pkgsrc-Changes archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: pkgsrc/www/apache-tomcat7
Module Name: pkgsrc
Committed By: ryoon
Date: Tue Apr 8 20:14:55 UTC 2014
Modified Files:
pkgsrc/www/apache-tomcat7: Makefile PLIST distinfo
Log Message:
Update to 7.0.53
* Fix CVE-2014-0050 and CVE-2013-4590,
Changelog:
Tomcat 7.0.53 (violetagg)
Catalina
add Make it easier for applications embedding and/or extending
Tomcat to modify the javaseClassLoader attribute of the WebappClassLoader.
(markt)
fix Improve the robustness of web application undeployment based on
some code analysis triggered by the report for 54315. (markt)
fix 56219: Improve merging process for web.xml files to take
account of the elements and attributes supported by the Servlet version of the
merged file. (markt)
fix 56190: The response should be closed (i.e. no further output is
permitted) when a call to AsyncContext.complete() takes effect. (markt)
fix 56236: Enable Tomcat to work with alternative Servlet and JSP
API JARs that package the XML schemas in such as way as to require a dependency
on the JSP API before enabling validation for web.xml. Tomcat has no such
dependency. (markt)
fix 56246: Fix NullPointerException in MemoryRealm when
authenticating an unknown user. (markt)
fix 56248: Allow the deployer to update an existing WAR file
without undeploying the existing application if the update flag is set. This
allows any existing custom context.xml for the application to be retained. To
update an application and remove any existing context.xml simply undeploy the
old version of the application before deploying the new version. (markt)
fix Redefine the globalXsltFile initialisation parameter of the
DefaultServlet as relative to CATALINA_BASE/conf or CATALINA_HOME/conf. Prevent
user supplied XSLTs used by the DefaultServlet from defining external entities.
(markt)
add Add a work around for validating XML documents (often TLDs)
that use just the file name to refer to refer to the JavaEE schema on which
they are based. (markt)
fix 56293: Cache resources loaded by the class loader from
/META-INF/services/ for better performance for repeated look ups. (markt)
Coyote
fix 53119: Make sure the NIO AJP output buffer is cleared on any
error to prevent any possible overflow if it is written to again before the
connection is closed. This extends the original fix for the APR/native output
buffer to the NIO connector. (kkolinko)
fix 56172: Avoid possible request corruption when using the AJP NIO
connector and a request is sent using more than one AJP message. Patch provided
by Amund Elstad. (markt)
fix 56213: Reduce garbage collection when the NIO connector is
under heavy load. (markt)
fix Improve processing of chuck size from chunked headers. Avoid
overflow and use a bit shift instead of a multiplication as it is marginally
faster. (markt/kkolinko)
fix Fix possible overflow when parsing long values from a byte
array. (markt)
Jasper
fix 54475: Add Java 8 support to SMAP generation for JSPs. Patch by
Robbie Gibson. (markt)
fix 55483: Improve handing of overloaded methods and constructors
in expression language implementation. (markt)
fix 56208: Restore the validateXml option to Jasper that was
previously renamed validateTld. Both options are now supported. validateXml
controls the validation of web.xml files when Jasper parses them and
validateTld controls the validation of *.tld files when Jasper parses them.
(markt)
fix 56223: Throw an IllegalStateException if a call is made to
ServletContext.setInitParameter() after the ServletContext has been
initialized. (markt)
fix 56265: Do not escape values of dynamic tag attributes
containing EL expressions. (kkolinko)
fix Make the default compiler source and target versions for JSPs
Java 6 since Tomcat 7 requires Java 6 as a minimum. (markt)
update 56283: Update to the Eclipse JDT Compiler P20140317-1600 which
adds support for Java 8 syntax to JSPs. Add support for value "1.8" for the
compilerSourceVM and compilerTargetVM options. (markt)
WebSocket
fix Avoid a possible deadlock when one thread is shutting down a
connection while another thread is trying to write to it. (markt)
fix Call onError if an exception is thrown calling onClose when
closing a session. (remm)
Web applications
code In the documentation: add support for several documentation
tags from Tomcat 8. Such as <version-major/>. (kkolinko)
add 56093: Add the SSL Valve to the documentation web application.
(markt)
fix 56217: Improve readability by using left alignment for the
table cell containing the request information on the Manager application status
page. (markt)
fix Fixed java.lang.NegativeArraySizeException when using "Expire
sessions" command in the manager web application on a context where the session
timeout is disabled. (kfujino)
fix Add support for LAST_ACCESS_AT_START system property to Manager
web application. (kfujino)
fix Add definition of org.apache.catalina.ant.FindLeaksTask.
(kfujino)
fix 56273: If the Manager web application does not perform an
operation because the web application is already being serviced, report an
error rather than reporting success. (markt)
fix 56304: Add a note to the documentation about not using
WebSocket with BIO HTTP in production. (markt)
Other
fix 56143: Improve service.bat so that it can be launched from a
non-UAC console. This includes using a single call to tomcat7.exe to install
the Windows service rather than three calls, and using command line arguments
instead of environment variables to pass the settings. (markt/kkolinko)
fix Fix regression in 7.0.52: when using service.bat install to
install the service the values for --StdOutput, --StdError options were passed
as blank instead of "auto". (kkolinko)
fix Align options between service.bat and exe Windows installer.
For service.bat the changes are in --Classpath, --DisplayName, --StartPath,
--StopPath. For exe installer the changes are in --JvmMs, --JvmMx options,
which are now 128 Mb and 256 Mb respectively instead of being empty. Explicitly
specify --LogPath path when uninstalling Windows service, avoiding default
value for that option. (kkolinko)
code Simplify Windows *.bat files: remove %OS% checks, as java 6
does not run on ancient non-NT operating systems. (kkolinko)
fix 56137: Explicitly use the BIO connector in the SSL example in
server.xml so it doesn't break if APR is enabled. (markt)
fix 56139: Avoid a web application class loader leak in some unit
tests when running on Windows. (markt)
fix Correct build script to avoid building JARs with empty
packages. (markt)
add Allow to limit JUnit test run to a number of selected test case
methods. (kkolinko)
fix 56189: Remove used file cpappend.bat from the distribution.
(markt)
Tomcat 7.0.52 (violetagg) released 2014-02-17
Catalina
fix Generate a valid root element for the effective web.xml for a
web application for all supported versions of web.xml. (markt)
Coyote
code Pull up SocketWrapper to AbstractProcessor. (markt)
fix In some circumstances asynchronous requests could time out too
soon. (markt)
Tomcat 7.0.51 (violetagg) not released
Catalina
fix 55287: ServletContainerInitializer defined in the container may
not be found. (markt/jboynes)
fix 55855: Provide a per Context option (containerSciFilter) to
exclude container SCIs. (markt)
fix 55937: When deploying applications, treat a context path of
/ROOT as equivalent to /. (markt)
fix 55943: Improve the implementation of the class loader check
that prevents web applications from trying to override J2SE implementation
classes. As part of this fix, refactor the way a null parent class loader is
handled which enables a number of null checks and object creation calls to be
removed. (markt)
fix 55958: Differentiate between foo.war the WAR file and foo.war
the directory. (markt)
fix 55960: Improve the single sign on (SSO) unit tests. Patch
provided by Brian Burch. (markt)
fix 55974: Retain order when reporting errors and warnings while
parsing XML configuration files. (markt)
fix 56013: Fix issue with SPNEGO authentication when using IBM
JREs. IBM JREs only understand the option of infinite lifetime for Kerberos
credentials. Based on a patch provided by Arunav Sanyal. (markt)
fix 56016: When loading resources for XML schema validation, take
account of the possibility that servlet-api.jar and jsp-api.jar may not be
loaded by the same class loader. Patch by Juan Carlos Estibariz. (markt)
fix 56025: When creating a WebSocket connection, always call
ServerEndpointConfig.Configurator.getNegotiatedSubprotocol() and always create
the EndPoint instance after calling
ServerEndpointConfig.Configurator.modifyHandshake(). (markt)
fix 56032: Ensure that the WebSocket connection is closed after an
IO error or an interrupt while sending a WebSocket message. (markt)
fix 56042: If a request in async mode has an error but has already
been dispatched don't generate an error page in the ErrorReportValve so the
dispatch target can handle it. (markt)
fix Add missing javax.annotation.sql.* classes to
annotations-api.jar. (markt)
fix The type of logger attribute of Context MBean should be not
org.apache.commons.logging.Log but org.apache.juli.logging.Log. (kfujino)
fix 56082: Fix a concurrency bug in JULI's LogManager
implementation. (markt)
fix 56096: When the attribute rmiBindAddress of the JMX Remote
Lifecycle Listener is specified it's value will be used when constructing the
address of a JMX API connector server. Patch is provided by Jim Talbut.
(violetagg)
fix When environment entry with one and the same name is defined in
the web deployment descriptor and with annotation then the one specified in the
web deployment descriptor is with priority. (violetagg)
fix Change default value of xmlBlockExternal attribute of Context.
It is true now. (kkolinko)
Coyote
fix Avoid possible NPE if a content type is specified without a
character set. (markt)
fix 55956: Make the forwarded remote IP address available to the
Connectors via a request attribute. (markt)
fix 55976: Fix sendfile support for the HTTP NIO connector. (markt)
fix 55996: Ensure Async requests timeout correctly when using the
NIO HTTP connector. (markt)
add 56021: Make it possible to use the Windows-MY key store with
the BIO and NIO connectors for SSL configuration. It requires a keystoreFile=""
keystoreType="Windows-My" to be set on the connector. Based on a patch provided
by Asanka. (markt)
Jasper
fix Correct a regression in the XML refactoring that meant that
errors in TLD files were swallowed. (markt)
fix 55671: Correct typo in the log message for a wrong value of
genStringAsCharArray init-param of JspServlet. This parameter had a different
name in Tomcat 6. (kkolinko)
fix 55973: Fix processing of XML schemas when validation is enabled
in Jasper. (kkolinko)
fix 56010: Don't throw an IllegalArgumentException when
JspFactory.getPageContext is used with JspWriter.DEFAULT_BUFFER. Based on a
patch by Eugene Chung. (markt)
fix 56012: When using the extends attribute of the page directive
do not import the super class if it is in an unnamed package as imports from
unnamed packages are now explicitly illegal. (markt)
fix 56029: A regression in the fix for 55198 meant that when EL
containing a ternary expression was used in an attribute a compilation error
would occur for some expressions. (markt)
fix Correct several errors in jspxml Schema and DTD. (kkolinko)
fix Change default value of the blockExternal attribute of JspC
task. The default value is true. Add support for -no-blockExternal switch when
JspC is run as a standalone application. (kkolinko)
Cluster
code Simplify the code of
o.a.c.ha.tcp.SimpleTcpCluster.createManager(String). Remove unnecessary class
cast. (kfujino)
WebSocket
fix Do not return an empty string for the Sec-WebSocket-Protocol
HTTP header when no sub-protocol has been requested or no sub-protocol could be
agreed as RFC6455 requires that no Sec-WebSocket-Protocol header is returned in
this case. (markt)
Web applications
fix Add index.xhtml to the welcome files list for the examples web
application. (kkolinko)
fix Clarify that the connectionTimeout may also be used as the read
timeout when reading a request body (if any) in the documentation web
application. (markt)
fix Clarify the behaviour of the maxConnections attribute for a
connector in the documentation web application. (markt)
fix 55888: Update the documentation web application to make it
clearer that a Container may define no more than one Realm. (markt)
fix 55956: Where available, displayed the forwarded remote IP
address available on the status page of the Manager web application. (markt)
fix Correct links to the Tomcat mailing lists in the ROOT web
application. (kkolinko)
fix In Manager web application improve handling of file upload
errors. Display a message instead of error 500 page. Simplify parts handling
code, as it is known that Tomcat takes care of them when recycling a request.
(kkolinko)
Extras
fix 55166, 56045: Copy the XML schemas used for validation that are
packaged in jsp-api.jar to servlet-api.jar so that an embedded Tomcat instance
can start without Jasper being available. This also enables validation to work
without Jasper being available. (markt/kkolinko)
fix 56039: Enable the JmxRemoteLifecycleListener to work over SSL.
Patch by esengstrom. (markt)
Other
fix 55743: Enable the stop script to work when the shutdown port is
disabled and a PID file is defined. This is only available on platforms that
use catalina.sh. (markt)
fix 55986: When forcing Tomcat to stop via kill -9 $CATALINA_PID,
the catalina.sh script could incorrectly report that Tomcat had not yet
completely stopped when it had. Based on a patch by jess. (markt)
fix Package correct license and notice files with embedded JARs.
(markt)
code Remove svn keywords (such as $Id) from source files and
documentation. (kkolinko)
fix Fix CVE-2014-0050, a denial of service with a malicious,
malformed Content-Type header and multipart request processing. Fixed by
merging latest code (r1565163) from Commons FileUpload. (markt)
fix 56115: Expose the httpusecaches property of Ant's get task as
some users may need to change the default. Based on a suggestion by Anthony.
(markt)
Tomcat 7.0.50 (violetagg) released 2014-01-08
Catalina
fix Handle the case where a context.xml file is added to a web
application deployed from a directory. Previously the file was ignored until
Tomcat was restarted. Now (assuming automatic deployment is enabled) it will
trigger a redeploy of the web application. (markt)
fix Fix string comparison in HostConfig.setContextClass().
(kkolinko)
code Streamline handling of WebSocket messages when no handler is
configured for the message currently being received. (markt)
fix Handle the case where a WebSocket annotation configures a
message size limit larger than the default permitted by Tomcat. (markt)
fix 55855: This is a partial fix that bypasses the relatively
expensive check for a WebSocket upgrade request if no WebSocket endpoints have
been registered. (markt)
fix 55905: Prevent a NPE when web.xml references a taglib file that
does not exist. Provide better error message. (violetagg)
Coyote
fix When using the BIO connector with an internal executor, do not
display a warning that the executor has not shutdown as the default
configuration for BIO connectors is not to wait. This is because threads in
keep-alive connections cannot be interrupted and therefore the warning was
nearly always displayed. (markt)
Jasper
fix JspC uses servlet context initialization parameters to pass
configuration so ensure that the servlet context used supports initialization
parameters. (markt)
Cluster
fix In AbstractReplicatedMap#finalize, remove rpcChannel from
channel Listener of group channel before sending MapMessage.MSG_STOP message.
This prevents that the node that sent the MapMessage.MSG_STOP by normal
shutdown is added to member map again by ping at heartbeat thread in the node
that received the MapMessage.MSG_STOP. (kfujino)
fix Add time stamp to GET_ALL_SESSIONS message. (kfujino)
Web applications
fix Fix the sample configuration of StaticMembershipInterceptor in
order to prevent warning log. uniqueId must be 16 bytes. (kfujino)
Extras
update Update dependencies that are used to build tomcat-juli extras
component. Apache Avalon Framework is updated to version 4.1.5, Apache Log4J to
version 1.2.17. (rjung)
Tomcat 7.0.49 (violetagg) not released
Catalina
fix Correct a regression in the new XML local resolver that
triggered false failures when XML validation was configured. (markt)
fix Prevent a NPE when destroying HTTP upgrade handler for
WebSocket connections. (violetagg)
Tomcat 7.0.48 (violetagg) not released
Catalina
add 51294: Add support for unpacking WARs located outside of the
Host's appBase in to the appBase. (markt)
fix 55656: Configure the Digester to use the server class loader
when parsing server.xml rather than the class loader that loaded
StandardServer. Patch provided by Roberto Benedetti. (markt)
fix 55664: Correctly handle JSR 356 WebSocket Encoder, Decoder and
MessageHandler implementations that use a generic type such as
Encoder.Text<List<String>>. Includes a test case by Niki Dokovski. (markt)
fix Correctly handle WebSocket Encoders, Decoders and
MessageHandlers that use arrays of generic types. (markt)
fix 55681: Ensure that the WebSocket session is made available to
MessageHandler method calls. (markt)
fix Updated servlet spec version and documentation section-number
reported when JAR files are rejected for containing a trigger class (e.g.
javax.servlet.Servlet). (schultz)
add Modify the WebSocket handshake process so that the user
properties Map exposed by the ServerEndpointConfig during the call to
Configurator.modifyHandshake() is unique to the connection rather than shared
by all connections associated with the Endpoint. This allows for easier
configuration of per connection properties from within modifyHandshake().
(markt)
fix 55684: Log a warning but continue if the memory leak detection
code is unable to access all threads to check for possible memory leaks when a
web application is stopped. (markt)
fix Define the web-fragment.xml in tomcat7-websocket.jar as a
Servlet 3.0 web fragment rather than as a Servlet 3.1 web fragment. (markt)
fix 55715: Add a per web application executor to the WebSocket
implementation and use it for calling SendHandler.onResult() when there is a
chance that the current thread also initiated the write. (markt)
fix Prevent file descriptors leak and ensure that files are closed
when configuring the web application. (violetagg)
fix Fixed the name of the provider-configuration file located in
tomcat7-websocket.jar!/META-INF/services that exposes information for
javax.websocket.server.ServerEndpointConfig$Configurator implementation.
(violetagg)
fix 55760: Remove the unnecessary setting of the
javax.security.auth.useSubjectCredsOnly system property in the
SpnegoAuthenticator as in addition to it being unnecessary, it causes problems
with using SPNEGO with IBM JDKs. Patch provided by Arunav Sanyal. (markt)
fix 55772: Ensure that the request and response are recycled after
an error during asynchronous processing. Includes a test case based on code
contributed by Todd West. (markt)
fix 55778: Add an option to the JNDI Realm to control the QOP used
for the connection to the LDAP server after authentication when using SPNEGO
with delegated credentials. This value is used to set the
javax.security.sasl.qop environment property for the LDAP connection. (markt)
fix 55798: Log an error if the MemoryUserDatabase is unable to find
the specified user database file. (markt)
fix 55799: Correctly enforce the restriction in JSR356 that no more
than one data message may be sent to a remote WebSocket endpoint at a time.
(markt)
fix When Catalina parses TLD files, always use a namespace aware
parser to be consistent with how Jasper parses TLD files. The tldNamespaceAware
attribute of the Context is now ignored. (markt)
fix Deprecate the tldNamespaceAware Context attribute as TLDs are
always parsed with a namespace aware parser. (markt)
fix Correct a logic error that meant that unpackWARs was ignored
and the WAR was always expanded if a WAR failed to deploy. (markt)
add Add support for defining copyXML on a per Context basis. (markt)
fix Define the expected behaviour of the automatic deployment and
align the implementation to that definition. (markt)
add When running under a security manager, change the default value
of the Host's deployXML attribute to false. (markt)
add If a Host is configured with a value of false for deployXML, a
web application has an embedded descriptor at META-INF/context.xml and no
explicit descriptor has been defined for this application, do not allow the
application to start. The reason for this is that the embedded descriptor may
contain configuration necessary for secure operation such as a RemoteAddrValve.
(markt)
fix Prevent an NPE in the WebSocket ServerContainer when processing
an HTTP session end event. (markt)
add 55801: Add the ability to set a custom SSLContext to use for
client wss connections. Patch provided by Maciej Lypik. (markt)
fix 55804: If the GSSCredential for the cached Principal expires
when using SPNEGO authentication, force a re-authentication. (markt)
add 55811: If the main web.xml contains an empty absolute-ordering
element and validation of web.xml is not enabled, skip parsing any
web-fragment.xml files as the result is never used. (markt)
fix 55839: Extend support for digest prefixes {MD5}, {SHA} and
{SSHA} to all Realms rather than just the JNDIRealm. (markt)
fix 55842: Ensure that if a larger than default response buffer is
configured that the full buffer is used when a Servlet outputs via a Writer.
(markt)
fix 55851: Further fixes to enable SPNEGO authentication to work
with IBM JDKs. Based on a patch by Arunav Sanyal. (markt)
add Fix CVE-2013-4590: Add an option to the Context to control the
blocking of XML external entities when parsing XML configuration files and
enable this blocking by default when a security manager is used. The block is
implemented via a custom resolver to enable the logging of any blocked
entities. (markt)
Coyote
code Implement a number of small refactorings to the APR/native
handler for upgraded HTTP connections. (markt)
fix Fix an issue with upgraded HTTP connections over HTTPS (e.g.
secure WebSocket) when using the APR/native connector that resulted in the
unexpected closure of the connection. (markt)
fix Ensure that the application class loader is used when calling
the ReadListener and WriteListener methods when using non-blocking IO. A side
effect of not doing this was that JNDI was not available when processing
WebSocket events. (markt)
add Make the time that the internal executor (if used) waits for
request processing threads to terminate before continuing with the connector
stop process configurable. (markt)
fix 55749: Improve the error message when SSLEngine is disabled in
the AprLifecycleListener and SSL is configured for an APR/native connector.
(markt)
add If a request that includes an Expect: 100-continue header
receives anything other than a 2xx response, close the connection This protects
against misbehaving clients that may not sent the request body in that case and
send the next request instead. (markt)
fix Improve the parsing of trailing headers in HTTP requests.
(markt)
Jasper
fix 55735: Fix a regression caused by the fix to 55198. When
processing JSP documents, attributes in XML elements that are template content
should have their text xml-escaped, but output of EL expressions in them should
not be escaped. (markt)
fix 55807: The JSP compiler used a last modified time of -1 for
TLDs in JARs expanded in to WEB-INF/classes (IDEs often do this expansion) when
creating the dependency list for JSPs that used that TLD. This meant JSPs using
that TLD were recompiled on every access. (markt)
Cluster
add Add log message that initialization of AbstractReplicatedMap
has been completed. (kfujino)
fix The logger of AbstractReplicatedMap should be non-static in
order to enable logging of each application. Side-effects of this change is to
throw RuntimeException in MapMessage#getKey() and getValue() instead of Null
return and error log. (kfujino)
code Simplify the code of DeltaManager#startInternal(). Reduce
unnecessary nesting for acquisition of cluster instance. (kfujino)
fix Remove unnecessary attributes of stateTransferCreateSendTime
and receiverQueue from cluster manager template. These attributes should not be
defined as a template. (kfujino)
fix Fix MBean attribute definition of stateTransfered. The method
name is not isStateTransfered() but getStateTransfered(). (kfujino)
fix Correct stop failure log of cluster. Failure cause is not only
Valve. (kfujino)
fix Remove unnecessary sleep when sending session blocks on session
sync phase. (kfujino)
fix Expose stateTimestampDrop of
org.apache.catalina.ha.session.DeltaManager via JMX. (kfujino)
fix When the ping timeouted, make sure that memberDisappeared
method is not called by specifying the members that has already been removed.
(kfujino)
add Add log message of session relocation when member disappeared.
(kfujino)
fix If ping message fails, prevent wrong timeout detection of
normal member that is no failure members. (kfujino)
Web applications
add Add some documentation on the SSL configuration options for
WebSocket clients. (markt)
add Add to cluster document a description of
notifyLifecycleListenerOnFailure and heartbeatBackgroundEnabled. (kfujino)
fix Update the documentation with information for WebSocket 1.0
specification and javadoc. (violetagg)
fix 55703: Clarify the role of the singleton attribute for JNDI
resource factories. (markt)
fix 55746: Add documentation on the allRolesMode to the
CombinedRealm and LockOutRealm. Patch by Cédric Couralet. (markt)
add Expand the information on web applications that ship as part of
Tomcat in the security how-to section of the documentation web application.
(markt)
fix Expand the description of the WebSocket buffers in the
documentation web application to clarify their purpose. (markt)
add Correct the documentation for Cluster manager. (kfujino)
add Add information on how to configure integrated Windows
authentication when Tomcat is running on a non-Windows host. (markt)
Extras
update Update commons-logging to version 1.1.3. (rjung)
Other
add 52323: Add support for the Cobertura code coverage tool when
running the unit tests. Based on a patch by mhasko. (markt/kkolinko)
update Update sample Eclipse IDE project. Explicitly use a Java 6 SE
JDK. Exclude JSR356 WebSocket classes from build path, as they cannot be
compiled with Java 6. (kkolinko)
update Update the Eclipse compiler to 4.3.1. (kkolinko/markt)
To generate a diff of this commit:
cvs rdiff -u -r1.17 -r1.18 pkgsrc/www/apache-tomcat7/Makefile
cvs rdiff -u -r1.9 -r1.10 pkgsrc/www/apache-tomcat7/PLIST
cvs rdiff -u -r1.11 -r1.12 pkgsrc/www/apache-tomcat7/distinfo
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Home |
Main Index |
Thread Index |
Old Index