null.
-@@ -1383,22 +1298,18 @@ public class JNDIRealm extends RealmBase
- *
- * @exception NamingException if a directory server error occurs
- */
-- public Principal authenticate(JNDIConnection connection,
-- String username,
-- String credentials)
-- throws NamingException {
--
-- if (username == null || username.equals("")
-- || credentials == null || credentials.equals("")) {
-- if (containerLog.isDebugEnabled())
-+ public Principal authenticate(JNDIConnection connection, String username, String credentials)
-+ throws NamingException {
-+
-+ if (username == null || username.equals("") || credentials == null || credentials.equals("")) {
-+ if (containerLog.isDebugEnabled()) {
- containerLog.debug("username null or empty: returning null principal.");
-+ }
- return null;
- }
-
- if (userPatternArray != null) {
-- for (int curUserPattern = 0;
-- curUserPattern < userPatternArray.length;
-- curUserPattern++) {
-+ for (int curUserPattern = 0; curUserPattern < userPatternArray.length; curUserPattern++) {
- // Retrieve user information
- User user = getUser(connection, username, credentials, curUserPattern);
- if (user != null) {
-@@ -1426,12 +1337,14 @@ public class JNDIRealm extends RealmBase
- } else {
- // Retrieve user information
- User user = getUser(connection, username, credentials);
-- if (user == null)
-+ if (user == null) {
- return null;
-+ }
-
- // Check the user's credentials
-- if (!checkCredentials(connection.context, user, credentials))
-+ if (!checkCredentials(connection.context, user, credentials)) {
- return null;
-+ }
-
- // Search for additional roles
- Listtrue if the credentials are validated
- * @exception NamingException if a directory server error occurs
- */
-- protected boolean checkCredentials(DirContext context,
-- User user,
-- String credentials)
-- throws NamingException {
--
-- boolean validated = false;
--
-- if (userPassword == null) {
-- validated = bindAsUser(context, user, credentials);
-- } else {
-- validated = compareCredentials(context, user, credentials);
-- }
--
-- if (containerLog.isTraceEnabled()) {
-- if (validated) {
-- containerLog.trace(sm.getString("jndiRealm.authenticateSuccess",
-- user.getUserName()));
-- } else {
-- containerLog.trace(sm.getString("jndiRealm.authenticateFailure",
-- user.getUserName()));
-- }
-- }
-- return validated;
-- }
-+ protected boolean checkCredentials(DirContext context, User user, String credentials) throws NamingException {
-+
-+ boolean validated = false;
-+
-+ if (userPassword == null) {
-+ validated = bindAsUser(context, user, credentials);
-+ } else {
-+ validated = compareCredentials(context, user, credentials);
-+ }
-+
-+ if (containerLog.isTraceEnabled()) {
-+ if (validated) {
-+ containerLog.trace(sm.getString("jndiRealm.authenticateSuccess", user.getUserName()));
-+ } else {
-+ containerLog.trace(sm.getString("jndiRealm.authenticateFailure", user.getUserName()));
-+ }
-+ }
-+ return validated;
-+ }
-
-
- /**
-@@ -1811,17 +1724,15 @@ public class JNDIRealm extends RealmBase
- * @return true if the credentials are validated
- * @exception NamingException if a directory server error occurs
- */
-- protected boolean compareCredentials(DirContext context,
-- User info,
-- String credentials)
-- throws NamingException {
--
-+ protected boolean compareCredentials(DirContext context, User info, String credentials) throws NamingException {
- // Validate the credentials specified by the user
-- if (containerLog.isTraceEnabled())
-+ if (containerLog.isTraceEnabled()) {
- containerLog.trace(" validating credentials");
-+ }
-
-- if (info == null || credentials == null)
-+ if (info == null || credentials == null) {
- return false;
-+ }
-
- String password = info.getPassword();
-
-@@ -1838,21 +1749,22 @@ public class JNDIRealm extends RealmBase
- * @return true if the credentials are validated
- * @exception NamingException if a directory server error occurs
- */
-- protected boolean bindAsUser(DirContext context,
-- User user,
-- String credentials)
-- throws NamingException {
--
-- if (credentials == null || user == null)
-- return false;
--
-- String dn = user.getDN();
-- if (dn == null)
-- return false;
--
-- // Validate the credentials specified by the user
-- if (containerLog.isTraceEnabled()) {
-- containerLog.trace(" validating credentials by binding as the user");
-+ protected boolean bindAsUser(DirContext context, User user, String credentials) throws NamingException {
-+
-+ if (credentials == null || user == null) {
-+ return false;
-+ }
-+
-+ // This is returned from the directory so will be attribute value
-+ // escaped if required
-+ String dn = user.getDN();
-+ if (dn == null) {
-+ return false;
-+ }
-+
-+ // Validate the credentials specified by the user
-+ if (containerLog.isTraceEnabled()) {
-+ containerLog.trace(" validating credentials by binding as the user");
- }
-
- userCredentialsAdd(context, dn, credentials);
-@@ -1877,48 +1789,47 @@ public class JNDIRealm extends RealmBase
- return validated;
- }
-
-- /**
-- * Configure the context to use the provided credentials for
-- * authentication.
-- *
-- * @param context DirContext to configure
-- * @param dn Distinguished name of user
-- * @param credentials Credentials of user
-- * @exception NamingException if a directory server error occurs
-- */
-- private void userCredentialsAdd(DirContext context, String dn,
-- String credentials) throws NamingException {
-+
-+ /**
-+ * Configure the context to use the provided credentials for
-+ * authentication.
-+ *
-+ * @param context DirContext to configure
-+ * @param dn Distinguished name of user
-+ * @param credentials Credentials of user
-+ * @exception NamingException if a directory server error occurs
-+ */
-+ private void userCredentialsAdd(DirContext context, String dn, String credentials) throws NamingException {
- // Set up security environment to bind as the user
- context.addToEnvironment(Context.SECURITY_PRINCIPAL, dn);
- context.addToEnvironment(Context.SECURITY_CREDENTIALS, credentials);
- }
-
-+
- /**
- * Configure the context to use {@link #connectionName} and
- * {@link #connectionPassword} if specified or an anonymous connection if
- * those attributes are not specified.
- *
-- * @param context DirContext to configure
-- * @exception NamingException if a directory server error occurs
-+ * @param context DirContext to configure
-+ * @exception NamingException if a directory server error occurs
- */
-- private void userCredentialsRemove(DirContext context)
-- throws NamingException {
-+ private void userCredentialsRemove(DirContext context) throws NamingException {
- // Restore the original security environment
- if (connectionName != null) {
-- context.addToEnvironment(Context.SECURITY_PRINCIPAL,
-- connectionName);
-+ context.addToEnvironment(Context.SECURITY_PRINCIPAL, connectionName);
- } else {
- context.removeFromEnvironment(Context.SECURITY_PRINCIPAL);
- }
-
- if (connectionPassword != null) {
-- context.addToEnvironment(Context.SECURITY_CREDENTIALS,
-- connectionPassword);
-+ context.addToEnvironment(Context.SECURITY_CREDENTIALS, connectionPassword);
- } else {
- context.removeFromEnvironment(Context.SECURITY_CREDENTIALS);
- }
- }
-
-+
- /**
- * Return a List of roles associated with the given User. Any
- * roles present in the user's directory entry are supplemented by
-@@ -1930,21 +1841,27 @@ public class JNDIRealm extends RealmBase
- * @return the list of role names
- * @exception NamingException if a directory server error occurs
- */
-- protected Listidentity transfer encoding. The
-+ inclusion of this encoding in RFC 2616 was an error that was corrected
-+ in 2001. Requests using this transfer encoding will now receive a 501
-+ response. (markt)
-+ userRoleAttribute
-+ is given. (fschumacher)
-+ WebappClassLoaderBase.getResources() method as it is not
-+ used and if something accidently exposes the class loader this method
-+ can be used to gain access to Tomcat internals. (markt)
-+ userRoleAttribute
- is given. (fschumacher)
diff --git a/tomcat-9.0-javadoc.patch b/tomcat-9.0-javadoc.patch
index 2c275b8..a16c32c 100644
--- a/tomcat-9.0-javadoc.patch
+++ b/tomcat-9.0-javadoc.patch
@@ -2,72 +2,6 @@ Index: apache-tomcat-9.0.35-src/build.xml
===================================================================
--- apache-tomcat-9.0.35-src.orig/build.xml
+++ apache-tomcat-9.0.35-src/build.xml
-@@ -1902,7 +1902,7 @@ Apache Tomcat ${version} native binaries
- source="${compile.source}"
- maxmemory="512m"
- failonerror="true"
-- failonwarning="true">
-+ failonwarning="false">
- OpenSSLEngine.unwrap
- when the destination buffers state is changed concurrently. (remm)
-
-+ content-length header should always be rejected
-+ with a 400 response. (markt)
-+ RemoteIpFilter determines that this request was submitted
- via a secure channel. (lihan)
-
-+ JsonErrorReportValve to ensure that it always outputs valid
-+ JSON. (markt)
-+ The maximum number of parameter and value pairs (GET plus POST) which
-- will be automatically parsed by the container. Parameter and value pairs
-- beyond this limit will be ignored. A value of less than 0 means no limit.
-- If not specified, a default of 10000 is used. Note that
-- FailedRequestFilter filter can be
-- used to reject requests that hit the limit.
The maximum total number of request parameters (including uploaded
-+ files) obtained from the query string and, for POST requests, the request
-+ body if the content type is
-+ application/x-www-form-urlencoded or
-+ multipart/form-data. Request parameters beyond this limit
-+ will be ignored. A value of less than 0 means no limit. If not specified,
-+ a default of 10000 is used. Note that FailedRequestFilter
-+ filter can be used to reject requests that
-+ exceed the limit.
The maximum number of parameter and value pairs (GET plus POST) which
-- will be automatically parsed by the container. Parameter and value pairs
-- beyond this limit will be ignored. A value of less than 0 means no limit.
-- If not specified, a default of 10000 is used. Note that
-- FailedRequestFilter filter can be
-- used to reject requests that hit the limit.
The maximum total number of request parameters (including uploaded
-+ files) obtained from the query string and, for POST requests, the request
-+ body if the content type is
-+ application/x-www-form-urlencoded or
-+ multipart/form-data. Request parameters beyond this limit
-+ will be ignored. A value of less than 0 means no limit. If not specified,
-+ a default of 10000 is used. Note that FailedRequestFilter
-+ filter can be used to reject requests that
-+ exceed the limit.
RemoteIpFilter determines that this request was submitted
-+ via a secure channel. (lihan)
-+