450,1720463,1720658-1720660,1720756,1720816,1721813,1721818,1721831,1721861,1721867,1721882,1722523,1722527,1722800,1722926,1722941,1722997,1723130,1723440,1723488,1723890,1724434,1724674,1724792,1724803,1724902,1725128,1725131,1725154,1725167,1725911,1725921,1725929,1725963-1725965,1725970,1
 
725974,1726171-1726173,1726175,1726179-1726182,1726190-1726191,1726195-1726200,1726203,1726226,1726576,1726630,1726992,1727029,1727037,1727671,1727676,1727900,1728028,1728092,1728439,1728449,1729186,1729362,1731009,1731303,1731867,1731872,1731874,1731876,1731885,1731947,1731955,1731959,1731977,1731984,1732360,1732490,1732672,1732902,1733166,1733603,1733619,1733735,1733752,1733764,1733915,1733941,1733964,1734115,1734133,1734261,1734421,1734531,1736286,1737967,1738173,1738182,1738992,1739039,1739089-1739091,1739294,1739777,1739821,1739981,1740513,1740726,1741019,1741162,1741217,1743647,1743681,1744152,1744272,1746732,1746750,1752739,1754615,1755886,1756018,1758563,1759565,1761686,1762173,1762206,1766280,1767507-1767508,1767653,1767656,1769267,1772949,1773521,1773527,1774104,1777015,1777213,1779330,1783151,1784188,1784966,1785670,1786846,1788260,1788999,1789140,1789402,1791529,1791559,1795291,1796906,1797523,1799214,1800998-1800999,1801003,1801007-1801008,1801017,1801020,1802808,180281
 
4,1803618,1806107,1806733,1807082-1807083,1808707,1808884,1809267,1809644,1809832,1809904,1809915,1809924,1810283,1810328,1810574,1810576-1810577,1810584,1810588,1811141,1811842,1812090,1812096,1812150,1812511,1814976,1814983,1815072,181

Re: JDK 10: Release Candidate & JDK 11 Early Access builds available

[Mark Thomas]

On 02/03/18 11:15, Rory O'Donnell wrote:
> 
> Hi Mark,
> 
> Can you confirm the fix in JDK 11>
>  * JDK-8195096 -
>    Apache Tomcat
>  o Exception with custom LogManager on starting Apache Tomcat

Confirmed. This is fixed in JDK 11 EA3.

Any plans to fix this in JDK 10 ?

Thanks,

Mark

> *JDK 10 build 45 is our JDK 10 Release Candidate and now available at
> http://jdk.java.net/10/*
> 
>  * Schedule, status & features
>  o http://openjdk.java.net/projects/jdk/10/
>  * Release Notes
>  o http://jdk.java.net/10/release-notes
>  * Summary of changes in b45:
>  o JDK-8198658  -
>    Docs still point to JDK 9 docs
> 
> *JDK 11 EA build 3, under both the GPL and Oracle EA licenses, are now
> available at **http://jdk.java.net/11**.*
> 
>  * Schedule, status & features
>  o http://openjdk.java.net/projects/jdk/11/
>  * Release Notes:
>  o http://jdk.java.net/11/release-notes
>  * Summary of changes
>  o https://download.java.net/java/early_access/jdk11/2/jdk-11+2.html
>  * JEPs targeted to JDK 11, so far
>  o 309: Dynamic Class-File Constants 
>  o 318: Epsilon: An Arbitrarily Low-Overhead Garbage Collector
>    
>  o *320: **Remove the Java EE and CORBA Modules
>    *
>    **
>  + ** *This build includes JEP 320, so build is significantly
>    smaller (nine fewer modules, 22 fewer megabyteson Linux/x64).*
>  o 323: Local-Variable Syntax for Lambda Parameters
>    
>  * Open Source Project fixes in JDK 11 build 1
>  o JDK-8195096 -
>    Apache Tomcat
>  + Exception with custom LogManager on starting Apache Tomcat
>  o JDK-8193802 -
>    Apache Maven
>  + NullPointerException from JarFileSystem.getVersionMap()
>  o JDK-8191842  -
>    jOOQ
>  + JShell: Inferred type information is lost when assigning
>    types to a "var"
> 
> Finally, the Crypto roadmap
>  was updated -
> 23-Feb-2018**
> **
> 
>  * Add support for AEAD TLS Cipher Suites
>  o Target date changed from 2018-04-17 to 2018-07-17
> 
> 
> Regards,
> Rory
> 


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 62146] Support to add customized KeyManager like "trustManagerClassName" did.

[bugzilla]

https://bz.apache.org/bugzilla/show_bug.cgi?id=62146

--- Comment #3 from Wang, Simon <18616998...@163.com> ---
Thanks for your comments. could you give more details about Tomcat-8.5
reloading TLS config?

Another concern is: that's big impact for us to upgrade Tomcat7 to Tomcat-8.5.
Could you give a hand to review my PR to see whether there are potential risk
for this patch. We could use this patch for ourselves first, then later upgrade
to Tomcat-8.5 after have thorough testing and evaluation on potential changes.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org