[GitHub] [tomcat-jakartaee-migration] markt-asf closed issue #23: Vulnerability with Apache Commons Compress v1.20

2021-08-12 Thread GitBox
markt-asf closed issue #23: URL: https://github.com/apache/tomcat-jakartaee-migration/issues/23 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: de

[GitHub] [tomcat-jakartaee-migration] markt-asf commented on issue #23: Vulnerability with Apache Commons Compress v1.20

2021-08-12 Thread GitBox
markt-asf commented on issue #23: URL: https://github.com/apache/tomcat-jakartaee-migration/issues/23#issuecomment-897403716 No plans to update. Automated scanning tools (including those that look at dependencies without considering the context in which it is used) generate a large numb

[GitHub] [tomcat-jakartaee-migration] abdulmuqsith commented on issue #23: Vulnerability with Apache Commons Compress v1.20

2021-08-12 Thread GitBox
abdulmuqsith commented on issue #23: URL: https://github.com/apache/tomcat-jakartaee-migration/issues/23#issuecomment-897404156 Thank you -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the spe

[GitHub] [tomcat] rrodewald commented on a change in pull request #444: Delegate check for preemptive authentication from AuthenticatorBase to affected Authenticators

2021-08-12 Thread GitBox
rrodewald commented on a change in pull request #444: URL: https://github.com/apache/tomcat/pull/444#discussion_r687513716 ## File path: java/org/apache/catalina/authenticator/SSLAuthenticator.java ## @@ -104,7 +104,7 @@ protected String getAuthMethod() { } @Overrid

[GitHub] [tomcat-native] michael-o commented on pull request #9: Simplify Address#getInfo() native implementation

2021-08-12 Thread GitBox
michael-o commented on pull request #9: URL: https://github.com/apache/tomcat-native/pull/9#issuecomment-897460099 @mturk Still waiting... -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the spe

[GitHub] [tomcat] michael-o commented on a change in pull request #444: Delegate check for preemptive authentication from AuthenticatorBase to affected Authenticators

2021-08-12 Thread GitBox
michael-o commented on a change in pull request #444: URL: https://github.com/apache/tomcat/pull/444#discussion_r687520920 ## File path: java/org/apache/catalina/authenticator/SSLAuthenticator.java ## @@ -104,7 +104,7 @@ protected String getAuthMethod() { } @Overrid

[GitHub] [tomcat] michael-o commented on pull request #444: Delegate check for preemptive authentication from AuthenticatorBase to affected Authenticators

2021-08-12 Thread GitBox
michael-o commented on pull request #444: URL: https://github.com/apache/tomcat/pull/444#issuecomment-897492778 One more nit: I think the check in the header-based authenticators is too generic. Shouldn't they check for a value for their auth scheme only? Basic for `Basic `, etc.? -- Th

[GitHub] [tomcat] rrodewald commented on pull request #444: Delegate check for preemptive authentication from AuthenticatorBase to affected Authenticators

2021-08-12 Thread GitBox
rrodewald commented on pull request #444: URL: https://github.com/apache/tomcat/pull/444#issuecomment-897494990 That's a good point IMHO. Now that the check is in the individual `Authenticator`s it can easily be made more specific. I'm not too familiar with Digest and SPNEGO but I'll try.

[GitHub] [tomcat] michael-o commented on pull request #444: Delegate check for preemptive authentication from AuthenticatorBase to affected Authenticators

2021-08-12 Thread GitBox
michael-o commented on pull request #444: URL: https://github.com/apache/tomcat/pull/444#issuecomment-897500252 > > > That's a good point IMHO. Now that the check is in the individual `Authenticator`s it can easily be made more specific. I'm not too familiar with Digest and SPNEGO

[GitHub] [tomcat] rrodewald commented on pull request #444: Delegate check for preemptive authentication from AuthenticatorBase to affected Authenticators

2021-08-12 Thread GitBox
rrodewald commented on pull request #444: URL: https://github.com/apache/tomcat/pull/444#issuecomment-897549391 The removal of the preemptive capability of the `SSLAuthenticator` makes multiple tests fail: ``` [junit] Test org.apache.catalina.valves.rewrite.TestResolverSSL FAILED

Re: [VOTE] Release Apache Tomcat 8.5.70

2021-08-12 Thread jean-frederic clere
On 09/08/2021 22:05, Mark Thomas wrote: [X] Stable - go ahead and release as 8.5.70 On fedora 34, I have the following failures: +++ [concat] Testsuites with failed tests: [concat] TEST-org.apache.catalina.valves.rewrite.TestResolverSSL.NIO.txt [concat] TEST-org.apache.catalina.valves

[GitHub] [tomcat] rrodewald edited a comment on pull request #444: Delegate check for preemptive authentication from AuthenticatorBase to affected Authenticators

2021-08-12 Thread GitBox
rrodewald edited a comment on pull request #444: URL: https://github.com/apache/tomcat/pull/444#issuecomment-897549391 The removal of the preemptive capability of the `SSLAuthenticator` makes multiple tests fail: ``` [junit] Test org.apache.catalina.valves.rewrite.TestResolverSSL

[GitHub] [tomcat] michael-o commented on pull request #444: Delegate check for preemptive authentication from AuthenticatorBase to affected Authenticators

2021-08-12 Thread GitBox
michael-o commented on pull request #444: URL: https://github.com/apache/tomcat/pull/444#issuecomment-897565545 This needs to analyzed whether the tests are invalid or not. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and

[GitHub] [tomcat] rrodewald commented on pull request #444: Delegate check for preemptive authentication from AuthenticatorBase to affected Authenticators

2021-08-12 Thread GitBox
rrodewald commented on pull request #444: URL: https://github.com/apache/tomcat/pull/444#issuecomment-897703572 Will have to look at that in detail, which will take some time. I have to postpone this for 2 weeks because I am on vacation. -- This is an automated message from the Apache Gi

[Bug 65498] New: If-None-Match header causes 400 with static file

2021-08-12 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=65498 Bug ID: 65498 Summary: If-None-Match header causes 400 with static file Product: Tomcat 9 Version: 9.0.46 Hardware: PC OS: Mac OS X 10.1 Status: NEW Sev

[Bug 65498] If-None-Match header causes 400 with static file

2021-08-12 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=65498 dzab...@rampecdn.com changed: What|Removed |Added CC||dzab...@rampecdn.com -- You are

[Bug 65498] If-None-Match header causes 400 with static file

2021-08-12 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=65498 --- Comment #1 from Michael Osipov --- Where is the bug? The ETag us invalid, hence the 400. -- You are receiving this mail because: You are the assignee for the bug. - To un

[Bug 65498] If-None-Match header causes 400 with static file

2021-08-12 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=65498 --- Comment #2 from dzab...@rampecdn.com --- Any E-Tag I use seems to cause the issue. i.e. 'If-None-Match: W/"8176-1626385749844"-gzip' -- You are receiving this mail because: You are the assignee for the bug. ---

[Bug 65498] If-None-Match header causes 400 with static file

2021-08-12 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=65498 --- Comment #3 from dzab...@rampecdn.com --- (In reply to dzabner from comment #2) > Any E-Tag I use seems to cause the issue. > > i.e. 'If-None-Match: W/"8176-1626385749844"-gzip' Interestingly, removing the -gzip fixes the issue. So maybe th

[Bug 65498] If-None-Match header causes 400 with static file

2021-08-12 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=65498 --- Comment #4 from Michael Osipov --- (In reply to dzabner from comment #2) > Any E-Tag I use seems to cause the issue. > > i.e. 'If-None-Match: W/"8176-1626385749844"-gzip' This ETag 8s invalid too -- You are receiving this mail because:

[Bug 65498] If-None-Match header causes 400 with static file

2021-08-12 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=65498 --- Comment #5 from dzab...@rampecdn.com --- So I guess the bug is bad ETag generation: curl -v -s -H 'Accept-Encoding: gzip' http://localhost:8080/example/example.js 2>&1 > /dev/null * Trying ::1... * TCP_NODELAY set * Connected to local

[Bug 65498] If-None-Match header causes 400 with static file

2021-08-12 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=65498 dzab...@rampecdn.com changed: What|Removed |Added Resolution|--- |CLOSED Status|NEW