2:48 a.m.
Author: remy.maucherat(a)jboss.com
Date: 2008-07-04 03:48:40 -0400 (Fri, 04 Jul 2008)
New Revision: 698
Modified:
trunk/java/org/apache/catalina/core/ApplicationContext.java
trunk/java/org/apache/catalina/core/StandardContextValve.java
trunk/java/org/apache/coyote/Constants.java
trunk/java/org/apache/coyote/ajp/AjpAprProcessor.java
trunk/java/org/apache/coyote/ajp/AjpProcessor.java
trunk/java/org/apache/coyote/http11/InternalAprOutputBuffer.java
trunk/java/org/apache/coyote/http11/InternalOutputBuffer.java
trunk/webapps/docs/changelog.xml
trunk/webapps/docs/sysprops.xml
Log:
- Port two Tomcat patches.
- No message in headers.
- Query string fix in the RD.
Modified: trunk/java/org/apache/catalina/core/ApplicationContext.java
===================================================================
--- trunk/java/org/apache/catalina/core/ApplicationContext.java 2008-07-03 14:22:35 UTC
(rev 697)
+++ trunk/java/org/apache/catalina/core/ApplicationContext.java 2008-07-04 07:48:40 UTC
(rev 698)
@@ -369,10 +369,21 @@
throw new IllegalArgumentException
(sm.getString
("applicationContext.requestDispatcher.iae", path));
+
+ // Get query string
+ String queryString = null;
+ int pos = path.indexOf('?');
+ if (pos >= 0) {
+ queryString = path.substring(pos + 1);
+ path = path.substring(0, pos);
+ }
+
path = normalize(path);
if (path == null)
return (null);
+ pos = path.length();
+
// Use the thread local URI and mapping data
DispatchData dd = dispatchData.get();
if (dd == null) {
@@ -383,15 +394,6 @@
MessageBytes uriMB = dd.uriMB;
uriMB.recycle();
- // Get query string
- String queryString = null;
- int pos = path.indexOf('?');
- if (pos >= 0) {
- queryString = path.substring(pos + 1);
- } else {
- pos = path.length();
- }
-
// Use the thread local mapping data
MappingData mappingData = dd.mappingData;
Modified: trunk/java/org/apache/catalina/core/StandardContextValve.java
===================================================================
--- trunk/java/org/apache/catalina/core/StandardContextValve.java 2008-07-03 14:22:35 UTC
(rev 697)
+++ trunk/java/org/apache/catalina/core/StandardContextValve.java 2008-07-04 07:48:40 UTC
(rev 698)
@@ -120,8 +120,7 @@
|| (requestPathMB.equalsIgnoreCase("/META-INF"))
|| (requestPathMB.startsWithIgnoreCase("/WEB-INF/", 0))
|| (requestPathMB.equalsIgnoreCase("/WEB-INF"))) {
- String requestURI = request.getDecodedRequestURI();
- notFound(requestURI, response);
+ notFound(response);
return;
}
@@ -148,15 +147,13 @@
// Select the Wrapper to be used for this Request
Wrapper wrapper = request.getWrapper();
if (wrapper == null) {
- String requestURI = request.getDecodedRequestURI();
- notFound(requestURI, response);
+ notFound(response);
return;
} else if (!wrapper.isStarted()) {
// May be as a result of a reload, try and find the new wrapper
wrapper = (Wrapper) container.findChild(wrapper.getName());
if (wrapper == null) {
- String requestURI = request.getDecodedRequestURI();
- notFound(requestURI, response);
+ notFound(response);
return;
}
}
@@ -308,10 +305,10 @@
* @param requestURI The request URI for the requested resource
* @param response The response we are creating
*/
- private void notFound(String requestURI, HttpServletResponse response) {
+ protected void notFound(HttpServletResponse response) {
try {
- response.sendError(HttpServletResponse.SC_NOT_FOUND, requestURI);
+ response.sendError(HttpServletResponse.SC_NOT_FOUND);
} catch (IllegalStateException e) {
;
} catch (IOException e) {
Modified: trunk/java/org/apache/coyote/Constants.java
===================================================================
--- trunk/java/org/apache/coyote/Constants.java 2008-07-03 14:22:35 UTC (rev 697)
+++ trunk/java/org/apache/coyote/Constants.java 2008-07-04 07:48:40 UTC (rev 698)
@@ -60,5 +60,12 @@
(System.getSecurityManager() != null);
+ /**
+ * If true, custom HTTP status messages will be used in headers.
+ */
+ public static final boolean USE_CUSTOM_STATUS_MSG_IN_HEADER =
+ Boolean.valueOf(System.getProperty(
+ "org.apache.coyote.USE_CUSTOM_STATUS_MSG_IN_HEADER",
+ "false")).booleanValue();
}
Modified: trunk/java/org/apache/coyote/ajp/AjpAprProcessor.java
===================================================================
--- trunk/java/org/apache/coyote/ajp/AjpAprProcessor.java 2008-07-03 14:22:35 UTC (rev
697)
+++ trunk/java/org/apache/coyote/ajp/AjpAprProcessor.java 2008-07-04 07:48:40 UTC (rev
698)
@@ -915,7 +915,10 @@
// HTTP header contents
responseHeaderMessage.appendInt(response.getStatus());
- String message = response.getMessage();
+ String message = null;
+ if (org.apache.coyote.Constants.USE_CUSTOM_STATUS_MSG_IN_HEADER) {
+ message = response.getMessage();
+ }
if (message == null){
message = HttpMessages.getMessage(response.getStatus());
} else {
Modified: trunk/java/org/apache/coyote/ajp/AjpProcessor.java
===================================================================
--- trunk/java/org/apache/coyote/ajp/AjpProcessor.java 2008-07-03 14:22:35 UTC (rev 697)
+++ trunk/java/org/apache/coyote/ajp/AjpProcessor.java 2008-07-04 07:48:40 UTC (rev 698)
@@ -921,7 +921,10 @@
// HTTP header contents
responseHeaderMessage.appendInt(response.getStatus());
- String message = response.getMessage();
+ String message = null;
+ if (org.apache.coyote.Constants.USE_CUSTOM_STATUS_MSG_IN_HEADER) {
+ message = response.getMessage();
+ }
if (message == null){
message = HttpMessages.getMessage(response.getStatus());
} else {
Modified: trunk/java/org/apache/coyote/http11/InternalAprOutputBuffer.java
===================================================================
--- trunk/java/org/apache/coyote/http11/InternalAprOutputBuffer.java 2008-07-03 14:22:35
UTC (rev 697)
+++ trunk/java/org/apache/coyote/http11/InternalAprOutputBuffer.java 2008-07-04 07:48:40
UTC (rev 698)
@@ -430,11 +430,14 @@
buf[pos++] = Constants.SP;
// Write message
- String message = response.getMessage();
+ String message = null;
+ if (org.apache.coyote.Constants.USE_CUSTOM_STATUS_MSG_IN_HEADER) {
+ message = response.getMessage();
+ }
if (message == null) {
write(HttpMessages.getMessage(status));
} else {
- write(message);
+ write(message.replace('\n', ' ').replace('\r', '
'));
}
// End the response status line
Modified: trunk/java/org/apache/coyote/http11/InternalOutputBuffer.java
===================================================================
--- trunk/java/org/apache/coyote/http11/InternalOutputBuffer.java 2008-07-03 14:22:35 UTC
(rev 697)
+++ trunk/java/org/apache/coyote/http11/InternalOutputBuffer.java 2008-07-04 07:48:40 UTC
(rev 698)
@@ -422,11 +422,14 @@
buf[pos++] = Constants.SP;
// Write message
- String message = response.getMessage();
+ String message = null;
+ if (org.apache.coyote.Constants.USE_CUSTOM_STATUS_MSG_IN_HEADER) {
+ message = response.getMessage();
+ }
if (message == null) {
write(getMessage(status));
} else {
- write(message);
+ write(message.replace('\n', ' ').replace('\r', '
'));
}
// End the response status line
Modified: trunk/webapps/docs/changelog.xml
===================================================================
--- trunk/webapps/docs/changelog.xml 2008-07-03 14:22:35 UTC (rev 697)
+++ trunk/webapps/docs/changelog.xml 2008-07-04 07:48:40 UTC (rev 698)
@@ -95,6 +95,9 @@
<fix>
<jboss-jira>JBAS-5671</jboss-jira>: Check child the right child is
passed when removing it. (remm)
</fix>
+ <fix>
+ Extract the query string before normalization when getting a request dispatcher.
(remm)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
@@ -118,6 +121,9 @@
<bug>45272</bug>: IE is not fully compliant, and the redone cookies
could cause issues with
quoted paths. (fhanik)
</fix>
+ <fix>
+ Do not use custom messages in headers by default. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Jasper">
Modified: trunk/webapps/docs/sysprops.xml
===================================================================
--- trunk/webapps/docs/sysprops.xml 2008-07-03 14:22:35 UTC (rev 697)
+++ trunk/webapps/docs/sysprops.xml 2008-07-04 07:48:40 UTC (rev 698)
@@ -110,11 +110,34 @@
with that id.</p>
</property>
+ <property
+ name="org.apache.coyote. USE_CUSTOM_STATUS_MSG_IN_HEADER">
+ <p>If this is <code>true</code> custom HTTP status messages will
be used
+ within HTTP headers. Users must ensure that any such message is
+ ISO-8859-1 encoded, particularly if user provided input is included in
+ the message, to prevent a possible XSS vulnerability. If not specified
+ the default value of <code>false</code> will be used.</p>
+ </property>
+
</properties>
</section>
+<section name="EL">
+ <properties>
+
+ <property name="org.apache.el.parser.COERCE_TO_ZERO">
+ <p>If <code>true</code>, when coercing expressions to numbers
+ <code>""</code> and <code>null</code> will be
coerced to zero as required
+ by the specification. If not specified, the default value of
+ <code>true</code> will be used.</p>
+ </property>
+
+ </properties>
+</section>
+
+
<section name="JSP">
<properties>
@@ -130,6 +153,13 @@
be used.</p>
</property>
+ <property name="org.apache.jasper.compiler.
Parser.STRICT_QUOTE_ESCAPING">
+ <p>If <code>false</code> the requirements for escpaing quotes in
JSP
+ attributes will be relaxed so that a missing required quote will not
+ cause an error. If not specified, the specification compliant default of
+ <code>true</code> will be used.</p>
+ </property>
+
<!--
<property name="org.apache.jasper.runtime.
BodyContentImpl.LIMIT_BUFFER">
<p>If <code>true</code>, any tag buffer that expands beyond