[Tomcat 8.5] : Calling [asyncError()] is not valid for a request with Async state [COMPLETING]

2018-05-05 Thread Anees Shaikh 
Hi,

I am using using *tomcat-embed-core-8.5.11*, with JDK 8, OS : Linux

I am getting following error very frequently. Please can you help.

ERROR [http-nio-auto-1-exec-6] o.a.c.c.CoyoteAdapter:181 : Exception while
processing an asynchronous request java.lang.IllegalStateException: Calling
[asyncError()] is not valid for a request with Async state [COMPLETING] at
org.apache.coyote.AsyncStateMachine.asyncError(AsyncStateMachine.java:397)
at org.apache.coyote.AbstractProcessor.action(AbstractProcessor.java:389)
at org.apache.coyote.Request.action(Request.java:391) at
org.apache.catalina.core.AsyncContextImpl.setErrorState(AsyncContextImpl.java:380)
at 
org.apache.catalina.connector.CoyoteAdapter.asyncDispatch(CoyoteAdapter.java:180)
at org.apache.coyote.AbstractProcessor.dispatch(AbstractProcessor.java:221)
at org.apache.coyote.AbstractProcessorLight.process(
AbstractProcessorLight.java:53) at org.apache.coyote.AbstractProtocol$
ConnectionHandler.process(AbstractProtocol.java:798) at
org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1434)
at 
org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at 
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at 
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at 
org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:748)
As per your documentation.



As per tomcat documentation for 8.0.25 is the above issue fixed ?
Tomcat 8.0.25 (markt)

   - [image: Fix:] 58192
   : Correct a
   regression in the previous fix for 58023
   . Ensure that
   classes are associated with their manifest even if the class file is first
   read (and cached) without the manifest. (markt)
   - [image: Fix:] *Fix thread safety issue in
   the AsyncContext implementation that meant a sequence
   of start();dispatch(); calls using non-container threads could result in a
   previous dispatch interfering with a subsequent start. (markt)*


Thanks and regards,
Anees Shaikh
Technical Lead - Loginext Solutions Pvt. Ltd
+91 7875043336

-- 
This message (including any attachments) contains confidential information 
intended for a specific individual and purpose, and is protected by law and 
is the property of LogiNext. If you are not the intended recipient, you 
should delete this message. Any disclosure, copying, or distribution of 
this message, or the taking of any action based on it, is strictly 
prohibited.

svn commit: r1830971 - in /tomcat/tc7.0.x/trunk: RELEASE-NOTES RUNNING.txt

2018-05-05 Thread kkolinko 
Author: kkolinko
Date: Sat May  5 13:05:54 2018
New Revision: 1830971

URL: http://svn.apache.org/viewvc?rev=1830971&view=rev
Log:
For https://bz.apache.org/bugzilla/show_bug.cgi?id=62353
Clarify the effect of using the wrong version of Common Annotations.

Modified:
tomcat/tc7.0.x/trunk/RELEASE-NOTES
tomcat/tc7.0.x/trunk/RUNNING.txt

Modified: tomcat/tc7.0.x/trunk/RELEASE-NOTES
URL: 
http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/RELEASE-NOTES?rev=1830971&r1=1830970&r2=1830971&view=diff
==
--- tomcat/tc7.0.x/trunk/RELEASE-NOTES (original)
+++ tomcat/tc7.0.x/trunk/RELEASE-NOTES Sat May  5 13:05:54 2018
@@ -98,7 +98,7 @@ Bundled APIs:
 =
 A standard installation of Tomcat @VERSION_MAJOR_MINOR@ makes all of the 
following APIs available
 for use by web applications (by placing them in "lib"):
-* annotations-api.jar (Annotations package)
+* annotations-api.jar (Common Annotations 1.1 package)
 * catalina.jar (Tomcat Catalina implementation)
 * catalina-ant.jar (Tomcat Catalina Ant tasks)
 * catalina-ha.jar (High availability package)
@@ -121,15 +121,16 @@ You can make additional APIs available t
 putting unpacked classes into a "classes" directory (not created by default),
 or by placing them in JAR files in the "lib" directory.
 
-To override the XML parser implementation or interfaces, use the endorsed
-mechanism of the JVM. The default configuration defines JARs located in
-"$CATALINA_HOME/endorsed" as endorsed. This mechanism is no longer supported
-with Java 9.
+To override the XML parser implementation or interfaces, use the Endorsed
+Standards Override mechanism of the JVM. The default configuration defines
+JARs located in "$CATALINA_HOME/endorsed" as endorsed. This mechanism is
+no longer supported with Java 9.
 
 When running on Java 6, the Common Annotations 1.0 implementation provided
 by the JRE will be used. To use the Common Annotations 1.1 provided by
-Tomcat, use the endorsed mechanism of the JVM. The default configuration
-defines JARs located in "$CATALINA_HOME/endorsed" as endorsed.
+Tomcat, use the Endorsed Standards Override mechanism of the JVM. The
+default configuration defines JARs located in "$CATALINA_HOME/endorsed" as
+endorsed.
 
 
 

Modified: tomcat/tc7.0.x/trunk/RUNNING.txt
URL: 
http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/RUNNING.txt?rev=1830971&r1=1830970&r2=1830971&view=diff
==
--- tomcat/tc7.0.x/trunk/RUNNING.txt (original)
+++ tomcat/tc7.0.x/trunk/RUNNING.txt Sat May  5 13:05:54 2018
@@ -40,10 +40,17 @@ Running With JRE 6 Or Later
 
 (1.3) When running on Java 6, the Common Annotations 1.0 implementation
   provided by the JRE will be used. To use the Common Annotations 1.1
-  provided by Tomcat, use the endorsed mechanism of the JVM. The
-  default configuration defines JARs located in
+  provided by Tomcat, use the Endorsed Standards Override mechanism
+  of the JVM. The default configuration defines JARs located in
   "$CATALINA_HOME/endorsed" as endorsed.
 
+  Note: Java 6 includes a subset of Common Annotations 1.0 classes.
+
+  The only known difference between versions 1.0 and 1.1 of those
+  classes is introduction of "lookup" element on Resource annotation.
+
+  Majority of web applications will not notice the difference.
+
 (2) Download and Install Apache Tomcat
 
 (2.1) Download a binary distribution of Tomcat from:



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1830973 - /tomcat/tc7.0.x/trunk/RUNNING.txt

2018-05-05 Thread kkolinko 
Author: kkolinko
Date: Sat May  5 13:29:26 2018
New Revision: 1830973

URL: http://svn.apache.org/viewvc?rev=1830973&view=rev
Log:
Add note that Java 7 is required for Java WebSocket API.

It is odd that this requirement has not been mentioned in RUNNING.txt, nor in 
RELEASE-NOTES. It is mentioned in BUILDING.txt

Modified:
tomcat/tc7.0.x/trunk/RUNNING.txt

Modified: tomcat/tc7.0.x/trunk/RUNNING.txt
URL: 
http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/RUNNING.txt?rev=1830973&r1=1830972&r2=1830973&view=diff
==
--- tomcat/tc7.0.x/trunk/RUNNING.txt (original)
+++ tomcat/tc7.0.x/trunk/RUNNING.txt Sat May  5 13:29:26 2018
@@ -32,6 +32,9 @@ Running With JRE 6 Or Later
   release version 6 or later, from
   http://www.oracle.com/technetwork/java/javase/downloads/index.html
 
+  NOTE:  Java WebSocket API (JSR-356) is supported only when running
+  with Java 7 or later.
+
 (1.2) Install the JRE according to the instructions included with the
   release.
 
@@ -44,7 +47,7 @@ Running With JRE 6 Or Later
   of the JVM. The default configuration defines JARs located in
   "$CATALINA_HOME/endorsed" as endorsed.
 
-  Note: Java 6 includes a subset of Common Annotations 1.0 classes.
+  NOTE:  Java 6 includes a subset of Common Annotations 1.0 classes.
 
   The only known difference between versions 1.0 and 1.1 of those
   classes is introduction of "lookup" element on Resource annotation.



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 62353] 7.0.87: java.lang.NoSuchMethodError: javax.annotation.Resource.lookup()Ljava/lang/String

2018-05-05 Thread bugzilla 
https://bz.apache.org/bugzilla/show_bug.cgi?id=62353

--- Comment #10 from Konstantin Kolinko  ---
(In reply to Mark Thomas from comment #9)
> Patch applied. Docs updated. Will be in 7.0.88.

Looks good. I amended the docs a bit.

Several notes, for a record:

1. Looking into commit history of javax.annotation classes in Tomcat 7:

- The commit that updates Common Annotations 1.0 -> 1.1 is r1521045 (fixed bug
55534).

The only change of existing annotation classes in that commit is adding
lookup() element on @Resource annotation.

There is also r1797343 that added missing @Documented annotation. This is not a
change between versions, as those annotations are already present in Commons
Annotations 1.0 - as can be seen in Java 6 javadoc for javax.annotation
classes.

Thus addition of "luokup" is the only difference.

2. When running with Java 6, the value of "luokup" element on a @Resource
annotation, if present, will be silently ignored.

- This is covered by Java Language Specification,
13.5.7 Evolution of Annotation Types.

https://docs.oracle.com/javase/specs/jls/se6/html/binaryComp.html#13.5.7

- Technically: looking into source code for Open JDK 6,
I confirm that it is silently skipped.

Trace:
- java.lang.Class#initAnnotationsIfNecessary()
-> sun.reflect.annotation.AnnotationParser
-> AnnotationParser#parseAnnotation()
-> L237 "// Member is no longer present in annotation type; ignore it"

http://grepcode.com/file/repository.grepcode.com/java/root/jdk/openjdk/6-b27/sun/reflect/annotation/AnnotationParser.java#236

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 62350] AccessControlException: "org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE", "read"

2018-05-05 Thread bugzilla 
https://bz.apache.org/bugzilla/show_bug.cgi?id=62350

--- Comment #5 from Konstantin Kolinko  ---
(In reply to Remy Maucherat from comment #1)
> From the comment in the policy, I don't remember why preloading
> BodyContentImpl isn't enough for precompiled JSPs, but I suppose that's
> still the case.

(In reply to Konstantin Kolinko from comment #2)
> 
> Looking into org.apache.jasper.security.SecurityClassLoad class in 8.5, it
> preloads some runtime classes, but BodyContentImpl class is not preloaded.
> 

I tried to do the preloading of BodyContentImpl class (in SecurityClassLoad).
It does not fix this issue.

So I am back to updating the catalina.policy file.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1830989 - in /tomcat/trunk: conf/catalina.policy webapps/docs/changelog.xml

2018-05-05 Thread kkolinko 
Author: kkolinko
Date: Sat May  5 16:19:22 2018
New Revision: 1830989

URL: http://svn.apache.org/viewvc?rev=1830989&view=rev
Log:
Fix http://bz.apache.org/bugzilla/show_bug.cgi?id=62350
Add the permission to read property 
org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE.

Modified:
tomcat/trunk/conf/catalina.policy
tomcat/trunk/webapps/docs/changelog.xml

Modified: tomcat/trunk/conf/catalina.policy
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/conf/catalina.policy?rev=1830989&r1=1830988&r2=1830989&view=diff
==
--- tomcat/trunk/conf/catalina.policy (original)
+++ tomcat/trunk/conf/catalina.policy Sat May  5 16:19:22 2018
@@ -174,6 +174,8 @@ grant {
 
 // Precompiled JSPs need access to these system properties.
 permission java.util.PropertyPermission
+ "org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE", "read";
+permission java.util.PropertyPermission
  "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read";
 permission java.util.PropertyPermission
  "org.apache.el.parser.COERCE_TO_ZERO", "read";

Modified: tomcat/trunk/webapps/docs/changelog.xml
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/webapps/docs/changelog.xml?rev=1830989&r1=1830988&r2=1830989&view=diff
==
--- tomcat/trunk/webapps/docs/changelog.xml (original)
+++ tomcat/trunk/webapps/docs/changelog.xml Sat May  5 16:19:22 2018
@@ -84,6 +84,17 @@
   
 
   
+  
+
+  
+62350: Amend catalina.policy file to allow
+reading system property
+org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE
+when running under a SecurityManager. This is a follow-up to
+the fix for 43925. (kkolinko)
+  
+
+  
   
 
   



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1830991 - in /tomcat/tc8.5.x/trunk: ./ conf/catalina.policy webapps/docs/changelog.xml

2018-05-05 Thread kkolinko 
Author: kkolinko
Date: Sat May  5 16:22:45 2018
New Revision: 1830991

URL: http://svn.apache.org/viewvc?rev=1830991&view=rev
Log:
Fix http://bz.apache.org/bugzilla/show_bug.cgi?id=62350
Add the permission to read property 
org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE.

Merged r1830989 from tomcat/trunk.

Modified:
tomcat/tc8.5.x/trunk/   (props changed)
tomcat/tc8.5.x/trunk/conf/catalina.policy
tomcat/tc8.5.x/trunk/webapps/docs/changelog.xml

Propchange: tomcat/tc8.5.x/trunk/
--
--- svn:mergeinfo (original)
+++ svn:mergeinfo Sat May  5 16:22:45 2018
@@ -1,2 +1,2 @@
 /tomcat/tc8.0.x/trunk:1809644
-/tomcat/trunk:1734785,1734799,1734845,1734928,1735041,1735044,1735480,1735577,1735597,1735599-1735600,1735615,1736145,1736162,1736209,1736280,1736297,1736299,1736489,1736646,1736703,1736836,1736849,1737104-1737105,1737112,1737117,1737119-1737120,1737155,1737157,1737192,1737280,1737339,1737632,1737664,1737715,1737748,1737785,1737834,1737860,1737903,1737959,1738005,1738007,1738014-1738015,1738018,1738022,1738039,1738043,1738059-1738060,1738147,1738149,1738174-1738175,1738261,1738589,1738623-1738625,1738643,1738816,1738850,1738855,1738946-1738948,1738953-1738954,1738979,1738982,1739079-1739081,1739087,1739113,1739153,1739172,1739176,1739191,1739474,1739492,1739726,1739762,1739775,1739814,1739817-1739818,1739975,1740131,1740324,1740465,1740495,1740508-1740509,1740520,1740535,1740707,1740803,1740810,1740969,1740980,1740991,1740997,1741015,1741033,1741036,1741058,1741060,1741080,1741147,1741159,1741164,1741173,1741181,1741190,1741197,1741202,1741208,1741213,1741221,1741225,1741232,1741409
 
,1741501,1741677,1741892,1741896,1741984,1742023,1742042,1742071,1742090,1742093,1742101,1742105,1742111,1742139,1742146,1742148,1742166,1742181,1742184,1742187,1742246,1742248-1742251,1742263-1742264,1742268,1742276,1742369,1742387,1742448,1742509-1742512,1742917,1742919,1742933,1742975-1742976,1742984,1742986,1743019,1743115,1743117,1743124-1743125,1743134,1743425,1743554,1743679,1743696-1743698,1743700-1743701,1744058,1744064-1744065,1744125,1744149,1744194,1744229,1744270,1744323,1744432,1744684,1744697,1744705,1744713,1744760,1744786,1745083,1745142-1745143,1745145,1745177,1745179-1745180,1745227,1745248,1745254,1745337,1745467,1745473,1745535,1745576,1745735,1745744,1746304,1746306-1746307,1746319,1746327,1746338,1746340-1746341,1746344,1746427,1746441,1746473,1746490,1746492,1746495-1746496,1746499-1746501,1746503-1746507,1746509,1746549,1746551,1746554,1746556,1746558,1746584,1746620,1746649,1746724,1746939,1746989,1747014,1747028,1747035,1747210,1747225,1747234,1747253,1747
 
404,1747506,1747536,1747924,1747980,1747993,1748001,1748253,1748452,1748547,1748629,1748676,1748715,1749287,1749296,1749328,1749373,1749465,1749506,1749508,1749665-1749666,1749763,1749865-1749866,1749898,1749978,1749980,1750011,1750015,1750056,1750480,1750617,1750634,1750692,1750697,1750700,1750703,1750707,1750714,1750718,1750723,1750774,1750899,1750975,1750995,1751061,1751097,1751173,1751438,1751447,1751463,1751702,1752212,1752737,1752745,1753078,1753080,1753358,1753363,1754111,1754140-1754141,1754281,1754310,1754445,1754467,1754494,1754496,1754528,1754532-1754533,1754613,1754714,1754874,1754941,1754944,1754950-1754951,1755005,1755007,1755009,1755132,1755180-1755181,1755185,1755190,1755204-1755206,1755208,1755214,1755224,1755227,1755230,1755629,1755646-1755647,1755650,1755653,1755675,1755680,1755683,1755693,1755717,1755731-1755737,1755812,1755828,1755884,1755890,1755918-1755919,1755942,1755958,1755960,1755970,1755993,1756013,1756019,1756039,1756056,1756083-1756114,1756175,1756288-1
 
756289,1756408-1756410,1756778,1756798,1756878,1756898,1756939,1757123-1757124,1757126,1757128,1757132-1757133,1757136,1757145,1757167-1757168,1757175,1757180,1757182,1757195,1757271,1757278,1757347,1757353-1757354,1757363,1757374,1757399,1757406,1757408,1757485,1757495,1757499,1757527,1757578,1757684,1757722,1757727,1757790,1757799,1757813,1757853,1757883,1757903,1757976,1757997,1758000,1758058,1758072-1758075,1758078-1758079,1758223,1758257,1758261,1758276,1758292,1758369,1758378-1758383,1758421,1758423,1758425-1758427,1758430,1758443,1758448,1758459,1758483,1758486-1758487,1758499,1758525,1758556,1758580,1758582,1758584,1758588,1758842,1759019,1759212,1759224,1759227,1759252,1759274,1759513-1759516,1759611,1759757,1759785-1759790,1760005,1760022,1760109-1760110,1760135,1760200-1760201,1760227,1760300,1760397,1760446,1760454,1760640,1760648,1761057,1761422,1761491,1761498,1761500-1761501,1761550,1761553,1761572,1761574,1761625-1761626,1761628,1761682,1761740,1761752,1762051-176205
 
3,1762123,1762168,1762172,1762182,1762201-1762202,1762204,1762208,1762288,1762296,1762324,1762348,1762353,1762362,1762374,1762492,1762503,1762505,1762541,1762608,1762710,1762753,1762766,1762769,1762944,1762947,1762953,1763167,1763179,1763232,1763259,1763271-1763272,1763276-1763277,1763319-1763320

svn commit: r1830992 - in /tomcat/tc8.0.x/trunk: ./ conf/catalina.policy webapps/docs/changelog.xml

2018-05-05 Thread kkolinko 
Author: kkolinko
Date: Sat May  5 16:28:28 2018
New Revision: 1830992

URL: http://svn.apache.org/viewvc?rev=1830992&view=rev
Log:
Fix http://bz.apache.org/bugzilla/show_bug.cgi?id=62350
Add the permission to read property 
org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE.

Merged r1830991 from tomcat/tc8.5.x/trunk.

Modified:
tomcat/tc8.0.x/trunk/   (props changed)
tomcat/tc8.0.x/trunk/conf/catalina.policy
tomcat/tc8.0.x/trunk/webapps/docs/changelog.xml

Propchange: tomcat/tc8.0.x/trunk/
--
--- svn:mergeinfo (original)
+++ svn:mergeinfo Sat May  5 16:28:28 2018
@@ -1,2 +1,2 @@
-/tomcat/tc8.5.x/trunk:1735042,1737966,1743139-1743140,1744151,1747537,1747925,1748002,1754614,1754643,1762124,1762183,1762203,1763792,1772948,1777014,1779719,1782037,1782240,1782386-1782387,1785669,1786845,1788249,1788324,1788905,1789216,1789335,1791528,1791558,1796697-1796698,1797521,1798543,1799162,1800143,1801693,1802805,1806799,1807079-1807080,1808880,1809831,1812093,1812143,1812145,1812319,1814975,1815945,1815956,1820207,1822186,1823164,1823497,1824960,1826872-1826873,1827862,1829310,1829777,1829796,1829935,1830215
-/tomcat/trunk:1636524,1637156,1637176,1637188,1637331,1637684,1637695,1637890,1637892,1638720-1638725,1639653,1640010,1640083-1640084,1640088,1640275,1640322,1640347,1640361,1640365,1640403,1640410,1640652,1640655-1640658,1640688,1640700-1640883,1640903,1640976,1640978,1641000,1641026,1641038-1641039,1641051-1641052,1641058,1641064,1641300,1641369,1641374,1641380,1641486,1641634,1641656-1641692,1641704,1641707-1641718,1641720-1641722,1641735,1641981,1642233,1642280,1642554,1642564,1642595,1642606,1642668,1642679,1642697,1642699,1642766,1643002,1643045,1643054-1643055,1643066,1643121,1643128,1643206,1643209-1643210,1643216,1643249,1643270,1643283,1643309-1643310,1643323,1643365-1643366,1643370-1643371,1643465,1643474,1643536,1643570,1643634,1643649,1643651,1643654,1643675,1643731,1643733-1643734,1643761,1643766,1643814,1643937,1643963,1644017,1644169,1644201-1644203,1644321,1644323,1644516,1644523,1644529,1644535,1644730,1644768,1644784-1644785,1644790,1644793,1644815,1644884,1644886
 
,1644890,1644892,1644910,1644924,1644929-1644930,1644935,1644989,1645011,1645247,1645355,1645357-1645358,1645455,1645465,1645469,1645471,1645473,1645475,1645486-1645488,1645626,1645641,1645685,1645743,1645763,1645951-1645953,1645955,1645993,1646098-1646106,1646178,1646220,1646302,1646304,1646420,1646470-1646471,1646476,1646559,1646717-1646723,1646773,1647026,1647042,1647530,1647655,1648304,1648815,1648907,1649973,1650081,1650365,1651116,1651120,1651280,1651470,1652938,1652970,1653041,1653471,1653550,1653574,1653797,1653815-1653816,1653819,1653840,1653857,1653888,1653972,1654013,1654030,1654050,1654123,1654148,1654159,1654513,1654515,1654517,1654522,1654524,1654725,1654735,1654766,1654785,1654851-1654852,1654978,1655122-1655124,1655126-1655127,1655129-1655130,1655132-1655133,1655312,1655351,1655438,1655441,1655454,168,1656087,1656299,1656319,1656331,1656345,1656350,1656590,1656648-1656650,1656657,1657041,1657054,1657374,1657492,1657510,1657565,1657580,1657584,1657586,1657589,1657
 
592,1657607,1657609,1657682,1657907,1658207,1658734,1658781,1658790,1658799,1658802,1658804,1658833,1658840,1658966,1659043,1659053,1659059,1659174,1659184,1659188-1659189,1659216,1659263,1659293,1659304,1659306-1659307,1659382,1659384,1659428,1659471,1659486,1659505,1659516,1659521,1659524,1659559,1659562,1659803,1659806,1659814,1659833,1659862,1659905,1659919,1659948,1659967,1659983-1659984,1660060,1660074,1660077,1660133,1660168,1660331-1660332,1660353,1660358,1660924,1661386,1661770,1661867,1661972,1661990,1662200,1662308-1662309,1662548,1662614,1662696,1662736,1662985,1662988-1662989,1663264,1663277,1663298,1663534,1663562,1663676,1663715,1663754,1663768,1663772,1663781,1663893,1663995,1664143,1664163,1664174,1664301,1664317,1664347,1664657,1664659,1664710,1664863-1664864,1664866,1665085,1665292,1665559,1665653,1665661,1665672,1665694,1665697,1665736,1665779,1665976-1665977,1665980-1665981,1665985-1665986,1665989,1665998,1666004,1666008,1666013,1666017,1666024,1666116,1666386-1
 
666387,1666494,1666496,1666552,1666569,1666579,137,149,1666757,1666966,1666972,1666985,1666995,1666997,1667292,1667402,1667406,1667546,1667615,1667630,1667636,1667688,1667764,1667871,1668026,1668135,1668193,1668593,1668596,1668630,1668639,1668843,1669353,1669370,1669451,1669800,1669838,1669876,1669882,1670394,1670433,1670591,1670598-1670600,1670610,1670631,1670719,1670724,1670726,1670730,1670940,1671112,1672272,1672284,1673754,1674294,1675461,1675486,1675594,1675830,1676231,1676250-1676251,1676364,1676381,1676393,1676479,1676525,1676552,1676615,1676630,1676634,1676721,1676926,1676943,1677140,1677802,1678011,1678162,1678174,1678339,1678426-1678427,1678694,1678701,1679534,1679708,1679710,1679716,1680034,1680246,1681056,1681123,1681138,1681280,1681283,1681286,1681450,1681697,16

svn commit: r1830993 - in /tomcat/tc7.0.x/trunk: ./ conf/catalina.policy webapps/docs/changelog.xml

2018-05-05 Thread kkolinko 
Author: kkolinko
Date: Sat May  5 16:31:26 2018
New Revision: 1830993

URL: http://svn.apache.org/viewvc?rev=1830993&view=rev
Log:
Fix http://bz.apache.org/bugzilla/show_bug.cgi?id=62350
Add the permission to read property 
org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE.

Merged r1830992 from tomcat/tc8.0.x/trunk.

Modified:
tomcat/tc7.0.x/trunk/   (props changed)
tomcat/tc7.0.x/trunk/conf/catalina.policy
tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml

Propchange: tomcat/tc7.0.x/trunk/
--
--- svn:mergeinfo (original)
+++ svn:mergeinfo Sat May  5 16:31:26 2018
@@ -1,3 +1,3 @@
-/tomcat/tc8.0.x/trunk:1636525,1637336,1637685,1637709,1638726,1640089,1640276,1640349,1640363,1640366,1640642,1640672,1640674,1640689,1640884,1641001,1641065,1641067,1641375,1641638,1641723,1641726,1641729-1641730,1641736,1641988,1642669-1642670,1642698,1642701,1643205,1643215,1643217,1643230,1643232,1643273,1643285,1643329-1643330,1643511,1643513,1643521,1643539,1643571,1643581-1643582,1643635,1643655,1643738,1643964,1644018,1644333,1644525,1644954,1644992,1645014,1645360,1645456,1645627,1645642,1645686,1645903-1645904,1645908-1645909,1645913,1645920,1646458,1646460-1646462,1646735,1646738-1646741,1646744,1646746,1646748-1646755,1646757,1646759-1646760,1647043,1648816,1651420-1651422,1651844,1652926,1652939-1652940,1652973,1653798,1653817,1653841,1654042,1654161,1654736,1654767,1654787,1656592,1659907,1662986,1663265,1663278,1663325,1663535,1663567,1663679,1663997,1664175,1664321,1664872,1665061,1665086,1666027,1666395,1666503,1666506,1666560,1666570,1666581,1666759,1666967,1666988
 
,1667553-1667555,1667558,1667617,1667633,1667637,1667747,1667767,1667873,1668028,1668137,1668634,1669432,1669801,1669840,1669895-1669896,1670398,1670435,1670592,1670605-1670607,1670609,1670632,1670720,1670725,1670727,1670731,1671114,1672273,1672285,1673759,1674220,1674295,1675469,1675488,1675595,1675831,1676232,1676367-1676369,1676382,1676394,1676483,1676556,1676635,1678178,1679536,1679988,1680256,1681124,1681182,1681703,1681730,1681840,1681864,1681869,1682010,1682034,1682047,1682052-1682053,1682062,1682064,1682070,1682312,1682325,1682331,1682386,1684367,1684385,1685759,1685774,1685827,1685892,1687341,1688904,1689358,1689657,1689921,1692850,1693093,1693108,1693324,1694060,1694115,1694291,1694427,1694431,1694503,1694549,1694789,1694873,1694881,1695356,1695372,1695823-1695825,1696200,1696281,1696379,1696468,1700608,1700871,1700897,1700978,1701094,1701124,1701608,1701668,1701676,1701766,1701944,1702248,1702252,1702314,1702390,1702723,1702725,1702728,1702730,1702733,1702735,1702737,1702
 
739,1702742,1702744,1702748,1702751,1702754,1702758,1702760,1702763,1702766,1708779,1708782,1708806,1709314,1709670,1710347,1710442,1710448,1710490,1710574,1710578,1712226,1712229,1712235,1712255,1712618,1712649,1712655,1712860,1712899,1712903,1712906,1712913,1712926,1712975,1713185,1713262,1713287,1713613,1713621,1713872,1713976,1713994,1713998,1714004,1714013,1714059,1714538,1714580,1715189,1715207,1715544,1715549,1715637,1715639-1715645,1715667,1715683,1715866,1715978,1715981,1716216-1716217,1716355,1716414,1716421,1717208-1717209,1717257,1717283,1717288,1717291,1717421,1717517,1717529,1718797,1718840-1718843,1719348,1719357-1719358,1719400,1719491,1719737,1720235,1720396,1720442,1720446,1720450,1720463,1720658-1720660,1720756,1720816,1721813,1721818,1721831,1721861,1721867,1721882,1722523,1722527,1722800,1722926,1722941,1722997,1723130,1723440,1723488,1723890,1724434,1724674,1724792,1724803,1724902,1725128,1725131,1725154,1725167,1725911,1725921,1725929,1725963-1725965,1725970,1
 
725974,1726171-1726173,1726175,1726179-1726182,1726190-1726191,1726195-1726200,1726203,1726226,1726576,1726630,1726992,1727029,1727037,1727671,1727676,1727900,1728028,1728092,1728439,1728449,1729186,1729362,1731009,1731303,1731867,1731872,1731874,1731876,1731885,1731947,1731955,1731959,1731977,1731984,1732360,1732490,1732672,1732902,1733166,1733603,1733619,1733735,1733752,1733764,1733915,1733941,1733964,1734115,1734133,1734261,1734421,1734531,1736286,1737967,1738173,1738182,1738992,1739039,1739089-1739091,1739294,1739777,1739821,1739981,1740513,1740726,1741019,1741162,1741217,1743647,1743681,1744152,1744272,1746732,1746750,1752739,1754615,1755886,1756018,1758563,1759565,1761686,1762173,1762206,1766280,1767507-1767508,1767653,1767656,1769267,1772949,1773521,1773527,1774104,1777015,1777213,1779330,1783151,1784188,1784966,1785670,1786846,1788260,1788999,1789140,1789402,1791529,1791559,1795291,1796906,1797523,1799214,1800998-1800999,1801003,1801007-1801008,1801017,1801020,1802808,180281
 
4,1803618,1806107,1806733,1807082-1807083,1808707,1808884,1809267,1809644,1809832,1809904,1809915,1809924,1810283,1810328,1810574,1810576-1810577,1810584,1810588,1811141,1811842,1812090,1812096,1812150,1812511,1814976,1814983,1815072,1815453,1815946,1815957,1816143,1816682,1817229,1817287,1820200,1820209,1820283,182030

[Bug 62350] AccessControlException: "org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE", "read"

2018-05-05 Thread bugzilla 
https://bz.apache.org/bugzilla/show_bug.cgi?id=62350

Konstantin Kolinko  changed:

   What|Removed |Added

 Resolution|--- |FIXED
 Status|NEW |RESOLVED

--- Comment #6 from Konstantin Kolinko  ---
Fixed by adding a permission into catalina.policy.

The fix will be in 9.0.9, 8.5.32, 8.0.53 and 7.0.88.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

buildbot failure in on tomcat-trunk

2018-05-05 Thread buildbot 
The Buildbot has detected a new failure on builder tomcat-trunk while building 
. Full details are available at:
https://ci.apache.org/builders/tomcat-trunk/builds/3241

Buildbot URL: https://ci.apache.org/

Buildslave for this Build: silvanus_ubuntu

Build Reason: The AnyBranchScheduler scheduler named 'on-tomcat-commit' 
triggered this build
Build Source Stamp: [branch tomcat/trunk] 1830989
Blamelist: kkolinko

BUILD FAILED: failed compile_1

Sincerely,
 -The Buildbot




-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

Re: buildbot failure in on tomcat-trunk

2018-05-05 Thread Konstantin Kolinko 
2018-05-05 19:38 GMT+03:00  :
> The Buildbot has detected a new failure on builder tomcat-trunk while 
> building . Full details are available at:
> https://ci.apache.org/builders/tomcat-trunk/builds/3241
>
> Buildbot URL: https://ci.apache.org/
>
> Buildslave for this Build: silvanus_ubuntu
>
> Build Reason: The AnyBranchScheduler scheduler named 'on-tomcat-commit' 
> triggered this build
> Build Source Stamp: [branch tomcat/trunk] 1830989
> Blamelist: kkolinko
>
> BUILD FAILED: failed compile_1

This is odd.
Failed test class:
TEST-org.apache.catalina.connector.TestCoyoteOutputStream.NIO2.txt

Testsuite: org.apache.catalina.connector.TestCoyoteOutputStream
Tests run: 13, Failures: 0, Errors: 1, Skipped: 0, Time elapsed: 5.197 sec

Failed test case:

Testcase: testNonBlockingWriteTwiceBlockingWriteNoneNonContainerThread
took 0.149 sec
Caused an ERROR
missing CR
java.io.IOException: missing CR
at sun.net.www.http.ChunkedInputStream.processRaw(ChunkedInputStream.java:405)
at 
sun.net.www.http.ChunkedInputStream.readAheadBlocking(ChunkedInputStream.java:572)
at sun.net.www.http.ChunkedInputStream.readAhead(ChunkedInputStream.java:609)
at sun.net.www.http.ChunkedInputStream.read(ChunkedInputStream.java:696)
at java.io.FilterInputStream.read(FilterInputStream.java:133)
at 
sun.net.www.protocol.http.HttpURLConnection$HttpInputStream.read(HttpURLConnection.java:3393)
at java.io.BufferedInputStream.fill(BufferedInputStream.java:246)
at java.io.BufferedInputStream.read1(BufferedInputStream.java:286)
at java.io.BufferedInputStream.read(BufferedInputStream.java:345)
at java.io.FilterInputStream.read(FilterInputStream.java:107)
at org.apache.catalina.startup.TomcatBaseTest.methodUrl(TomcatBaseTest.java:705)
at org.apache.catalina.startup.TomcatBaseTest.methodUrl(TomcatBaseTest.java:663)
at org.apache.catalina.startup.TomcatBaseTest.getUrl(TomcatBaseTest.java:657)
at 
org.apache.catalina.connector.TestCoyoteOutputStream.doNonBlockingTest(TestCoyoteOutputStream.java:145)
at 
org.apache.catalina.connector.TestCoyoteOutputStream.testNonBlockingWriteTwiceBlockingWriteNoneNonContainerThread(TestCoyoteOutputStream.java:87)

All other tests are OK.


https://ci.apache.org/projects/tomcat/tomcat9/logs/1830989/TEST-org.apache.catalina.connector.TestCoyoteOutputStream.NIO2.txt

Best regards,
Konstantin Kolinko

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

Re: [VOTE] Release Apache Tomcat 8.0.52

2018-05-05 Thread Konstantin Kolinko 
2018-04-28 20:22 GMT+03:00 Violeta Georgieva :
> The proposed Apache Tomcat 8.0.52 release is now available for voting.
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-8/v8.0.52/
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1182/
> The svn tag is:
> http://svn.apache.org/repos/asf/tomcat/tc8.0.x/tags/TOMCAT_8_0_52/
>
> The proposed 8.0.52 release is:
> [ ] Broken - do not release
> [x] Stable - go ahead and release as 8.0.52

Unit tests: OK (Java 7u80, 8u172 x all connectors) (32-bit, Windows 10)

Smoke tests:
When running with a SecurityManager I see
https://bz.apache.org/bugzilla/show_bug.cgi?id=62350
Amending catalina.policy file fixes this issue. Not a show-stopper.


Best regards,
Konstantin Kolinko

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 62350] AccessControlException: "org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE", "read"

2018-05-05 Thread bugzilla 
https://bz.apache.org/bugzilla/show_bug.cgi?id=62350

--- Comment #7 from Mark Thomas  ---
Loading the class won't trigger the static initializer.
Class.forName(String,boolean,ClassLoader) would work.

I was planning on going through the default security policy to see how many
entries I could remove by initialising rather than just loading the appropriate
classes.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1830997 - /tomcat/trunk/java/org/apache/jasper/security/SecurityClassLoad.java

2018-05-05 Thread markt 
Author: markt
Date: Sat May  5 18:40:57 2018
New Revision: 1830997

URL: http://svn.apache.org/viewvc?rev=1830997&view=rev
Log:
Alphabetical order for loaded classes

Modified:
tomcat/trunk/java/org/apache/jasper/security/SecurityClassLoad.java

Modified: tomcat/trunk/java/org/apache/jasper/security/SecurityClassLoad.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/jasper/security/SecurityClassLoad.java?rev=1830997&r1=1830996&r2=1830997&view=diff
==
--- tomcat/trunk/java/org/apache/jasper/security/SecurityClassLoad.java 
(original)
+++ tomcat/trunk/java/org/apache/jasper/security/SecurityClassLoad.java Sat May 
 5 18:40:57 2018
@@ -39,20 +39,15 @@ public final class SecurityClassLoad {
 // Ensure XMLInputFactory is loaded with Tomcat's class loader
 loader.loadClass( basePackage + "compiler.EncodingDetector");
 
+loader.loadClass( basePackage + "runtime.JspContextWrapper");
 loader.loadClass( basePackage + 
"runtime.JspFactoryImpl$PrivilegedGetPageContext");
 loader.loadClass( basePackage + 
"runtime.JspFactoryImpl$PrivilegedReleasePageContext");
-
+loader.loadClass( basePackage + "runtime.JspFragmentHelper");
 loader.loadClass( basePackage + "runtime.JspRuntimeLibrary");
-
+loader.loadClass( basePackage + "runtime.PageContextImpl");
+loader.loadClass( basePackage + "runtime.ProtectedFunctionMapper");
 loader.loadClass( basePackage + 
"runtime.ServletResponseWrapperInclude");
 loader.loadClass( basePackage + "runtime.TagHandlerPool");
-loader.loadClass( basePackage + "runtime.JspFragmentHelper");
-
-loader.loadClass( basePackage + "runtime.ProtectedFunctionMapper");
-
-loader.loadClass( basePackage + "runtime.PageContextImpl");
-
-loader.loadClass( basePackage + "runtime.JspContextWrapper");
 
 // Trigger loading of class and reading of property
 SecurityUtil.isPackageProtectionEnabled();



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

buildbot success in on tomcat-trunk

2018-05-05 Thread buildbot 
The Buildbot has detected a restored build on builder tomcat-trunk while 
building . Full details are available at:
https://ci.apache.org/builders/tomcat-trunk/builds/3242

Buildbot URL: https://ci.apache.org/

Buildslave for this Build: silvanus_ubuntu

Build Reason: The AnyBranchScheduler scheduler named 'on-tomcat-commit' 
triggered this build
Build Source Stamp: [branch tomcat/trunk] 1830997
Blamelist: markt

Build succeeded!

Sincerely,
 -The Buildbot




-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 62350] AccessControlException: "org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE", "read"

2018-05-05 Thread bugzilla 
https://bz.apache.org/bugzilla/show_bug.cgi?id=62350

--- Comment #8 from Mark Thomas  ---
An alternative, and arguably better approach, would be to use a privileged
block. It is probably more code but it should allow for easier re-use.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1830999 - /tomcat/trunk/java/org/apache/el/lang/ELSupport.java

2018-05-05 Thread markt 
Author: markt
Date: Sat May  5 19:18:49 2018
New Revision: 1830999

URL: http://svn.apache.org/viewvc?rev=1830999&view=rev
Log:
Clean-up
Don't use a constant for the result of test that is only used once.

Modified:
tomcat/trunk/java/org/apache/el/lang/ELSupport.java

Modified: tomcat/trunk/java/org/apache/el/lang/ELSupport.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/el/lang/ELSupport.java?rev=1830999&r1=1830998&r2=1830999&view=diff
==
--- tomcat/trunk/java/org/apache/el/lang/ELSupport.java (original)
+++ tomcat/trunk/java/org/apache/el/lang/ELSupport.java Sat May  5 19:18:49 2018
@@ -42,23 +42,18 @@ public class ELSupport {
 
 private static final Long ZERO = Long.valueOf(0L);
 
-private static final boolean IS_SECURITY_ENABLED =
-(System.getSecurityManager() != null);
-
 protected static final boolean COERCE_TO_ZERO;
 
 static {
 String coerceToZeroStr;
-if (IS_SECURITY_ENABLED) {
+if (System.getSecurityManager() != null) {
 coerceToZeroStr = AccessController.doPrivileged(
 new PrivilegedAction(){
 @Override
 public String run() {
 return System.getProperty(
-"org.apache.el.parser.COERCE_TO_ZERO",
-"false");
+"org.apache.el.parser.COERCE_TO_ZERO", 
"false");
 }
-
 }
 );
 } else {



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1831000 - in /tomcat/trunk: conf/catalina.policy java/org/apache/jasper/runtime/BodyContentImpl.java webapps/docs/changelog.xml

2018-05-05 Thread markt 
Author: markt
Date: Sat May  5 19:39:31 2018
New Revision: 1831000

URL: http://svn.apache.org/viewvc?rev=1831000&view=rev
Log:
Refactor org.apache.jasper.runtime.BodyContentImpl so an additional permission 
is not required in catalina.policy
This is a follow-up to the fix for 43925.

Modified:
tomcat/trunk/conf/catalina.policy
tomcat/trunk/java/org/apache/jasper/runtime/BodyContentImpl.java
tomcat/trunk/webapps/docs/changelog.xml

Modified: tomcat/trunk/conf/catalina.policy
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/conf/catalina.policy?rev=1831000&r1=1830999&r2=1831000&view=diff
==
--- tomcat/trunk/conf/catalina.policy (original)
+++ tomcat/trunk/conf/catalina.policy Sat May  5 19:39:31 2018
@@ -174,10 +174,6 @@ grant {
 
 // Precompiled JSPs need access to these system properties.
 permission java.util.PropertyPermission
- "org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE", "read";
-permission java.util.PropertyPermission
- "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read";
-permission java.util.PropertyPermission
  "org.apache.el.parser.COERCE_TO_ZERO", "read";
 
 // The cookie code needs these.

Modified: tomcat/trunk/java/org/apache/jasper/runtime/BodyContentImpl.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/jasper/runtime/BodyContentImpl.java?rev=1831000&r1=1830999&r2=1831000&view=diff
==
--- tomcat/trunk/java/org/apache/jasper/runtime/BodyContentImpl.java (original)
+++ tomcat/trunk/java/org/apache/jasper/runtime/BodyContentImpl.java Sat May  5 
19:39:31 2018
@@ -21,6 +21,8 @@ import java.io.CharArrayReader;
 import java.io.IOException;
 import java.io.Reader;
 import java.io.Writer;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 
 import javax.servlet.jsp.JspWriter;
 import javax.servlet.jsp.tagext.BodyContent;
@@ -39,13 +41,40 @@ import org.apache.jasper.Constants;
  */
 public class BodyContentImpl extends BodyContent {
 
-private static final boolean LIMIT_BUFFER =
-Boolean.parseBoolean(System.getProperty(
-"org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", 
"false"));
+private static final boolean LIMIT_BUFFER;
+private static final int TAG_BUFFER_SIZE;
 
-private static final int TAG_BUFFER_SIZE =
-
Integer.getInteger("org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE",
+static {
+if (System.getSecurityManager() == null) {
+LIMIT_BUFFER = Boolean.parseBoolean(System.getProperty(
+"org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", 
"false"));
+TAG_BUFFER_SIZE = Integer.getInteger(
+"org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE",
 Constants.DEFAULT_TAG_BUFFER_SIZE).intValue();
+} else {
+LIMIT_BUFFER = AccessController.doPrivileged(
+new PrivilegedAction() {
+@Override
+public Boolean run() {
+return Boolean.valueOf(System.getProperty(
+
"org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER",
+"false"));
+}
+}
+).booleanValue();
+TAG_BUFFER_SIZE = AccessController.doPrivileged(
+new PrivilegedAction() {
+@Override
+public Integer run() {
+return Integer.getInteger(
+
"org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE",
+Constants.DEFAULT_TAG_BUFFER_SIZE);
+}
+}
+).intValue();
+}
+}
+
 
 private char[] cb;
 private int nextChar;

Modified: tomcat/trunk/webapps/docs/changelog.xml
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/webapps/docs/changelog.xml?rev=1831000&r1=1830999&r2=1831000&view=diff
==
--- tomcat/trunk/webapps/docs/changelog.xml (original)
+++ tomcat/trunk/webapps/docs/changelog.xml Sat May  5 19:39:31 2018
@@ -87,11 +87,12 @@
   
 
   
-62350: Amend catalina.policy file to allow
-reading system property
-org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE
-when running under a SecurityManager. This is a follow-up to
-the fix for 43925. (kkolinko)
+62350: Refactor
+org.apache.jasper.runtime.BodyContentImpl so a
+SecurityException is not thrown when running under a
+SecurityManger and additional permissions are not required in the
+catalina.policy file. This is a follow-up

svn commit: r1831001 - /tomcat/trunk/conf/catalina.policy

2018-05-05 Thread markt 
Author: markt
Date: Sat May  5 19:40:41 2018
New Revision: 1831001

URL: http://svn.apache.org/viewvc?rev=1831001&view=rev
Log:
Remove unnecessary permission.
After this permission was first granted, the code that reads the property was 
moved into a privileged block so this permission is no longer required.

Modified:
tomcat/trunk/conf/catalina.policy

Modified: tomcat/trunk/conf/catalina.policy
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/conf/catalina.policy?rev=1831001&r1=1831000&r2=1831001&view=diff
==
--- tomcat/trunk/conf/catalina.policy (original)
+++ tomcat/trunk/conf/catalina.policy Sat May  5 19:40:41 2018
@@ -172,10 +172,6 @@ grant {
 permission java.lang.RuntimePermission
  "accessClassInPackage.org.apache.jasper.runtime.*";
 
-// Precompiled JSPs need access to these system properties.
-permission java.util.PropertyPermission
- "org.apache.el.parser.COERCE_TO_ZERO", "read";
-
 // The cookie code needs these.
 permission java.util.PropertyPermission
  "org.apache.catalina.STRICT_SERVLET_COMPLIANCE", "read";



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1831003 - in /tomcat/trunk: conf/catalina.policy java/javax/servlet/http/Cookie.java test/javax/servlet/http/TestCookieRFC2109Validator.java

2018-05-05 Thread markt 
Author: markt
Date: Sat May  5 20:21:21 2018
New Revision: 1831003

URL: http://svn.apache.org/viewvc?rev=1831003&view=rev
Log:
Refactor to remove the need for explicit property permissions for Cookie code

Modified:
tomcat/trunk/conf/catalina.policy
tomcat/trunk/java/javax/servlet/http/Cookie.java
tomcat/trunk/test/javax/servlet/http/TestCookieRFC2109Validator.java

Modified: tomcat/trunk/conf/catalina.policy
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/conf/catalina.policy?rev=1831003&r1=1831002&r2=1831003&view=diff
==
--- tomcat/trunk/conf/catalina.policy (original)
+++ tomcat/trunk/conf/catalina.policy Sat May  5 20:21:21 2018
@@ -172,14 +172,6 @@ grant {
 permission java.lang.RuntimePermission
  "accessClassInPackage.org.apache.jasper.runtime.*";
 
-// The cookie code needs these.
-permission java.util.PropertyPermission
- "org.apache.catalina.STRICT_SERVLET_COMPLIANCE", "read";
-permission java.util.PropertyPermission
- "org.apache.tomcat.util.http.ServerCookie.STRICT_NAMING", "read";
-permission java.util.PropertyPermission
- "org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR", "read";
-
 // Applications using WebSocket need to be able to access these packages
 permission java.lang.RuntimePermission 
"accessClassInPackage.org.apache.tomcat.websocket";
 permission java.lang.RuntimePermission 
"accessClassInPackage.org.apache.tomcat.websocket.server";

Modified: tomcat/trunk/java/javax/servlet/http/Cookie.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/javax/servlet/http/Cookie.java?rev=1831003&r1=1831002&r2=1831003&view=diff
==
--- tomcat/trunk/java/javax/servlet/http/Cookie.java (original)
+++ tomcat/trunk/java/javax/servlet/http/Cookie.java Sat May  5 20:21:21 2018
@@ -17,6 +17,8 @@
 package javax.servlet.http;
 
 import java.io.Serializable;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.text.MessageFormat;
 import java.util.BitSet;
 import java.util.Locale;
@@ -54,19 +56,66 @@ import java.util.ResourceBundle;
 public class Cookie implements Cloneable, Serializable {
 
 private static final CookieNameValidator validation;
+
 static {
+boolean strictServletCompliance;
 boolean strictNaming;
-String prop = 
System.getProperty("org.apache.tomcat.util.http.ServerCookie.STRICT_NAMING");
-if (prop != null) {
-strictNaming = Boolean.parseBoolean(prop);
+boolean allowSlash;
+String propStrictNaming;
+String propFwdSlashIsSeparator;
+
+if (System.getSecurityManager() == null) {
+strictServletCompliance = Boolean.getBoolean(
+"org.apache.catalina.STRICT_SERVLET_COMPLIANCE");
+propStrictNaming = System.getProperty(
+"org.apache.tomcat.util.http.ServerCookie.STRICT_NAMING");
+propFwdSlashIsSeparator = System.getProperty(
+
"org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR");
 } else {
-strictNaming = 
Boolean.getBoolean("org.apache.catalina.STRICT_SERVLET_COMPLIANCE");
+strictServletCompliance = AccessController.doPrivileged(
+new PrivilegedAction() {
+@Override
+public Boolean run() {
+return Boolean.valueOf(System.getProperty(
+
"org.apache.catalina.STRICT_SERVLET_COMPLIANCE"));
+}
+}
+).booleanValue();
+propStrictNaming = AccessController.doPrivileged(
+new PrivilegedAction() {
+@Override
+public String run() {
+return System.getProperty(
+
"org.apache.tomcat.util.http.ServerCookie.STRICT_NAMING");
+}
+}
+);
+propFwdSlashIsSeparator = AccessController.doPrivileged(
+new PrivilegedAction() {
+@Override
+public String run() {
+return System.getProperty(
+
"org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR");
+}
+}
+);
 }
 
-if (strictNaming) {
-validation = new RFC2109Validator();
+if (propStrictNaming == null) {
+strictNaming = strictServletCompliance;
+} else {
+strictNaming = Boolean.parseBoolean(propStrictNaming);
+}
+
+if (propFwdSlashIsSeparator == null) {
+allowSlash = !strictServletCompliance;
+