[pkgsrc/trunk]: pkgsrc/www/apache-tomcat9 Update to 9.0.22

[ryoon <ryoon%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/419b49bb9c8f
branches:  trunk
changeset: 336464:419b49bb9c8f
user:      ryoon <ryoon%pkgsrc.org@localhost>
date:      Mon Jul 15 14:32:15 2019 +0000

description:
Update to 9.0.22

Changelog:
Tomcat 9.0.22 (markt)
Catalina

    Fix: Improve parsing of Range request headers. (markt)
    Fix: Range headers that specify a range unit Tomcat does not recognise should be ignored rather than triggering a 416 response. Based on a pull request by zhanhb. (markt)
    Fix: When comparing a date from a If-Range header, an exact match is required. Based on a pull request by zhanhb. (markt)
    Fix: Add an option to the default servlet to disable processing of PUT requests with Content-Range headers as partial PUTs. The default behaviour (processing as partial PUT) is unchanged. Based 
on a pull request by zhanhb. (markt)
    Fix: Improve parsing of Content-Range headers. (markt)
    Update: Update the recommended minimum Tomcat Native version to 1.2.23. (markt)

Coyote

    Fix: Remove a source of potential deadlocks when using HTTP/2 when the Connector is configured with useAsyncIO as true. (markt)
    Fix: 63523: Restore SSLUtilBase methods as protected to preserve compatibility. (remm)
    Fix: Fix typo in UTF-32LE charset name. Patch by zhanhb vi Github. (fschumacher)
    Fix: Once a URI is identified as invalid don't attempt to process it further. Based on a PR by Alex Repert. (markt)
    Fix: Fix to avoid the possibility of long poll times for individual pollers when using mutliple pollers with APR. (markt)
    Fix: Refactor the fix for 63205 so it only applies when using PKCS12 keystores as regressions have been reported with some other keystore types. (markt)

Jasper

    Add: Include file names if SMAP processor is unable to delete or rename a class file during SMAP generation. (markt)
    Update: Update to the Eclipse JDT compiler 4.12. (markt)

WebSocket

    Fix: 63521: As required by the WebSocket specification, if a POJO that is deployed as a result of the SCI scan for annotated POJOs is subsequently deployed via the programmatic API ignore the 
programmatic deployment. (markt)

Other

    Fix: Switch the check for terminal availability to test for stdin as using stdout does not work when output is piped to another process. Patch provided by Rados?aw J?zwik. (markt)
    Add: Add user buildable optional modules for easier CDI 2 and JAX-RS support. Also include a new documentation page describing how to use it. (remm)

2019-06-07 Tomcat 9.0.21 (markt)
Catalina

    Add: 57287: Add file sorting to DefaultServlet (schultz)
    Fix: Fix --no-jmx flag processing, which was called after registry initialization. (remm)
    Fix: Ensure that a default request character encoding set on a ServletContext is used when calling ServletRequest#getReader(). (markt)
    Fix: Make a best efforts attempt to clean-up if a request fails during processing due to an OutOfMemoryException. (markt)
    Fix: Improve the BoM detection for static files handled by the default servlet for the rarely used UTF-32 encodings. Identified by Coverity Scan. (markt)
    Fix: Ensure that the default servlet reads the entire global XSLT file if one is defined. Identified by Coverity Scan. (markt)
    Fix: Avoid potential NullPointerException when generating an HTTP Allow header. Identified by Coverity Scan. (markt)
    Code: Add Context.createInstanceManager() for easier framework integration. (remm)
    Code: Add utility org.apache.catalina.core.FrameworkListener to allow replicating adding a Listener to context.xml in a programmatic way. (remm)
    Code: Move Container.ADD_CHILD_EVENT to before the child container start, and Container.REMOVE_CHILD_EVENT to before removal of the child from the internal child collection. (remm)
    Add: Remove any fragment included in the target path used to obtain a RequestDispatcher. The requested target path is logged as a warning since this is an application error. (markt)

Coyote

    Fix: NIO poller seems to create some unwanted concurrency, causing rare CI test failures. Add sync when processing async operation to avoid this. (remm)
    Fix: Fix concurrency issue that lead to incorrect HTTP/2 connection timeout. (remm/markt)
    Fix: Avoid useless exception wrapping in async IO. (remm)
    Fix: 63412: Security manager failure when using the async IO API from a webapp. (remm)
    Fix: Remove acceptorThreadCount Connector attribute, one accept thread is sufficient. As documented, value 2 was the only other sensible value, but without and impact beyond certain 
microbenchmarks. (remm)
    Fix: Avoid possible NPEs on connector stop. (remm)
    Update: Remove pollerThreadCount Connector attribute for NIO, one poller thread is sufficient. (remm)
    Add: Add async IO for APR connector for consistency, but disable it by default due to low performance. (remm)
    Fix: Avoid blocking write of internal buffer when using async IO. (remm)
    Code: Refactor async IO implementation to the SocketWrapperBase. (remm)
    Update: Refactor SocketWrapperBase close using an atomic boolean and a doClose method that subclasses will implement, with a guarantee that it will be run only once. (remm)
    Fix: Decouple the socket wrapper, which is not recycled, from the NIOx channel after close, and replace it with a dummy static object. (remm)
    Fix: Clear buffers on socket wrapper close. (remm)
    Fix: NIO2 failed to properly close sockets on connector stop. (remm)
    Update: Reduce the default for maxConcurrentStreams on the Http2Protocol from 200 to 100 to align with typical defaults for HTTP/2 implementations. (markt)
    Update: Reduce the default HTTP/2 header list size from 4GB to 32kB to align with typical HTTP/2 implementations. (markt)
    Add: Add support for same-site cookie attribute. Patch provided by John Kelly. (markt)
    Fix: Drop legacy NIO double socket close (close channel, then close socket). (remm)
    Fix: Fix HTTP/2 end of stream concurrency with async. (remm)
    Fix: Correct a bug in the stream flushing code that could lead to multiple threads processing the stream concurrently which in turn could cause errors processing the stream. (markt)

Cluster

    Fix: 62841: Refactor the DeltaRequest serialization to reduce the window during which the DeltaSession is locked and to remove a potential cause of deadlocks during serialization. (markt)
    Fix: 63441: Further streamline the processing of session creation messages in the DeltaManager to reduce the possibility of a session update message being processed before the session has been 
created. (markt)

WebSocket

   d: Expand the explanation of how deprecated TLS configuration attributes are converted to the new TLS configuration style. (markt)

Tribes

    Fix: Treat NoRouteToHostException the same way as SocketTimeoutException when checking the health of group membaven packaging. (remm)
    Fix: 63403: Fix TestHttp2InitialConnection test failures when running with a non-English locale. (kkolinko)
    Fix: Add Graal JreCompat, and use it to disable JMX and URL stream handlers. (remm)
    Add: Expand the coverage and Expand the coverage and quality of the Simplified Chinese translations provided with Apache Tomcat. Includes contributions by ?. (markt)
    Fix: Use the test command to check for terminal availability rather than the tty command since the tty based te

    Fix: Fix some edge cases where the docBase was not being set using a canonical path which in turn meant resource URLs were not being constructed as expected. (markt)
    Fix: Fix a potential resource leak when executing CGI scripts from a WAR file. Identified by Coverity scan. (markt)
    Fix: Fix a potential concurrency issue in the StringCache identified by Coverity scan. (markt)
    Fix: Fix a potential concurrency issue in the main Sendfile thread of the APR connector. Identified by Coverity scan. (markt)
    Fix: Fix a potential resource leak when running a web application from a WAR file. Identified by Coverity scan. (markt)
    Fix: Fix a potential resource leak on some exception paths in the DataSourceRealm. Identified by Coverity scan. (markt)
    Fix: Fix a potential resource leak on an exception path when parsing JSP files. Identified by Coverity scan. (markt)
    Fix: Fix a potential resource leak when a JNDI lookup returns an object of an in compatible class. Identified by Coverity scan. (markt)
    Code: Refactor ManagerServlet to avoid loading classes when filtering JNDI resources for resources of a specified type. (markt)
    Fix: 63324: Refactor the CrawlerSessionManagerValve so that the object placed in the session is compatible with session serialization with mem-cached. Patch provided by Martin Lemanski. (markt)
    Add: 63358: Expand the throwOnFailure support in the Connector to include the adding of a Connector to a running Service. (markt)
    Add: 63361: Add a new method (Registry.disableRegistry()) that can be used to disable JMX registration of Tomcat components providing it is called before the first component is registered. (markt)
    Fix: Avoid OutOfMemoryErrors and ArrayIndexOutOfBoundsExceptions when accessing large files via the default servlet when resource caching has been disabled. (markt)
    Fix: Avoid a NullPointerException when a Context is defined in server.xml with a docBase but not the optional path. (markt)
    Fix: 63333: Override the isAvailable() method in the JAASRealm so that only login failures caused by invalid credentials trigger account lock out when the LockOutRealm is in use. Patch provided 
by jchobantonov. (markt)
    Fix: Add --no-jmx flag to allow disabling JMX in startup.Tomcat.main. (remm)

Coyote

    Fix: The useAsyncIO boolean attribute on the Connector element value now defaults to true. (remm)
    Fix: Possible HTTP/2 connection leak issue when using async with NIO. (remm)
    Fix: Fix socket close discrepancies for NIO, now the wrapper close is used everywhere except for socket accept problems. (remm)
    Fix: Implement poller timeout when using async IO with NIO. (remm)
    Fix: Avoid creating and using object caches when they are disabled. (remm)
    Fix: When running on newer JREs that don't support SSLv2Hello, don't warn that it is not available unless explicitly configured. (markt)
    Fix: Change default value of pollerThreadCount of NIO to 1. (remm)
    Fix: Associate BlockPoller thread name with its NIO connector for better readability. (remm)
    Fix: The async HTTP/2 frame parser should tolerate concurrency so clearing shared buffers before attempting a read is not possible. (remm)
    Update: Update the HTTP/2 connection preface and initial frame reading to be asynchronous instead of blocking IO. (remm)
    Code: Refactor Hostname validation to improve performance. Patch provided by Uwe Hees. (markt)
    Update: Add additional NIO2 style read and write methods closer to core NIO2, for possible use with an asynchronous workflow like CompletableFuture. (remm)
    Fix: Expand HTTP/2 timeout handling to include connection window exhaustion on write. This is the fix for CVE-2019-10072. (markt)

Jasper

    Fix: 63359: Ensure that the type conversions used when converting from strings for jsp:setProperty actions are correctly implemented as per section JSP.1.14.2.1 of the JSP 2.3 specification. 
(markt)

Other

    Fix: 63335: Ensure that stack traces written by the OneLineFormatter are fully indented. The entire stack trace is now indented by an additional TAB character. (markt)
    Fix: 63370: Message files (LocalStrings_*.properties) of the examples webapp not converted to ascii. (woonsan)
    Add: Expand the coverage and quality of the French translations provided with Apache Tomcat. (remm)
    Add: Expand the coverage and quality of the Japanese translations provided with Apache Tomcat. Includes contributions by motohashi.yuki. (markt)
    Add: Expand the coverage and quality of the Czech translations provided with Apache Tomcat. Includes contributions by Arno?t Havelka. (markt)
    Fix: When using the OneLineFormatter, don't print a blank line in the log after printing a stack trace. (markt)
    Update: Update the internal fork of Apache Commons FileUpload to 41e4047 (2019-04-24) pick up some enhancements. (markt)
    Update: Update the internal fork of Apache Commons DBCP 2 to dcdbc72 (2019-04-24) to pick up some clean-up and enhancements. (markt)
    Update: Update the internal fork of Apache Commons Pool 2 to 0664f4d (2019-04-30) to pick up some enhancements and bug fixes. (markt)

2019-04-13 Tomcat 9.0.19 (markt)
Catalina

    Fix: Fix wrong JMX registration regression in 9.0.18. (remm)

Coyote

    Update: Add vectoring for NIO in the base and SSL channels. (remm)
    Add: Add asynchronous IO from NIO2 to the NIO connector, with support for the async IO implementations for HTTP/2 and Websockets. The useAsyncIO boolean attribute on the Connector element allows 
enabling use of the asynchronous IO API. (remm)

Other

    Fix: Ensure that the correct files are included in the source distribution for javacc based parsers depending on whether jjtree is used or not. (markt)
    Fix: Ensure that text files in the source distribution have the correct line endings for the target platform. (markt)

not released Tomcat 9.0.18 (markt)
Catalina

    Fix: 63196: Provide a default (X-Forwarded-Proto) for the protocolHeader attribute of the RemoteIpFilter and RemoteIpValve. (markt)
    Fix: 63235: Refactor Charset cache to reduce start time. (markt)
    Fix: 63249: Use a consistent log level (WARN) when logging the failure to register or deregister a JMX Bean. (markt)
    Fix: 63249: Use a consistent log level (ERROR) when logging the LifecycleException associated with the failure to start or stop a component. (markt)
    Fix: When the SSI directive fsize is used with an invalid target, return a file size of - rather than 1k. (markt)
    Fix: 63251: Implement a work-around for a known JRE bug (JDK-8194653) that may cause a dead-lock when Tomcat starts. (markt)
    Fix: 63275: When using a RequestDispatcher ensure that HttpServletRequest.getContextPath() returns an encoded path in the dispatched request. (markt)
    Update: Add optional listeners for Server/Listener, as a slight variant of a standard listener. The difference is that loading is not fatal when it fails. This would allow adding example 
configuration to the standard server.xml if deemed useful. Storeconfig will not attempt to persist the new listener. (remm)
    Fix: 63286: Document the differences in behaviour between the LogFormat directive in httpd and the pattern attribute in the AccessLogValve for %D and %T. (markt)
    Fix: 63287: Make logging levels more consistent for similar issues of similar severity. (markt)
    Fix: 63311: Add support for https URLs to the local resolver within Tomcat used to resolve standard XML DTDs and schemas when Tomcat is configured to validate XML configuration files such as 
web.xml. (markt)
    Fix: Encode the output of the SSI printenv command. This is the fix for CVE-2019-0221. (markt)
    Code: Use constants for SSI encoding values. (markt)
    Add: When the CGI Servlet is configured with enableCmdLineArguments set to true, limit the encoded form of the individual command line arguments to those values allowed by RFC 3875. This 
restriction may be relaxed by the use of the new initialisation parameter cmdLineArgumentsEncoded. (markt)
    Add: When the CGI Servlet is configured with enableCmdLineArguments set to true, limit the decoded form of the individual command line arguments to known safe values when running on Windows. This 
restriction may be relaxed by the use of the new initialisation parameter cmdLineArgumentsDecoded. This is the fix for CVE-2019-0232. (markt)

Coyote

    Fix: Fix bad interaction between NIO2 async read API and the regular read. (remm)
    Fix: Refactor NIO2 write pending strategy for the classic IO API. (remm)
    Fix: Restore original maxConnections default for NIO2 as the underlying close issues have been fixed. (remm)
    Fix: Harmonize NIO2 isReadyForWrite with isReadyForRead code. (remm)
    Fix: When using a JSSE TLS connector that supported ALPN (Java 9 onwards) and a protocol was not negotiated, Tomcat failed to fallback to HTTP/1.1 and instead dropped the connection. (markt)
    Fix: Correct a regression in the TLS connector refactoring in Tomcat 9.0.17 that prevented the use of PKCS#8 private keys with OpenSSL based connectors. (markt)
    Fix: Fix NIO2 SSL edge cases. (remm)
    Fix: When performing an upgrade from HTTP/1.1 to HTTP/2, ensure that any query string present in the original HTTP/1.1 request is passed to the HTTP/2 request processing. (markt)
    Fix: When Tomcat writes a final response without reading all of an HTTP/2 request, reset the stream to inform the client that the remaining request body is not required. (markt)

Jasper

    Add: Add support for specifying Java 11 (with the value 11) as the compiler source and/or compiler target for JSP compilation. (markt)
    Add: Add support for specifying Java 12 (with the value 12) and Java 13 (with the value 13) as the compiler source and/or compiler target for JSP compilation. If used with an ECJ version that 
does not support these values, a warning will be logged and the latest supported version will used. Based on a patch by Thomas Collignon. (markt)

Web applications

    Fix: 63184: Expand the SSI documentation to provide more information on the supported directives and their attributes. Patch provided by nightwatchcyber. (markt)
    Add: Add a note to the documentation about the risk of DoS with poorly written regular expressions and the RewriteValve. Patch provided by salgattas. (markt)

jdbc-pool

    Fix: Improved maxAge handling. Add support for age check on idle connections. Connection that expired reconnects rather than closes it. Patch provided by toby1984. (kfujino)
    Fix: 63320: Ensure that StatementCache caches statements that include arrays in arguments. (kfujino)

Other

    Update: Update to the Eclipse JDT compiler 4.10. (markt)
    Add: Expand the coverage and quality of the Spanish translations provided with Apache Tomcat. Includes contributions by Ulises Gonzalez Horta. (markt)
    Add: Expand the coverage and quality of the Czech translations provided with Apache Tomcat. Includes contributions by Arno?t Havelka. (markt)
    Add: Expand the coverage and quality of the Chinese translations provided with Apache Tomcat. Includes contributions by winsonzhao and wjt. (markt)
    Add: Expand the coverage and quality of the Russian translations provided with Apache Tomcat. (kkolinko)
    Add: Expand the coverage and quality of the Japanese translations provided with Apache Tomcat. (kfujino)
    Add: Expand the coverage and quality of the Korean translations provided with Apache Tomcat. (woonsan)
    Add: Expand the coverage and quality of the German translations provided with Apache Tomcat. (fschumacher)
    Add: Expand the coverage and quality of the French translations provided with Apache Tomcat. (remm)

diffstat:

 www/apache-tomcat9/Makefile |   4 ++--
 www/apache-tomcat9/PLIST    |   5 +++--
 www/apache-tomcat9/distinfo |  10 +++++-----
 3 files changed, 10 insertions(+), 9 deletions(-)

diffs (59 lines):

diff -r b492f186c038 -r 419b49bb9c8f www/apache-tomcat9/Makefile
--- a/www/apache-tomcat9/Makefile       Mon Jul 15 14:29:05 2019 +0000
+++ b/www/apache-tomcat9/Makefile       Mon Jul 15 14:32:15 2019 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.2 2019/03/26 20:59:57 ryoon Exp $
+# $NetBSD: Makefile,v 1.3 2019/07/15 14:32:15 ryoon Exp $
 #
 
 DISTNAME=      apache-tomcat-${TOMCAT_VER}
@@ -21,7 +21,7 @@
 
 .include "../../mk/bsd.prefs.mk"
 
-TOMCAT_VER=            9.0.17
+TOMCAT_VER=            9.0.22
 TOMCAT_HOME=           ${PREFIX}/share/tomcat
 EGDIR=                 ${PREFIX}/share/examples/tomcat
 DOCDIR=                        ${PREFIX}/share/doc/tomcat
diff -r b492f186c038 -r 419b49bb9c8f www/apache-tomcat9/PLIST
--- a/www/apache-tomcat9/PLIST  Mon Jul 15 14:29:05 2019 +0000
+++ b/www/apache-tomcat9/PLIST  Mon Jul 15 14:32:15 2019 +0000
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.2 2019/03/26 20:59:57 ryoon Exp $
+@comment $NetBSD: PLIST,v 1.3 2019/07/15 14:32:15 ryoon Exp $
 share/doc/tomcat/LICENSE
 share/doc/tomcat/NOTICE
 share/doc/tomcat/RELEASE-NOTES
@@ -39,7 +39,7 @@
 share/tomcat/lib/catalina-storeconfig.jar
 share/tomcat/lib/catalina-tribes.jar
 share/tomcat/lib/catalina.jar
-share/tomcat/lib/ecj-4.9.jar
+share/tomcat/lib/ecj-4.12.jar
 share/tomcat/lib/el-api.jar
 share/tomcat/lib/jasper-el.jar
 share/tomcat/lib/jasper.jar
@@ -112,6 +112,7 @@
 share/tomcat/webapps/docs/architecture/startup/serverStartup.txt
 share/tomcat/webapps/docs/balancer-howto.html
 share/tomcat/webapps/docs/building.html
+share/tomcat/webapps/docs/cdi.html
 share/tomcat/webapps/docs/cgi-howto.html
 share/tomcat/webapps/docs/changelog.html
 share/tomcat/webapps/docs/class-loader-howto.html
diff -r b492f186c038 -r 419b49bb9c8f www/apache-tomcat9/distinfo
--- a/www/apache-tomcat9/distinfo       Mon Jul 15 14:29:05 2019 +0000
+++ b/www/apache-tomcat9/distinfo       Mon Jul 15 14:32:15 2019 +0000
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.2 2019/03/26 20:59:57 ryoon Exp $
+$NetBSD: distinfo,v 1.3 2019/07/15 14:32:15 ryoon Exp $
 
-SHA1 (apache-tomcat-9.0.17.tar.gz) = bea9f591ec4172d9186fefce30e7598252f3428d
-RMD160 (apache-tomcat-9.0.17.tar.gz) = bdaa2be647723af360c5303158283f99a16771e3
-SHA512 (apache-tomcat-9.0.17.tar.gz) = f3427b7c5065a4f52af7bc00224afaae73226bf5def84b45aa305e18200a28e19463dd85a13f4ab1eb739366249cf1e99461014248f1f00b0c97f2afcef896a0
-Size (apache-tomcat-9.0.17.tar.gz) = 10798037 bytes
+SHA1 (apache-tomcat-9.0.22.tar.gz) = 14552f6cfb7d297f60ac90116b5ee44a8c3b45fc
+RMD160 (apache-tomcat-9.0.22.tar.gz) = 427b56cde9b7229de6eb651f8188062518f282b2
+SHA512 (apache-tomcat-9.0.22.tar.gz) = 9d3d93f8e03b5dc74e8d2ebc3f9daeb481485a391fb10289e23848063c23f52e8cf8566ebc7ff4f62c9b9f71591fad368a2bab487d31377c85a2607be3e029ff
+Size (apache-tomcat-9.0.22.tar.gz) = 10929702 bytes