java-packages/tomcat11
SHA256
6
0
Fork 0
forked from pool/tomcat11
Code Pull Requests Activity
Files
main
tomcat11/tomcat-jdt.patch

119 lines
7.8 KiB
Diff
Raw Permalink Normal View History

- Update to Tomcat 11.0.9 - adapt tomcat-jdt.patch * Fixed CVEs: + CVE-2025-52520: Align size tracking for multipart requests with FileUpload's use of long. (bsc#1246388) + CVE-2025-53506: Apply the initial HTTP/2 connection limits earlier. (bsc#1246318) * Catalina + Fix: Ensure application configured welcome files override the defaults when configuring an embedded web application programmatically. (markt) + Update: Optimize Request#getCharsetHolder to avoid repeated parsing when charset is null. Patch provided by morning-gu. (schultz) + Fix: Allow the default servlet to set the content length when the content length is known, no content has been written and a Writer is being used. (markt) + Fix: 69717: Correct a regression in the fix for CVE-2025-49125 that prevented access to PreResources and PostResources when mounted below the web application root with a path that was terminated with a file separator. (remm/markt) + Fix: 69731: Fix an issue that meant that the value of maxParameterCount applied was smaller than intended for multipart uploads with non-file parts when the parts were processed before query string parameters. (markt) + Fix: Align size tracking for multipart requests with FileUpload's use of long. (schultz) * Coyote + Fix: 69710: Increase the default for maxPartCount from 10 to 50. Update the documentation to provide more details on the memory requirements to support multi-part uploads while avoiding a denial of service risk. (markt) + Fix: 69713: Correctly handle an HTTP/2 data frame that includes padding when the headers include a content-length. (remm/markt) + Fix: Correctly collect statistics for HTTP/2 requests and avoid counting one request multiple times. Based on pull request #868 by qingdaoheze. (markt) + Fix: Fix JMX value for keepAliveCount on the endpoint. Also add the value of useVirtualThreads in JMX. (remm) + Fix: 69728: Remove incorrect warning when HTTP/2 is used with optional certificate verification and improve the warnings when a web application tries to use CLIENT-CERT with either HTTP/2 or a JSSE implementation of TLS 1.3. (markt) + Fix: When setting the initial HTTP/2 connection limit, apply those limits earlier. (markt) * Jasper + Code: Remove IMPL_OBJ_START from EL grammar for IDENTIFIER. (markt) + Code: Remove the INSTANCEOF and FUNCTIONSUFFIX definitions from the EL grammar as both are unused. (markt) * Web applications + Add: Documentation. Provide more explicit guidance regarding the security considerations for enabling write access to the web application via WebDAV, HTTP PUT requests or similar. (markt) + Add: Documentation. Add a section on reverse proxies to the security considerations page. (markt) * Other + Update: Update to the Eclipse JDT compiler 4.36. (markt) + Update: Update UnboundID to 7.0.3. (markt) + Update: Update Checkstyle to 10.25.1. (markt) + Update: Improvements to French translations. (remm) + Update: Improvements to Japanese translations provided by tak7iji. (markt) OBS-URL: https://build.opensuse.org/package/show/Java:packages/tomcat11?expand=0&rev=15
2025-08-14 08:00:45 +00:00
Index: apache-tomcat-11.0.9-src/java/org/apache/jasper/compiler/JDTCompiler.java
OBS-URL: https://build.opensuse.org/package/show/Java:packages/tomcat11?expand=0&rev=1
2025-04-24 04:32:40 +00:00
===================================================================
- Update to Tomcat 11.0.9 - adapt tomcat-jdt.patch * Fixed CVEs: + CVE-2025-52520: Align size tracking for multipart requests with FileUpload's use of long. (bsc#1246388) + CVE-2025-53506: Apply the initial HTTP/2 connection limits earlier. (bsc#1246318) * Catalina + Fix: Ensure application configured welcome files override the defaults when configuring an embedded web application programmatically. (markt) + Update: Optimize Request#getCharsetHolder to avoid repeated parsing when charset is null. Patch provided by morning-gu. (schultz) + Fix: Allow the default servlet to set the content length when the content length is known, no content has been written and a Writer is being used. (markt) + Fix: 69717: Correct a regression in the fix for CVE-2025-49125 that prevented access to PreResources and PostResources when mounted below the web application root with a path that was terminated with a file separator. (remm/markt) + Fix: 69731: Fix an issue that meant that the value of maxParameterCount applied was smaller than intended for multipart uploads with non-file parts when the parts were processed before query string parameters. (markt) + Fix: Align size tracking for multipart requests with FileUpload's use of long. (schultz) * Coyote + Fix: 69710: Increase the default for maxPartCount from 10 to 50. Update the documentation to provide more details on the memory requirements to support multi-part uploads while avoiding a denial of service risk. (markt) + Fix: 69713: Correctly handle an HTTP/2 data frame that includes padding when the headers include a content-length. (remm/markt) + Fix: Correctly collect statistics for HTTP/2 requests and avoid counting one request multiple times. Based on pull request #868 by qingdaoheze. (markt) + Fix: Fix JMX value for keepAliveCount on the endpoint. Also add the value of useVirtualThreads in JMX. (remm) + Fix: 69728: Remove incorrect warning when HTTP/2 is used with optional certificate verification and improve the warnings when a web application tries to use CLIENT-CERT with either HTTP/2 or a JSSE implementation of TLS 1.3. (markt) + Fix: When setting the initial HTTP/2 connection limit, apply those limits earlier. (markt) * Jasper + Code: Remove IMPL_OBJ_START from EL grammar for IDENTIFIER. (markt) + Code: Remove the INSTANCEOF and FUNCTIONSUFFIX definitions from the EL grammar as both are unused. (markt) * Web applications + Add: Documentation. Provide more explicit guidance regarding the security considerations for enabling write access to the web application via WebDAV, HTTP PUT requests or similar. (markt) + Add: Documentation. Add a section on reverse proxies to the security considerations page. (markt) * Other + Update: Update to the Eclipse JDT compiler 4.36. (markt) + Update: Update UnboundID to 7.0.3. (markt) + Update: Update Checkstyle to 10.25.1. (markt) + Update: Improvements to French translations. (remm) + Update: Improvements to Japanese translations provided by tak7iji. (markt) OBS-URL: https://build.opensuse.org/package/show/Java:packages/tomcat11?expand=0&rev=15
2025-08-14 08:00:45 +00:00
--- apache-tomcat-11.0.9-src.orig/java/org/apache/jasper/compiler/JDTCompiler.java
+++ apache-tomcat-11.0.9-src/java/org/apache/jasper/compiler/JDTCompiler.java
@@ -318,23 +318,23 @@ public class JDTCompiler extends org.apa
OBS-URL: https://build.opensuse.org/package/show/Java:packages/tomcat11?expand=0&rev=1
2025-04-24 04:32:40 +00:00
} else if (opt.equals("15")) {
settings.put(CompilerOptions.OPTION_Source, CompilerOptions.VERSION_15);
} else if (opt.equals("16")) {
- settings.put(CompilerOptions.OPTION_Source, CompilerOptions.VERSION_16);
+ settings.put(CompilerOptions.OPTION_Source, "16");
} else if (opt.equals("17")) {
- settings.put(CompilerOptions.OPTION_Source, CompilerOptions.VERSION_17);
+ settings.put(CompilerOptions.OPTION_Source, "17");
} else if (opt.equals("18")) {
- settings.put(CompilerOptions.OPTION_Source, CompilerOptions.VERSION_18);
+ settings.put(CompilerOptions.OPTION_Source, "18");
} else if (opt.equals("19")) {
- settings.put(CompilerOptions.OPTION_Source, CompilerOptions.VERSION_19);
+ settings.put(CompilerOptions.OPTION_Source, "19");
} else if (opt.equals("20")) {
- settings.put(CompilerOptions.OPTION_Source, CompilerOptions.VERSION_20);
+ settings.put(CompilerOptions.OPTION_Source, "20");
} else if (opt.equals("21")) {
- settings.put(CompilerOptions.OPTION_Source, CompilerOptions.VERSION_21);
+ settings.put(CompilerOptions.OPTION_Source, "21");
} else if (opt.equals("22")) {
- settings.put(CompilerOptions.OPTION_Source, CompilerOptions.VERSION_22);
+ settings.put(CompilerOptions.OPTION_Source, "22");
} else if (opt.equals("23")) {
- settings.put(CompilerOptions.OPTION_Source, CompilerOptions.VERSION_23);
+ settings.put(CompilerOptions.OPTION_Source, "23");
} else if (opt.equals("24")) {
- Update to Tomcat 11.0.9 - adapt tomcat-jdt.patch * Fixed CVEs: + CVE-2025-52520: Align size tracking for multipart requests with FileUpload's use of long. (bsc#1246388) + CVE-2025-53506: Apply the initial HTTP/2 connection limits earlier. (bsc#1246318) * Catalina + Fix: Ensure application configured welcome files override the defaults when configuring an embedded web application programmatically. (markt) + Update: Optimize Request#getCharsetHolder to avoid repeated parsing when charset is null. Patch provided by morning-gu. (schultz) + Fix: Allow the default servlet to set the content length when the content length is known, no content has been written and a Writer is being used. (markt) + Fix: 69717: Correct a regression in the fix for CVE-2025-49125 that prevented access to PreResources and PostResources when mounted below the web application root with a path that was terminated with a file separator. (remm/markt) + Fix: 69731: Fix an issue that meant that the value of maxParameterCount applied was smaller than intended for multipart uploads with non-file parts when the parts were processed before query string parameters. (markt) + Fix: Align size tracking for multipart requests with FileUpload's use of long. (schultz) * Coyote + Fix: 69710: Increase the default for maxPartCount from 10 to 50. Update the documentation to provide more details on the memory requirements to support multi-part uploads while avoiding a denial of service risk. (markt) + Fix: 69713: Correctly handle an HTTP/2 data frame that includes padding when the headers include a content-length. (remm/markt) + Fix: Correctly collect statistics for HTTP/2 requests and avoid counting one request multiple times. Based on pull request #868 by qingdaoheze. (markt) + Fix: Fix JMX value for keepAliveCount on the endpoint. Also add the value of useVirtualThreads in JMX. (remm) + Fix: 69728: Remove incorrect warning when HTTP/2 is used with optional certificate verification and improve the warnings when a web application tries to use CLIENT-CERT with either HTTP/2 or a JSSE implementation of TLS 1.3. (markt) + Fix: When setting the initial HTTP/2 connection limit, apply those limits earlier. (markt) * Jasper + Code: Remove IMPL_OBJ_START from EL grammar for IDENTIFIER. (markt) + Code: Remove the INSTANCEOF and FUNCTIONSUFFIX definitions from the EL grammar as both are unused. (markt) * Web applications + Add: Documentation. Provide more explicit guidance regarding the security considerations for enabling write access to the web application via WebDAV, HTTP PUT requests or similar. (markt) + Add: Documentation. Add a section on reverse proxies to the security considerations page. (markt) * Other + Update: Update to the Eclipse JDT compiler 4.36. (markt) + Update: Update UnboundID to 7.0.3. (markt) + Update: Update Checkstyle to 10.25.1. (markt) + Update: Improvements to French translations. (remm) + Update: Improvements to Japanese translations provided by tak7iji. (markt) OBS-URL: https://build.opensuse.org/package/show/Java:packages/tomcat11?expand=0&rev=15
2025-08-14 08:00:45 +00:00
- settings.put(CompilerOptions.OPTION_Source, CompilerOptions.VERSION_24);
+ settings.put(CompilerOptions.OPTION_Source, "24");
} else if (opt.equals("25")) {
OBS-URL: https://build.opensuse.org/package/show/Java:packages/tomcat11?expand=0&rev=1
2025-04-24 04:32:40 +00:00
// Constant not available in latest ECJ version shipped with
// Tomcat. May be supported in a snapshot build.
- Update to Tomcat 11.0.9 - adapt tomcat-jdt.patch * Fixed CVEs: + CVE-2025-52520: Align size tracking for multipart requests with FileUpload's use of long. (bsc#1246388) + CVE-2025-53506: Apply the initial HTTP/2 connection limits earlier. (bsc#1246318) * Catalina + Fix: Ensure application configured welcome files override the defaults when configuring an embedded web application programmatically. (markt) + Update: Optimize Request#getCharsetHolder to avoid repeated parsing when charset is null. Patch provided by morning-gu. (schultz) + Fix: Allow the default servlet to set the content length when the content length is known, no content has been written and a Writer is being used. (markt) + Fix: 69717: Correct a regression in the fix for CVE-2025-49125 that prevented access to PreResources and PostResources when mounted below the web application root with a path that was terminated with a file separator. (remm/markt) + Fix: 69731: Fix an issue that meant that the value of maxParameterCount applied was smaller than intended for multipart uploads with non-file parts when the parts were processed before query string parameters. (markt) + Fix: Align size tracking for multipart requests with FileUpload's use of long. (schultz) * Coyote + Fix: 69710: Increase the default for maxPartCount from 10 to 50. Update the documentation to provide more details on the memory requirements to support multi-part uploads while avoiding a denial of service risk. (markt) + Fix: 69713: Correctly handle an HTTP/2 data frame that includes padding when the headers include a content-length. (remm/markt) + Fix: Correctly collect statistics for HTTP/2 requests and avoid counting one request multiple times. Based on pull request #868 by qingdaoheze. (markt) + Fix: Fix JMX value for keepAliveCount on the endpoint. Also add the value of useVirtualThreads in JMX. (remm) + Fix: 69728: Remove incorrect warning when HTTP/2 is used with optional certificate verification and improve the warnings when a web application tries to use CLIENT-CERT with either HTTP/2 or a JSSE implementation of TLS 1.3. (markt) + Fix: When setting the initial HTTP/2 connection limit, apply those limits earlier. (markt) * Jasper + Code: Remove IMPL_OBJ_START from EL grammar for IDENTIFIER. (markt) + Code: Remove the INSTANCEOF and FUNCTIONSUFFIX definitions from the EL grammar as both are unused. (markt) * Web applications + Add: Documentation. Provide more explicit guidance regarding the security considerations for enabling write access to the web application via WebDAV, HTTP PUT requests or similar. (markt) + Add: Documentation. Add a section on reverse proxies to the security considerations page. (markt) * Other + Update: Update to the Eclipse JDT compiler 4.36. (markt) + Update: Update UnboundID to 7.0.3. (markt) + Update: Update Checkstyle to 10.25.1. (markt) + Update: Improvements to French translations. (remm) + Update: Improvements to Japanese translations provided by tak7iji. (markt) OBS-URL: https://build.opensuse.org/package/show/Java:packages/tomcat11?expand=0&rev=15
2025-08-14 08:00:45 +00:00
@@ -342,11 +342,11 @@ public class JDTCompiler extends org.apa
OBS-URL: https://build.opensuse.org/package/show/Java:packages/tomcat11?expand=0&rev=1
2025-04-24 04:32:40 +00:00
settings.put(CompilerOptions.OPTION_Source, "25");
} else {
log.warn(Localizer.getMessage("jsp.warning.unknown.sourceVM", opt));
- settings.put(CompilerOptions.OPTION_Source, CompilerOptions.VERSION_17);
+ settings.put(CompilerOptions.OPTION_Source, "17");
}
} else {
// Default to 17
- settings.put(CompilerOptions.OPTION_Source, CompilerOptions.VERSION_17);
+ settings.put(CompilerOptions.OPTION_Source, "17");
}
// Target JVM
- Update to Tomcat 11.0.9 - adapt tomcat-jdt.patch * Fixed CVEs: + CVE-2025-52520: Align size tracking for multipart requests with FileUpload's use of long. (bsc#1246388) + CVE-2025-53506: Apply the initial HTTP/2 connection limits earlier. (bsc#1246318) * Catalina + Fix: Ensure application configured welcome files override the defaults when configuring an embedded web application programmatically. (markt) + Update: Optimize Request#getCharsetHolder to avoid repeated parsing when charset is null. Patch provided by morning-gu. (schultz) + Fix: Allow the default servlet to set the content length when the content length is known, no content has been written and a Writer is being used. (markt) + Fix: 69717: Correct a regression in the fix for CVE-2025-49125 that prevented access to PreResources and PostResources when mounted below the web application root with a path that was terminated with a file separator. (remm/markt) + Fix: 69731: Fix an issue that meant that the value of maxParameterCount applied was smaller than intended for multipart uploads with non-file parts when the parts were processed before query string parameters. (markt) + Fix: Align size tracking for multipart requests with FileUpload's use of long. (schultz) * Coyote + Fix: 69710: Increase the default for maxPartCount from 10 to 50. Update the documentation to provide more details on the memory requirements to support multi-part uploads while avoiding a denial of service risk. (markt) + Fix: 69713: Correctly handle an HTTP/2 data frame that includes padding when the headers include a content-length. (remm/markt) + Fix: Correctly collect statistics for HTTP/2 requests and avoid counting one request multiple times. Based on pull request #868 by qingdaoheze. (markt) + Fix: Fix JMX value for keepAliveCount on the endpoint. Also add the value of useVirtualThreads in JMX. (remm) + Fix: 69728: Remove incorrect warning when HTTP/2 is used with optional certificate verification and improve the warnings when a web application tries to use CLIENT-CERT with either HTTP/2 or a JSSE implementation of TLS 1.3. (markt) + Fix: When setting the initial HTTP/2 connection limit, apply those limits earlier. (markt) * Jasper + Code: Remove IMPL_OBJ_START from EL grammar for IDENTIFIER. (markt) + Code: Remove the INSTANCEOF and FUNCTIONSUFFIX definitions from the EL grammar as both are unused. (markt) * Web applications + Add: Documentation. Provide more explicit guidance regarding the security considerations for enabling write access to the web application via WebDAV, HTTP PUT requests or similar. (markt) + Add: Documentation. Add a section on reverse proxies to the security considerations page. (markt) * Other + Update: Update to the Eclipse JDT compiler 4.36. (markt) + Update: Update UnboundID to 7.0.3. (markt) + Update: Update Checkstyle to 10.25.1. (markt) + Update: Improvements to French translations. (remm) + Update: Improvements to Japanese translations provided by tak7iji. (markt) OBS-URL: https://build.opensuse.org/package/show/Java:packages/tomcat11?expand=0&rev=15
2025-08-14 08:00:45 +00:00
@@ -396,32 +396,32 @@ public class JDTCompiler extends org.apa
OBS-URL: https://build.opensuse.org/package/show/Java:packages/tomcat11?expand=0&rev=1
2025-04-24 04:32:40 +00:00
settings.put(CompilerOptions.OPTION_TargetPlatform, CompilerOptions.VERSION_15);
settings.put(CompilerOptions.OPTION_Compliance, CompilerOptions.VERSION_15);
} else if (opt.equals("16")) {
- settings.put(CompilerOptions.OPTION_TargetPlatform, CompilerOptions.VERSION_16);
- settings.put(CompilerOptions.OPTION_Compliance, CompilerOptions.VERSION_16);
+ settings.put(CompilerOptions.OPTION_TargetPlatform, "16");
+ settings.put(CompilerOptions.OPTION_Compliance, "16");
} else if (opt.equals("17")) {
- settings.put(CompilerOptions.OPTION_TargetPlatform, CompilerOptions.VERSION_17);
- settings.put(CompilerOptions.OPTION_Compliance, CompilerOptions.VERSION_17);
+ settings.put(CompilerOptions.OPTION_TargetPlatform, "17");
+ settings.put(CompilerOptions.OPTION_Compliance, "17");
} else if (opt.equals("18")) {
- settings.put(CompilerOptions.OPTION_TargetPlatform, CompilerOptions.VERSION_18);
- settings.put(CompilerOptions.OPTION_Compliance, CompilerOptions.VERSION_18);
+ settings.put(CompilerOptions.OPTION_TargetPlatform, "18");
+ settings.put(CompilerOptions.OPTION_Compliance, "18");
} else if (opt.equals("19")) {
- settings.put(CompilerOptions.OPTION_TargetPlatform, CompilerOptions.VERSION_19);
- settings.put(CompilerOptions.OPTION_Compliance, CompilerOptions.VERSION_19);
+ settings.put(CompilerOptions.OPTION_TargetPlatform, "19");
+ settings.put(CompilerOptions.OPTION_Compliance, "19");
} else if (opt.equals("20")) {
- settings.put(CompilerOptions.OPTION_TargetPlatform, CompilerOptions.VERSION_20);
- settings.put(CompilerOptions.OPTION_Compliance, CompilerOptions.VERSION_20);
+ settings.put(CompilerOptions.OPTION_TargetPlatform, "20");
+ settings.put(CompilerOptions.OPTION_Compliance, "20");
} else if (opt.equals("21")) {
- settings.put(CompilerOptions.OPTION_TargetPlatform, CompilerOptions.VERSION_21);
- settings.put(CompilerOptions.OPTION_Compliance, CompilerOptions.VERSION_21);
+ settings.put(CompilerOptions.OPTION_TargetPlatform, "21");
+ settings.put(CompilerOptions.OPTION_Compliance, "21");
} else if (opt.equals("22")) {
- settings.put(CompilerOptions.OPTION_TargetPlatform, CompilerOptions.VERSION_22);
- settings.put(CompilerOptions.OPTION_Compliance, CompilerOptions.VERSION_22);
+ settings.put(CompilerOptions.OPTION_TargetPlatform, "22");
+ settings.put(CompilerOptions.OPTION_Compliance, "22");
} else if (opt.equals("23")) {
- settings.put(CompilerOptions.OPTION_TargetPlatform, CompilerOptions.VERSION_23);
- settings.put(CompilerOptions.OPTION_Compliance, CompilerOptions.VERSION_23);
+ settings.put(CompilerOptions.OPTION_TargetPlatform, "23");
+ settings.put(CompilerOptions.OPTION_Compliance, "23");
} else if (opt.equals("24")) {
- Update to Tomcat 11.0.9 - adapt tomcat-jdt.patch * Fixed CVEs: + CVE-2025-52520: Align size tracking for multipart requests with FileUpload's use of long. (bsc#1246388) + CVE-2025-53506: Apply the initial HTTP/2 connection limits earlier. (bsc#1246318) * Catalina + Fix: Ensure application configured welcome files override the defaults when configuring an embedded web application programmatically. (markt) + Update: Optimize Request#getCharsetHolder to avoid repeated parsing when charset is null. Patch provided by morning-gu. (schultz) + Fix: Allow the default servlet to set the content length when the content length is known, no content has been written and a Writer is being used. (markt) + Fix: 69717: Correct a regression in the fix for CVE-2025-49125 that prevented access to PreResources and PostResources when mounted below the web application root with a path that was terminated with a file separator. (remm/markt) + Fix: 69731: Fix an issue that meant that the value of maxParameterCount applied was smaller than intended for multipart uploads with non-file parts when the parts were processed before query string parameters. (markt) + Fix: Align size tracking for multipart requests with FileUpload's use of long. (schultz) * Coyote + Fix: 69710: Increase the default for maxPartCount from 10 to 50. Update the documentation to provide more details on the memory requirements to support multi-part uploads while avoiding a denial of service risk. (markt) + Fix: 69713: Correctly handle an HTTP/2 data frame that includes padding when the headers include a content-length. (remm/markt) + Fix: Correctly collect statistics for HTTP/2 requests and avoid counting one request multiple times. Based on pull request #868 by qingdaoheze. (markt) + Fix: Fix JMX value for keepAliveCount on the endpoint. Also add the value of useVirtualThreads in JMX. (remm) + Fix: 69728: Remove incorrect warning when HTTP/2 is used with optional certificate verification and improve the warnings when a web application tries to use CLIENT-CERT with either HTTP/2 or a JSSE implementation of TLS 1.3. (markt) + Fix: When setting the initial HTTP/2 connection limit, apply those limits earlier. (markt) * Jasper + Code: Remove IMPL_OBJ_START from EL grammar for IDENTIFIER. (markt) + Code: Remove the INSTANCEOF and FUNCTIONSUFFIX definitions from the EL grammar as both are unused. (markt) * Web applications + Add: Documentation. Provide more explicit guidance regarding the security considerations for enabling write access to the web application via WebDAV, HTTP PUT requests or similar. (markt) + Add: Documentation. Add a section on reverse proxies to the security considerations page. (markt) * Other + Update: Update to the Eclipse JDT compiler 4.36. (markt) + Update: Update UnboundID to 7.0.3. (markt) + Update: Update Checkstyle to 10.25.1. (markt) + Update: Improvements to French translations. (remm) + Update: Improvements to Japanese translations provided by tak7iji. (markt) OBS-URL: https://build.opensuse.org/package/show/Java:packages/tomcat11?expand=0&rev=15
2025-08-14 08:00:45 +00:00
- settings.put(CompilerOptions.OPTION_TargetPlatform, CompilerOptions.VERSION_24);
- settings.put(CompilerOptions.OPTION_Compliance, CompilerOptions.VERSION_24);
+ settings.put(CompilerOptions.OPTION_TargetPlatform, "24");
+ settings.put(CompilerOptions.OPTION_Compliance, "24");
} else if (opt.equals("25")) {
OBS-URL: https://build.opensuse.org/package/show/Java:packages/tomcat11?expand=0&rev=1
2025-04-24 04:32:40 +00:00
// Constant not available in latest ECJ version shipped with
// Tomcat. May be supported in a snapshot build.
- Update to Tomcat 11.0.9 - adapt tomcat-jdt.patch * Fixed CVEs: + CVE-2025-52520: Align size tracking for multipart requests with FileUpload's use of long. (bsc#1246388) + CVE-2025-53506: Apply the initial HTTP/2 connection limits earlier. (bsc#1246318) * Catalina + Fix: Ensure application configured welcome files override the defaults when configuring an embedded web application programmatically. (markt) + Update: Optimize Request#getCharsetHolder to avoid repeated parsing when charset is null. Patch provided by morning-gu. (schultz) + Fix: Allow the default servlet to set the content length when the content length is known, no content has been written and a Writer is being used. (markt) + Fix: 69717: Correct a regression in the fix for CVE-2025-49125 that prevented access to PreResources and PostResources when mounted below the web application root with a path that was terminated with a file separator. (remm/markt) + Fix: 69731: Fix an issue that meant that the value of maxParameterCount applied was smaller than intended for multipart uploads with non-file parts when the parts were processed before query string parameters. (markt) + Fix: Align size tracking for multipart requests with FileUpload's use of long. (schultz) * Coyote + Fix: 69710: Increase the default for maxPartCount from 10 to 50. Update the documentation to provide more details on the memory requirements to support multi-part uploads while avoiding a denial of service risk. (markt) + Fix: 69713: Correctly handle an HTTP/2 data frame that includes padding when the headers include a content-length. (remm/markt) + Fix: Correctly collect statistics for HTTP/2 requests and avoid counting one request multiple times. Based on pull request #868 by qingdaoheze. (markt) + Fix: Fix JMX value for keepAliveCount on the endpoint. Also add the value of useVirtualThreads in JMX. (remm) + Fix: 69728: Remove incorrect warning when HTTP/2 is used with optional certificate verification and improve the warnings when a web application tries to use CLIENT-CERT with either HTTP/2 or a JSSE implementation of TLS 1.3. (markt) + Fix: When setting the initial HTTP/2 connection limit, apply those limits earlier. (markt) * Jasper + Code: Remove IMPL_OBJ_START from EL grammar for IDENTIFIER. (markt) + Code: Remove the INSTANCEOF and FUNCTIONSUFFIX definitions from the EL grammar as both are unused. (markt) * Web applications + Add: Documentation. Provide more explicit guidance regarding the security considerations for enabling write access to the web application via WebDAV, HTTP PUT requests or similar. (markt) + Add: Documentation. Add a section on reverse proxies to the security considerations page. (markt) * Other + Update: Update to the Eclipse JDT compiler 4.36. (markt) + Update: Update UnboundID to 7.0.3. (markt) + Update: Update Checkstyle to 10.25.1. (markt) + Update: Improvements to French translations. (remm) + Update: Improvements to Japanese translations provided by tak7iji. (markt) OBS-URL: https://build.opensuse.org/package/show/Java:packages/tomcat11?expand=0&rev=15
2025-08-14 08:00:45 +00:00
@@ -430,12 +430,12 @@ public class JDTCompiler extends org.apa
OBS-URL: https://build.opensuse.org/package/show/Java:packages/tomcat11?expand=0&rev=1
2025-04-24 04:32:40 +00:00
settings.put(CompilerOptions.OPTION_Compliance, "25");
} else {
log.warn(Localizer.getMessage("jsp.warning.unknown.targetVM", opt));
- settings.put(CompilerOptions.OPTION_TargetPlatform, CompilerOptions.VERSION_17);
+ settings.put(CompilerOptions.OPTION_TargetPlatform, "17");
}
} else {
// Default to 17
- settings.put(CompilerOptions.OPTION_TargetPlatform, CompilerOptions.VERSION_17);
- settings.put(CompilerOptions.OPTION_Compliance, CompilerOptions.VERSION_17);
+ settings.put(CompilerOptions.OPTION_TargetPlatform, "17");
+ settings.put(CompilerOptions.OPTION_Compliance, "17");
}
final IProblemFactory problemFactory = new DefaultProblemFactory(Locale.getDefault());
Copy Permalink