forked from pool/tomcat
Accepting request 1186346 from home:RMestre:branches:Java:packages
* Catalina
+ Fix: Allow JAASRealm to use the configuration source to load a configured
configFile, for easier use with testing. (remm)
+ Fix: Add missing algorithm callback to the JAASCallbackHandler. (remm)
+ Fix: 69131: Expand the implementation of the filter value of the
Authenticator attribute allowCorsPreflight, so that it applies to all
requests that match the configured URL patterns for the CORS filter,
rather than only applying if the CORS filter is mapped to /*. (markt)
+ Add: Add support for shallow copies when using WebDAV. (markt)
+ Code: Deprecate the WebdavFixFilter as it is no longer required. (markt)
+ Fix: 69066: Fix regression in SPNEGO authenticator when processing Base64.
Submitted by Daniel Lyko. (remm)
+ Update: Update minimum recommended version of Tomcat Native to 1.3.0. Pull
request #728 provided by Dimitrios Soumis. (markt)
+ Update: The system property org.apache.catalina.connector.RECYCLE_FACADES
will now default to true if not specified, which will in turn set the
default value for the discardFacades connector attribute, thus causing
facade objects to be discarded by default. (remm)
+ Add: Add RealmBase.getPrincipal(GSSName, GSSCredential, GSSContext) for
retrieving extended/additional information from an established GSS
context. (michaelo)
+ Fix: Correct a regression in the fix for 68721 that caused some instances
of LinkageError to be reported as ClassNotFoundException. (markt)
+ Fix: Ensure that static resources deployed via a JAR file remain
accessible when the context is configured to use a bloom filter. Based on
pull request #730 provided by bergander. (markt)
+ Add: Introduce reference counting so the AprLifecycleListener is more
robust. This particularly targets more complex embedded configurations
with multiple server instances with independent lifecycles where more than
one server instance requires the AprLifecycleListener. (markt)
OBS-URL: https://build.opensuse.org/request/show/1186346
OBS-URL: https://build.opensuse.org/package/show/Java:packages/tomcat?expand=0&rev=316
This commit is contained in:
Fridrich Strba
Git OBS Bridge
parent
02de164b5d
commit
31ec7fc21a
206
tomcat.changes
206
tomcat.changes
@ -13,6 +13,212 @@ Mon Jul 8 14:54:54 UTC 2024 - Ricardo Mestre <ricardo.mestre@suse.com>
|
||||
* Fixed CVEs:
|
||||
+ CVE-2024-34750: Improper handling of exceptional conditions
|
||||
(bsc#1227399)
|
||||
* Catalina
|
||||
+ Fix: Allow JAASRealm to use the configuration source to load a configured
|
||||
configFile, for easier use with testing. (remm)
|
||||
+ Fix: Add missing algorithm callback to the JAASCallbackHandler. (remm)
|
||||
+ Fix: 69131: Expand the implementation of the filter value of the
|
||||
Authenticator attribute allowCorsPreflight, so that it applies to all
|
||||
requests that match the configured URL patterns for the CORS filter,
|
||||
rather than only applying if the CORS filter is mapped to /*. (markt)
|
||||
+ Add: Add support for shallow copies when using WebDAV. (markt)
|
||||
+ Code: Deprecate the WebdavFixFilter as it is no longer required. (markt)
|
||||
+ Fix: 69066: Fix regression in SPNEGO authenticator when processing Base64.
|
||||
Submitted by Daniel Lyko. (remm)
|
||||
+ Update: Update minimum recommended version of Tomcat Native to 1.3.0. Pull
|
||||
request #728 provided by Dimitrios Soumis. (markt)
|
||||
+ Update: The system property org.apache.catalina.connector.RECYCLE_FACADES
|
||||
will now default to true if not specified, which will in turn set the
|
||||
default value for the discardFacades connector attribute, thus causing
|
||||
facade objects to be discarded by default. (remm)
|
||||
+ Add: Add RealmBase.getPrincipal(GSSName, GSSCredential, GSSContext) for
|
||||
retrieving extended/additional information from an established GSS
|
||||
context. (michaelo)
|
||||
+ Fix: Correct a regression in the fix for 68721 that caused some instances
|
||||
of LinkageError to be reported as ClassNotFoundException. (markt)
|
||||
+ Fix: Ensure that static resources deployed via a JAR file remain
|
||||
accessible when the context is configured to use a bloom filter. Based on
|
||||
pull request #730 provided by bergander. (markt)
|
||||
+ Add: Introduce reference counting so the AprLifecycleListener is more
|
||||
robust. This particularly targets more complex embedded configurations
|
||||
with multiple server instances with independent lifecycles where more than
|
||||
one server instance requires the AprLifecycleListener. (markt)
|
||||
+ Update: Deprecate and remove sessionCounter (replaced by the addition of
|
||||
the active session count and the expired session count, as a reasonable
|
||||
approximation) and duplicates (which does not represent a possible event
|
||||
in current implementations) statistics from the session manager. (remm)
|
||||
+ Fix: 68890 Align output encoding of JSPs in the Manager webapp with the
|
||||
XML declarations in those same files. (schultz)
|
||||
+ Fix: Update Basic authentication to implement the requirements of RFC 7617
|
||||
including the changing of the trimCredentials setting which is now
|
||||
defaults to false. Note that the trimCredentials setting will be removed
|
||||
in Tomcat 11. (markt)
|
||||
+ Add: Small performance optimization when logging cookies with no values.
|
||||
(schultz)
|
||||
+ Fix: Correct error handling for asynchronous requests. If the application
|
||||
performs an dispatch during AsyncListener.onError() the dispatch is now
|
||||
performed rather than completing the request using the error page
|
||||
mechanism. (markt)
|
||||
+ Fix: Fix WebDAV lock null (locks for non existing resources) thread safety
|
||||
and removal. (remm)
|
||||
+ Fix: Add periodic checking for WebDAV locks expiration. (remm)
|
||||
+ Fix: Extend Asn1Parser to parse UTF8Strings. (michaelo)
|
||||
+ Update: Add highConcurrencyStatus attribute to the SemaphoreValve to
|
||||
optionally allow the valve to return an error status code to the client
|
||||
when a permit cannot be acquired from the semaphore. (remm)
|
||||
+ Add: Add checking of the "age" of the running Tomcat instance since its
|
||||
build-date to the SecurityListener, and log a warning if the server is
|
||||
old. (schultz)
|
||||
+ Fix: When using the AsyncContext, throw an IllegalStateException, rather
|
||||
than allowing an NullPointerException, if an attempt is made to use the
|
||||
AsyncContext after it has been recycled. (markt)
|
||||
+ Fix: Change the thread-safety mechanism for protecting
|
||||
StandardServer.services from a simple synchronized lock to a
|
||||
ReentrantReadWriteLock to allow multiple readers to operate
|
||||
simultaneously. Based upon a suggestion by Markus Wolfe. (schultz)
|
||||
+ Fix: Improve Service connectors, Container children and Service executors
|
||||
access sync using a ReentrantReadWriteLock. (remm)
|
||||
+ Fix: Improve handling of integer overflow if an attempt is made to upload
|
||||
a file via the Servlet API and the file is larger than
|
||||
Integer.MAX_VALUE. (markt)
|
||||
+ Fix: 68862: Handle possible response commit when processing read errors.
|
||||
(remm)
|
||||
* Jasper
|
||||
+ Fix: Update the optimisation in jakarta.el.ImportHandler so it is aware of
|
||||
new classes added to the java.lang package in Java 23. (markt)
|
||||
+ Fix: Ensure that an exception in toString() still results in an
|
||||
ELException when an object is coerced to a String using
|
||||
ExpressionFactory.coerceToType(). (markt)
|
||||
+ Add: Add support for specifying Java 24 (with the value 24) as the
|
||||
compiler source and/or compiler target for JSP compilation. If used with
|
||||
an Eclipse JDT compiler version that does not support these values, a
|
||||
warning will be logged and the default will used. (markt)
|
||||
+ Fix: 69135: When using include directives in a tag file packaged in a JAR
|
||||
file, ensure that context relative includes are processed correctly. (
|
||||
markt)
|
||||
+ Fix: 69135: When using include directives in a tag file packaged in a JAR
|
||||
file, ensure that file relative includes are processed correctly. (markt)
|
||||
+ Fix: 69135: When using include directives in a tag file packaged in a JAR
|
||||
file, ensure that file relative includes are are not permitted to access
|
||||
files outside of the /META_INF/tags/ directory nor outside of the JAR
|
||||
file. (markt)
|
||||
+ Fix: 68546: Small additional optimisation for initial loading of Servlet
|
||||
code generated for JSPs. Based on a suggestion by Dan Armstrong. (markt)
|
||||
+ Add: Add support for specifying Java 23 (with the value 23) as the
|
||||
compiler source and/or compiler target for JSP compilation. If used with
|
||||
an Eclipse JDT compiler version that does not support these values, a
|
||||
warning will be logged and the default will used. (markt)
|
||||
+ Fix: Handle the case where the JSP engine forwards a request/response to a
|
||||
Servlet that uses an OutputStream rather than a Writer. This was
|
||||
triggering an IllegalStateException on code paths where there was a
|
||||
subsequent attempt to obtain a Writer. (markt)
|
||||
+ Fix: Correctly handle the case where a tag library is packaged in a JAR
|
||||
file and the web application is deployed as a WAR file rather than an
|
||||
unpacked directory. (markt)
|
||||
+ Fix: Prevent the web application's ClassLoader from being pinned by the
|
||||
JSP compiler if an application uses a custom XMLInputFactory. Based upon a
|
||||
suggestion from Simon Niederberger. (schultz)
|
||||
* Web applications
|
||||
+ Fix: Fix status servlet detailed view of the connectors when using
|
||||
automatic port. (remm)
|
||||
+ Add: Add the ability to set a sub-title for the Manager web application
|
||||
main page. This is intended to allow users with lots of instances to
|
||||
easily distinguish them. Based on pull request #724 by Simon Arame.
|
||||
(markt)
|
||||
+ Fix: Examples: Improve performance of WebSocket chat application when
|
||||
multiple clients disconnect at the same time. (markt)
|
||||
+ Update: Examples: Increase the number of previous messages displayed when
|
||||
using the WebSocket chat application. (markt)
|
||||
+ Fix: Examples: Improve performance of WebSocket snake application when
|
||||
multiple clients disconnect at the same time. (markt)
|
||||
* Coyote
|
||||
+ Fix: Improve the algorithm used to identify the IP address to use to
|
||||
unlock the acceptor thread when a Connector is listening on all local
|
||||
addresses. Interfaces that are configured for point to point connections
|
||||
or are not currently up are now skipped. (markt)
|
||||
+ Fix: 69121: Ensure that the onComplete() event is triggered if
|
||||
AsyncListener.onError() dispatches to a target that throws an exception.
|
||||
(markt)
|
||||
+ Fix: Following the trailer header field refactoring, -1 is no longer an
|
||||
allowed value for maxTrailerSize. Adjust documentation accordingly. (remm)
|
||||
+ Fix: 69068: Ensure read timouts are triggered for asynchronous,
|
||||
non-blocking reads when using HTTP/2. (markt)
|
||||
+ Update: 69133: Add task queue size configuration on the Connector element,
|
||||
similar to the Executor element, for consistency. (remm)
|
||||
+ Fix: Make counting of active HTTP/2 streams per connection more robust.
|
||||
(markt)
|
||||
+ Add: Add support for TLS 1.3 client initiated re-keying. (markt)
|
||||
+ Fix: Align non-secure and secure writes with NIO and skip the write
|
||||
attempt when there are no bytes to be written. (markt)
|
||||
+ Fix: Allow any positive value for socket.unlockTimeout. If a negative or
|
||||
zero value is configured, the default of 250ms will be used. (mark)
|
||||
+ Fix: Reduce the time spent waiting for the connector to unlock. The
|
||||
previous default of 10s was noticeably too long for cases where the unlock
|
||||
has failed. The wait time is now 100ms plus twice socket.unlockTimeout.
|
||||
(markt)
|
||||
+ Fix: Ensure that the onAllDataRead() event is triggered when the request
|
||||
body uses chunked encoding and is read using non-blocking IO. (markt)
|
||||
+ Fix: 68934: Add debug logging in the latch object when exceeding
|
||||
maxConnections. (remm)
|
||||
+ Fix: Refactor trailer field handling to use a MimeHeaders instance to
|
||||
store trailer fields. (markt)
|
||||
+ Fix: Ensure that multiple instances of the same trailer field are handled
|
||||
correctly. (markt)
|
||||
+ Fix: Fix non-blocking reads of chunked request bodies. (markt)
|
||||
+ Fix: When an invalid HTTP response header was dropped, an off-by-one error
|
||||
meant that the first header in the response was also dropped. Fix based on
|
||||
pull request #710 by foremans. (markt)
|
||||
+ Fix: Add threadsMaxIdleTime attribute to the endpoint, to allow
|
||||
configuring the amount of time before an internal executor will scale back
|
||||
to the configured minSpareThreads size. (remm)
|
||||
* WebSocket
|
||||
+ Fix: 68884: Reduce the write timeout when writing WebSocket close messages
|
||||
for abnormal closes. The timeout defaults to 50 milliseconds and may be
|
||||
controlled using the
|
||||
org.apache.tomcat.websocket.ABNORMAL_SESSION_CLOSE_SEND_TIMEOUT property
|
||||
in the user properties collection associated with the WebSocket session.
|
||||
(markt)
|
||||
* Other
|
||||
+ Update: Add test-only build target to allow running only the testsuite,
|
||||
supporting Java versions down to the minimum supported to run Tomcat.
|
||||
(rjung)
|
||||
+ Update: Update UnboundID to 7.0.1. (markt)
|
||||
+ Update: Update to SpotBugs 4.8.6. (markt)
|
||||
+ Update: Remove cglib dependency as it is not required by the version of
|
||||
EasyMock used by the unit tests. (markt)
|
||||
+ Update: Update EasyMock to 5.3.0. This adds a test dependency on
|
||||
Byte-Buddy 1.14.17. (markt)
|
||||
+ Add: Improvements to Czech translations by Vladimír Chlup. (markt)
|
||||
+ Add: Improvements to French translations. (remm)
|
||||
+ Add: Improvements to Japanese translations by tak7iji. (markt)
|
||||
+ Add: Improvements to Chinese translations by fangzheng. (markt)
|
||||
+ Update: Revert Derby to 10.16.1.1 as that is the latest version of Derby
|
||||
that runs on Java 17. (markt)
|
||||
+ Update: Update to Commons Daemon 1.4.0. (markt)
|
||||
+ Update: Update to Objenesis 3.4. (markt)
|
||||
+ Update: Update to Checkstyle 10.17.0. (markt)
|
||||
+ Update: Update to SpotBugs 4.8.5. (markt)
|
||||
+ Add: Improvements to French translations. (remm)
|
||||
+ Add: Improvements to Japanese translations by tak7iji. (markt)
|
||||
+ Update: Switch to using the Base64 encoder and decoder provided by the JRE
|
||||
rather than the version provided by Commons Codec. The internal fork of
|
||||
Commons Codec has been deprecated and will be removed in Tomcat 11.
|
||||
(markt)
|
||||
+ Update: Update NSIS to 3.10. (mark0t)
|
||||
+ Update: Update UnboundID to 7.0.0. (markt)
|
||||
+ Update: Update Checkstyle to 10.16.0. (markt)
|
||||
+ Update: Update JaCoCo to 0.8.12. (markt)
|
||||
+ Update: Update SpotBugs to 4.8.4. (markt)
|
||||
+ Update: Update the internal fork of Apache Commons BCEL to 6.9.0. (markt)
|
||||
+ Update: Update the internal fork of Apache Commons DBCP to 2.12.0. (markt)
|
||||
+ Add: Improvements to Japanese translations by tak7iji. (markt)
|
||||
+ Update: Update Checkstyle to 10.14.1. (markt)
|
||||
+ Update: Update the internal fork of Apache Commons BCEL to 6.8.2. (markt)
|
||||
+ Update: Update the internal fork of Apache Commons Codec to 1.16.1.
|
||||
(markt)
|
||||
+ Add: Improvements to French translations. (remm)
|
||||
+ Add: Improvements to Japanese translations by tak7iji. (remm)
|
||||
+ Add: Improvements to Chinese translations by leeyazhou. (remm)
|
||||
- Modified patch:
|
||||
* tomcat-9.0-build-with-java-11.patch
|
||||
+ rediff to changed context
|
||||
|
||||
Loading…
Reference in New Issue
Block a user