The Apache Tomcat Servlet/JSP Container

Apache Tomcat 7

Version 7.0.59, Jan 28 2015
Apache Logo

Links

User Guide

Reference

Apache Tomcat Development

Changelog

Tomcat 7.0.59 (violetagg)
Tribes
fix 57504: Initialize TLD locations cache when creating the ServletContext. (jboynes)
fix Fix a possible deadlock when receiver thread invokes mapMemberAdded() while ping thread invokes memberAlive(). (kfujino)
Tomcat 7.0.58 (violetagg)not released
Catalina
fix 57173: Revert the fix for 56953 that broke annotation scanning in some cases. (markt)
fix 57178: The CORS filter now treats null as a valid origin that matches *. Patch provided by Gregor Zurowski. (markt)
fix 57180: Do not limit the CORS filter to only accepting requests that use an HTTP method defined in RFC 7231. (markt)
fix 57190: Fix ServletContext.getContext(String) when parallel deployment is used so that the correct ServletContext is returned. (markt)
fix 57208: Prevent NPE in JNDI Realm when no results are found in a directory context for a user with specified user name. Based on a patch provided by Jason McIntosh. (violetagg)
add 57209: Add a new attribute, userSearchAsUser to the JNDI Realm. (markt)
fix 57215: Ensure that the result of calling HttpServletRequest.getContextPath() is neither decoded nor normalized as required by the Servlet specification. (markt)
fix 57216: Improve handling of invalid context paths. A context path should either be an empty string or start with a '/' and do not end with a '/'. Invalid context path are automatically corrected and a warning is logged. The null and "/" values are now correctly changed to "". (markt/kkolinko)
fix Correct message that is logged when load-on-startup servlet fails to load. It was logging a wrong name. (kkolinko)
fix 57239: Correct several message typos. Includes patch by vladk. (kkolinko)
add Make the session id generator extensible by adding a SessionIdGenerator interface, an abstract base class and a standard implementation. (rjung)
add Back-port clarification from Servlet 3.1 specification that during aysnc processing an IllegalStateException should be thrown if getReqyest() or getResponse() is called after complete() or dispatch(). (markt)
fix Fix a concurrency issue in async processing. Ensure that a non-container thread can not change the async state until the container thread has completed. (markt)
fix 57252: Provide application configured error pages with a chance to handle an async error before the built-in error reporting. (markt)
fix 57281: Enable non-public Filter and Servlet classes to be configured programmatically via the Servlet 3.0 API and then used without error when running under a SecurityManager. (markt)
fix 57308: Remove unnecessary calls to System.getProperty() where more suitable API calls are available. (markt)
add Add unit tests for RemoteAddrValve and RemoteHostValve. (rjung)
add Allow to configure RemoteAddrValve and RemoteHostValve to adopt behavior depending on the connector port. Implemented by optionally adding the connector port to the string compared with the patterns allow and deny. Configured using addConnectorPort attribute on valve. (rjung)
add Optionally trigger authentication instead of denial in RemoteAddrValve and RemoteHostValve. This only works in combination with preemptiveAuthentication on the application context. Configured using invalidAuthenticationWhenDeny attribute on valve. (rjung)
fix Prevent file descriptors leak and ensure that files are closed after retrieving the last modification time. (violetagg)
fix 57326: Enable AsyncListener implementations to re-register themselves during AsyncListener.onStartAsync. (markt)
fix 57331: Allow ExpiresFilter to use "year" as synonym for "years" in its configuration. (kkolinko)
update Improve SnoopServlet in unit tests. (rjung)
add Add RequestDescriptor class to unit tests. Adjust TestRewriteValve to use RequestDescriptor. (rjung)
update Add more AJP unit tests. (rjung)
fix 57363: Log to stderr if LogManager is unable to read configuration files rather than swallowing the exception silently. (markt)
fix 57420: Make UEncoder a local variable in DirContextURLConnection to make it threadsafe. Based on ideas from kkolinko and violetagg. (fschumacher)
fix 57425: Don't add attributes with null value or name to the replicated context. (fschumacher)
add 57431: Enable usage of custom class for context creation when using embedded tomcat. (fschumacher)
fix 57446: Ensure that ServletContextListeners that have limited access to ServletContext methods are called with the same ServletContext instance for both contextInitialized() and contextDestroyed(). (markt)
fix 57461: When an instance of org.apache.catalina.startup.VersionLoggerListener logs the result of System.getProperty("java.home") don't report it in a manner that makes it look like the JAVA_HOME environment variable. (markt)
fix While closing streams for given resources ensure that if an exception happens it will be handled properly. Issue is reported by Coverity Scan. (violetagg)
fix Change Response to use UEncoder instances with shared safeChars. (fschumacher)
add Allow VersionLoggerListener to log all system properties. This feature is off by default. (kkolinko)
Coyote
fix 57234: Make SSL protocol filtering to remove insecure protocols case insensitive. (markt)
fix 57265: Fix some potential concurrency issues with sendFile and the NIO connector. (markt)
fix 57324: If the client uses Expect: 100-continue and Tomcat responds with a non-2xx response code, Tomcat also closes the connection. If Tomcat knows the connection is going to be closed when committing the response, Tomcat will now also send the Connection: close response header. (markt)
fix 57340: When using Comet, ensure that Socket and SocketWrapper are only returned to their respective caches once on socket close (it is possible for multiple threads to call close concurrently). (markt)
fix 57446: Ensure that ServletContextListeners that have limited access to ServletContext methods are called with the same ServletContext instance for both contextInitialized() and contextDestroyed(). (markt)
Jasper
fix Fix potential issue with BeanELresolver when running under a security manager. Some classes may not be accessible but may have accessible interfaces. (markt)
fix 57316: Fix JspC when directory name contains a character sequence that appears to be URL encoded. (markt)
Cluster
fix In order to enable define in Cluster element, ClusterSingleSignOn implements ClusterValve. (kfujino)
fix Fix mbean descriptor of ClusterSingleSignOn. (kfujino)
fix 57473: Add sanity check to FarmWebDeployer's WarWatcher to detect suspected incorrect permissions on the watch directory. (schultz)
WebSocket
fix Correct multiple issues with the flushing of batched messages that could lead to duplicate and/or corrupt messages. (markt)
fix Correctly implement headers case insensitivity. (markt/remm)
fix Allow optional use of user extensions. (remm)
fix Allow using partial binary message handlers. (remm)
fix Limit ping/pong message size. (remm)
fix Allow configuration of the time interval for the periodic event. (remm)
fix More accurate annotations processing. (remm)
fix Allow optional default for origin header in the client. (remm)
fix 57490: Make it possible to use Tomcat's WebSocket client within a web application when running under a SecurityManager. Based on a patch by Mikael Sterner. (markt)
add Add some debug logging to the WebSocket session to track session creation and session closure. (markt)
Web applications
fix Update documentation for CGI servlet. Recommend to copy the servlet declaration into web application instead of enabling it globally. Correct documentation for cgiPathPrefix. (kkolinko)
update Improve HTML version of build instructions and align with BUILDING.txt. Document creating second Eclipse project to compile WebSocket classes with Java 7 (ide-eclipse-websocket target added in 7.0.56). (kkolinko)
update Improve Tomcat Manager documentation. Rearrange, add section on HTML GUI, document /expire command and Server Status page. (kkolinko)
fix Fix ambiguity of section links on Valves configuration reference page. (kkolinko)
update 57238: Update information on SSL/TLS on Security and SSL documentation pages. Based on patch by Glen Peterson. (kkolinko)
add 57261: Add vminfo and threaddump commands to Manager application. Implement VminfoTask and ThreaddumpTask Ant tasks. (kkolinko)
fix 57323: Correct display of outdated sessions in sessions count listing in Manager application. (kkolinko)
add Add document of ClusterSingleSignOn. (kfujino)
update Clarify documentation for useBodyEncodingForURI attribute of a connector. (kkolinko)
Other
update When downloading required libraries at build time, use random name for temporary file and automatically create destination directory (base.path). (kkolinko)
update Update optional Checkstyle library to 6.1.1. (kkolinko)
update Simplify setproxy task in build.xml. Taskdef there is not needed since Ant 1.8.2. (kkolinko)
fix Improve Java 7 support in build.xml. Check whether the specified ${java.7.home} is valid. By default use Java that runs Ant (${java.home}) instead of the one found on $PATH to run JUnit tests. (kkolinko)
add 57344: Provide sha1 checksum files for Tomcat downloads. Correct filename patterns for apache-tomcat-*-embed.tar.gz archive to exclude an *.asc file. (kkolinko)
Tomcat 7.0.57 (violetagg)released 2014-11-11
Catalina
add 47919: Extend the information logged when Tomcat starts to optionally log the values of command line arguments (enabled by default) and environment variables (disabled by default). Note that the values added to CATALINA_OPTS and JAVA_OPTS environment variables will be logged, as they are used to build up the command line. (markt)
add 56401: Log version information when Tomcat starts. (markt/kkolinko)
fix 57022: Ensure SPNEGO authentication continues to work with the JNDI Realm using delegated credentials with recent Oracle JREs. (markt)
fix Correct a couple of NPEs in the JNDI Realm that could be triggered with when not specifying a roleBase and enabling roleSearchAsUser. (markt)
fix Remove the unnecessary registration of context.xml as a redeploy resource. The context.xml having an external docBase has already been registered as a redeploy resources at first. (kfujino)
fix Improve the previous fix for 56401. Avoid logging version information in the constructor since it then gets logged at undesirable times such as when using StoreConfig. (markt)
fix 57105: When parsing web.xml do not limit the buffer element of the jsp-property-group element to integer values as the allowed values are <number>kb or none. (markt)
update Update the minimum required version of the Tomcat Native library (if used) to 1.1.32. (markt)
update 57144: Improve ClientAbortException to provide non-null message. (kkolinko)
fix AsyncContext should remain usable until fireOnComplete is called. (remm)
fix AsyncContext createListener should wrap any instantiation exception using a ServletException. (remm)
Coyote
add 53952: Add support for TLSv1.1 and TLSv1.2 for APR connector. Based upon a patch by Marcel Šebek. This feature requires Tomcat Native library 1.1.32 or later. (schultz/jfclere)
add Disable SSLv3 by default for JSSE based HTTPS connectors (BIO and NIO). The change also ensures that SSLv2 is disabled for these connectors although SSLv2 should already be disabled by default by the JRE. (markt)
add Disable SSLv3 by default for the APR/native HTTPS connector. (markt)
fix Do not increase remaining counter at end of stream in IdentityInputFilter. (kkolinko)
fix Async state MUST_COMPLETE should still be started. (remm)
Jasper
fix 57099: Ensure that semi-colons are not permitted in JSP import page directives. (markt)
Cluster
fix Avoid possible integer overflows reported by Coverity Scan. (fschumacher)
WebSocket
fix 57054: Correctly handle the case in the WebSocket client when the HTTP response to the upgrade request can not be read in a single pass; either because the buffer is too small or the server sent the response in multiple packets. (markt)
fix Fix client subprotocol handling. (remm)
fix Add null checks for arguments in remote endpoint. (remm/kkolinko)
fix 57091: Work around the behaviour of the Oracle JRE when creating new threads in an applet environment that breaks the WebSocket client implementation. Patch provided by Niklas Hallqvist. (markt)
fix 57118: Ensure that that an EncodeException is thrown by RemoteEndpoint.Basic.sendObject(Object) rather than an IOException when no suitable Encoder is configured for the given Object. (markt)
Web applications
fix Correct documentation for ServerCookie.ALLOW_NAME_ONLY system property. (kkolinko)
fix 57049: Clarified that jvmRoute can be set in <Engine>'s jvmRoute or in a system property. (schultz)
fix Correct version of Java WebSocket mentioned in documentation (s/1.0/1.1/). (markt/kkolinko)
update In examples web application move Async and Comet examples from JSP to Servlet examples page. (kkolinko)
update Suppress timestamp comments and enable charset header in Javadoc. (kkolinko)
jdbc-pool
fix 57079: Use Tomcat version number for jdbc-pool module when building and shipping the module as part of Tomcat. (markt/kkolinko)
fix Fix broken overview page in javadoc generated via "javadoc" task in jdbc-pool build.xml file. (kkolinko)
Other
update 56079: The Apache Tomcat Windows service and the Apache Tomcat Windows service monitor application are now digitally signed. (markt)
fix Fix timestamps in Tomcat build and jdbc-pool to use 24-hour format instead of 12-hour one and use UTC timezone. (markt/kkolinko)
update Improve Tomcat build script to ensure that only one ecj-nn.jar file is present in Tomcat lib directory when Eclipse JDT Compiler is updated to a new version. (kkolinko)
update 56596: Update to Tomcat Native Library version 1.1.32 to pick up the Windows binaries that are based on OpenSSL 1.0.1j and APR 1.5.1. (markt)
code In Tomcat tests: log name of the current test method at start time. (kkolinko)
Tomcat 7.0.56 (violetagg)released 2014-10-06
Catalina
fix When scanning class files (e.g. for annotations) and reading the number of parameters in a MethodParameters structure only read a single byte (rather than two bytes) as per the JVM specification. Patch provided by Francesco Komauli. (markt)
fix Allow the JNDI Realm to start even if the directory is not available. The directory not being available is not fatal once the Realm is started and it need not be fatal when the Realm starts. Based on a patch by Cédric Couralet. (markt)
fix 56736: Avoid an incorrect IllegalStateException if the async timeout fires after a non-container thread has called AsyncContext.dispatch() but before a container thread starts processing the dispatch. (markt)
fix 56739: If an application handles an error on an application thread during asynchronous processing by calling HttpServletResponse.sendError(), then ensure that the application is given an opportunity to report that error via an appropriate application defined error page if one is configured. (markt)
fix 56771: When lookup for a resource in all the alternate or backup javax.naming.directory.DirContext, javax.naming.NameNotFoundException will be thrown at the end of the search if the resource is not available in these alternate or backup javax.naming.directory.DirContext. Based on a patch by Sheldon Shao. (violetagg)
fix 56796: Remove unnecessary sleep when stopping a web application. (markt)
fix 56801: Improve performance of org.apache.tomcat.util.file.Matcher which is to filter JARs for scanning during web application start. Based on a patch by Sheldon Shao. (kkolinko)
fix 56825: Enable pre-emptive authentication to work with the SSL authenticator. Based on a patch by jlmonteiro. (markt)
fix 56857: Fix thread safety issue when calling ServletContext methods while running under a security manager. (markt)
code 56882: Add testcase for processing of forwards and includes when Context have been reloaded. (kkolinko)
fix 56900: Fix some potential resource leaks when reading property files reported by Coverity Scan. Based on patches provided by Felix Schumacher. (markt)
fix 56902: Fix a potential resource leak in the Default Servlet reported by Coverity Scan. Based on a patch provided by Felix Schumacher. (markt)
fix 56903: Correct the return value for StandardContext.getResourceOnlyServlets() so that multiple names are separated by commas. Identified by Coverity Scan and fixed based on a patch by Felix Schumacher. (markt)
fix Fixed the multipart elements merge operation performed during web application deployment. Identified by Coverity Scan. (violetagg)
fix Correct the information written by ExtendedAccessLogValve when a format token x-O(XXX) is used so that multiple values for a header XXX are separated by commas. Identified by Coverity Scan. (violetagg)
fix Fix a potential resource leak when reading MANIFEST.MF file for extension dependencies reported by Coverity Scan. (violetagg)
fix Correctly handle multiple accept-language headers rather than just using the first header to determine the user's preferred Locale. (markt)
fix Fix some potential resource leaks when reading properties, files and other resources. Reported by Coverity Scan. (violetagg)
fix When using parallel deployment and undeployOldVersions feature is enabled on a Host, correctly undeploy context of old version. Make sure that Tomcat does not undeploy older Context if current context is not running. (kfujino)
fix When deploying war, add XML file in the config base to the redeploy resources if war does not have META-INF/context.xml or deployXML is false. If XML file is created in the config base, redeploy will occur. (kfujino)
code Various changes to reduce unnecessary code in Tomcat's copy of Apache Commons BCEL to reduce the time taken for annotation scanning when web applications start. Includes contributions from kkolinko and hzhang9. (markt)
fix 56938: Ensure web applications that have mixed case context paths and are deployed as directories are correctly removed on undeploy when running on a case sensitive file system. (markt)
add 57004: Add stuckThreadCount property to StuckThreadDetectionValve's JMX bean. Patch provided by Jiří Pejchal. (schultz)
fix 57011: Ensure that the request and response are correctly recycled when processing errors during async processing. (markt)
fix 57016: When using the PersistentValve do not remove sessions from the store when persisting them. (markt)
Coyote
fix 56780: Enable Tomcat to start when using SSL with an IBM JRE in strict SP800-131a mode. (markt)
fix 56910: Prevent the invalid value of -1 being used for maxConnections with APR connectors. (markt)
fix Ensure that AjpNioProtocol and AjpAprProtocol enable the KeepAliveTimeout. (kfujino)
Jasper
fix 43001: Enable the JspC Ant task to set the JspC option mappedFile. (kkolinko)
fix 56797: When matching a method in an EL expression, do not treat bridge methods as duplicates of the method they bridge to. In this case always call the target of the bridge method. (markt)
fix Correct a logic error in the JasperElResolver. There was no functional impact but the code was less efficient as a result of the error. Based on a patch by martinschaef. (markt)
fix Ensure that the implementation of javax.servlet.jsp.PageContext.include(String) and javax.servlet.jsp.PageContext.include(String, boolean) will throw IOException when an I/O error occur during the operation. (violetagg)
fix 56908: Fix some potential resource leaks when reading jar files. Reported by Coverity Scan. Based on patch provided by Felix Schumacher. (violetagg)
fix 56991: Deprecate the use of a request attribute to pass a <jsp-file> declaration to Jasper and prevent an infinite loop if this technique is used in conjunction with an include. (markt)
fix Fix a potential resource leak in JDTCompiler when checking wether a resource is a package. Reported by Coverity Scan. (fschumacher)
WebSocket
code 56446: Clearer handling of exceptions when calling a method on a POJO based WebSocket endpoint. Based on a suggestion by Eugene Chung. (markt)
fix 56746: Allow secure WebSocket client threads to use the current context class loader rather than explicitly setting it to the class loader that loaded the WebSocket implementation. This allows WebSocket client connections from within web applications to access, amongst other things, the JNDI resources associated with the web application. (markt)
fix 56905: Make destruction on web application stop of thread group used for WebSocket connections more robust. (kkolinko/markt)
fix 56907: Ensure that client IO threads are stopped if a secure WebSocket client connection fails. (markt)
fix When a WebSocket client attempts to write to a closed connection, handle the resulting IllegalStateException in a manner consistent with the handling of an IOException. (markt)
add Add support for the permessage-deflate extension. This is currently limited to decompressing incoming messages on the server side. It is expected that support will be extended to outgoing messages and to the client side shortly. (markt)
add Extend support for the permessage-deflate extension to compression of outgoing messages on the server side. (markt)
fix 56982: Return the actual negotiated extensions rather than an empty list for Session.getNegotiatedExtensions(). (markt)
update Update the WebSocket implementation to support the Java WebSocket specification version 1.1. (markt)
Web applications
fix Correct the label in the list of sessions by idle time for the bin that represents the idle time immediately below the maximum permitted idle time when using the expire command of the Manager application. (markt)
update Update the Windows authentication documentation after some additional testing to answer the remaining questions. (markt)
fix Correct a couple of broken links in the Javadoc. (markt)
Other
add 56788: Display the full version in the list of installed applications when installed via the Windows installer package. Patch provided by Alexandre Garnier. (markt)
add 56829: Add the ability for users to define their own values for _RUNJAVA and _RUNJDB environment variables. Be more strict with executable filename on Windows (s/java/java.exe/). Based on a patch by Neeme Praks. (markt/kkolinko)
fix 56895: Correctly compose JAVA_OPTS in catalina.bat so that escape sequences are preserved. Patch by Lucas Theisen. (markt)
update 56988: Allow to use relative path in base.path setting when building Tomcat. (kkolinko)
fix 56990: Ensure that the ide-eclipse build target downloads all the libraries required by the default Eclipse configuration files and configures Eclipse to use Java 6 for the project. Add build target ide-eclipse-websocket that creates a separate linked project that compiles websocket classes of Tomcat 7 with Java 7 compiler. (kkolinko)
Tomcat 7.0.55 (violetagg)released 2014-07-27
Catalina
fix 44312: Log an error if there is a conflict between Host and Alias names. Improve host management methods in Mapper to avoid occasionally removing a wrong host. Check that host management operations are performed on the host and not on an alias. (kkolinko)
fix 55282: Ensure that one and the same application listener is added only once when starting the web application. (violetagg)
add 56461: New failCtxIfServletStartFails attribute on Context and Host configuration to force the context startup to fail if a load-on-startup servlet fails its startup. (slaurent)
add 56526: Improved the StuckThreadDetectionValve to optionally interrupt stuck threads to attempt to unblock them. (slaurent)
fix 56545: Pre-load an additional class, the loading of which may otherwise be triggered by a web application which in turn would trigger an exception when running under a security manager. (kkolinko)
fix 56578: Correct regression in the fix for 56339 that prevented sessions from expiring when using clustering. (markt)
code 56588: Update deprecation of Context.addApplicationListener() methods according to changes in Tomcat 8. (kkolinko)
fix 56600: In WebdavServlet: Do not waste time generating response for broken PROPFIND request. (kkolinko)
fix Provide a better error message when asynchronous operations are not supported by a filter or servlet. Patch provided by Romain Manni-Bucau. (violetagg)
fix 56606: User entries in tomcat-users.xml file are recommended to use "username" attribute rather than legacy "name" attribute. Fix inconsistencies in Windows installer, examples. Update digester rules and documentation for MemoryRealm. (markt/kkolinko)
code 56611: Refactor code to remove inefficient calls to Method.isAnnotationPresent(). Based on a patch by Jian Mou. (markt/kkolinko)
fix 56653: Fix concurrency issue with lists of contexts in Mapper when stopping Contexts. (kkolinko)
fix 56657: When using parallel deployment, if the same session id matches different versions of a web application, prefer the latest version. Ensure that remapping selects the version that we expect. (kkolinko)
fix Assert that mapping result object is empty before performing mapping work in Mapper. (kkolinko)
fix 56658: Avoid delay between registrations of mappings for context and for its servlets. (kkolinko)
fix 56665: Correct the generation of the effective web.xml when elements contain an empty string as value. (violetagg)
fix 56666: When clearing the SSO cookie use the same values for domain, path, httpOnly and secure as were used to set the SSO cookie. (markt)
fix 56677: Ensure that HttpServletRequest.getServletContext() returns the correct value during a cross-context dispatch. (markt)
fix 56684: Ensure that Tomcat does not shut down if the socket waiting for the shutdown command experiences a SocketTimeoutException. (markt)
fix When the current PathInfo is modified as a result of dispatching a request, ensure that a call to HttpServletRequest.getPathTranslated() returns a value that is based on the modified PathInfo. (markt)
fix 56698: When persisting idle sessions, only persist newly idle sessions. Patch provided by Felix Schumacher. (markt)
fix 56710: Do not map requests to servlets when context is being reloaded. (kkolinko)
fix 56712: Fix session idle time calculations in PersistenceManager. (kkolinko)
fix 56717: Fix duplicate registration of MapperListener during repeated starts of embedded Tomcat. (kkolinko)
add 56724: Write an error message to Tomcat logs if container background thread is aborted unexpectedly. (kkolinko)
Coyote
fix 56518: When using NIO, do not attempt to write to the socket if the thread is marked interrupted as this will lead to a connection limit leak. This fix was based on analysis of the issue by hanyong. (markt)
fix 56521: Re-use the asynchronous write buffer between writes to reduce allocation and GC overhead. Based on a patch by leonzhx. Also make the buffer size configurable and remove copying of data within buffer when the buffer is only partially written on a subsequent write. (markt)
fix Correct a copy/paste error and return a 500 response rather than a 400 response when an internal server error occurs on early stages of request processing. (markt)
code 56582: Use switch(actionCode) in processors instead of a chain of "elseif"s. (kkolinko)
fix If request contains an unrecognized Expect header, respond with error 417 (Expectation Failed), according to RFC2616 chapter 14.20. (markt)
fix When an error occurs after the response has been committed close the connection immediately rather than attempting to finish the response to make it easier for the client to differentiate between a complete response and one that failed part way though. (markt)
fix 56620: Avoid bogus access log entries when pausing the NIO HTTP connector and ensure that access log entries generated by error conditions use the correct request start time. (markt)
add Add a new limit, defaulting to 2MB, for the amount of data Tomcat will swallow for an aborted upload. The limit is configurable by maxSwallowSize attribute of an HTTP connector. (markt)
update Allow to configure maxSwallowSize attribute of an HTTP connector via JMX. (kkolinko)
fix 56661: Fix getLocalAddr() for AJP connectors. The complete fix is only available with a recent AJP forwarder like the forthcoming mod_jk 1.2.41. (rjung)
Jasper
fix 56334#c15: Fix a regression in EL parsing when quoted string follows a whitespace. (kkolinko/markt)
fix 56543: Update to the Eclipse JDT Compiler 4.4. (violetagg)
fix 56561: Avoid NoSuchElementException while handling attributes with empty string value. (violetagg)
update 56581: If an error on a JSP page occurs when response has already been committed, do not clear the buffer of JspWriter, but flush it. It will make more clear where the error occurred. (kkolinko)
fix 56612: Correctly parse two consecutive escaped single quotes when used in UEL expression in a JSP. (markt)
update Move code that parses EL expressions within JSP template text from Parser to JspReader class for better performance. (kkolinko)
WebSocket
fix 56577: Improve the executor configuration used for the callbacks associated with asynchronous writes. (markt)
Web applications
fix Set the path for cookies created by the examples web application so they only returned to the examples application. This reduces the opportunity for using such cookies for malicious purposes should the advice to remove the examples web application from security sensitive systems be ignored. (markt/kkolinko)
fix Attempt to obfuscate session cookie values associated with other web applications when viewing HTTP request headers with the Request Header example from the examples web application. This reduces the opportunity to use this example for malicious purposes should the advice to remove the examples web application from security sensitive systems be ignored. (markt)
Other
update Update optional Checkstyle library to 5.7. (kkolinko)
fix 56685: Add quotes necessary for daemon.sh to work correctly on Solaris. Based on a suggesiton by lfuka. (markt)
update 56596: Update to Tomcat Native Library version 1.1.31 to pick up the Windows binaries that are based on OpenSSL 1.0.1h. (markt)
Tomcat 7.0.54 (violetagg)released 2014-05-22
Catalina
fix Fix custom UTF-8 decoder so that a byte of value 0xC1 is always rejected immediately as it is never valid in a UTF-8 byte sequence. Update UTF-8 decoder tests to account for UTF-8 decoding improvements in Java 8. The custom UTF-8 decoder is still required due to bugs in the UTF-8 decoder provided by Java. Java 8's decoder is better than Java 7's but it is still buggy. (markt)
fix 56027: Add more options for managing FIPS mode in the AprLifecycleListener. (schultz/kkolinko)
fix 56321: When a WAR is modified, undeploy the web application before deleting any expanded directory as the undeploy process may refer to classes that need to be loaded from the expanded directory. If the expanded directory is deleted first, any attempt to load a new class during undeploy will fail. (markt)
fix 56339: Avoid an infinite loop if an application calls session.invalidate() from the session destroyed event for that session. (markt)
update 56365: Simplify file name pattern matching code in StandardJarScanner. Ignore leading and trailing whitespace and empty strings when configuring patterns. Improve documentation. (kkolinko)
fix 56369: Ensure that removing an MBean notification listener reverts all the operations performed when adding an MBean notification listener. (markt)
add 56382: Information about finished deployment and its execution time is added to the log files. Patch is provided by Danila Galimov. (violetagg)
add 56383: Properties for disabling server information and error report are added to the org.apache.catalina.valves.ErrorReportValve. Based on the patch provided by Nick Bunn. (violetagg/kkolinko)
fix Fix CVE-2014-0119: Only create XML parsing objects if required and fix associated potential memory leak in the default Servlet. Extend XML factory, parser etc. memory leak protection to cover some additional locations where, theoretically, a memory leak could occur. Ensure that a TLD parser obtained from the cache has the correct value of blockExternal. (markt)
fix Modify generic exception handling so that StackOverflowError is not treated as a fatal error and can handled and/or logged as required. (markt)
fix 56409: Avoid StackOverflowError on non-Windows systems if a file named \ is encountered when scanning for TLDs. (markt)
add 56430: Extend checks for suspicious URL patterns to include patterns of the form *.a.b which are not valid patterns for extension mappings. (markt)
fix 56441: Raise the visibility of exceptions thrown when a problem is encountered calling a getter or setter on a component attribute. The logging level is raised from debug to warning. (markt)
fix 56451: Make resources accessed via a context alias accessible via JNDI in the same way standard resources are available. (markt)
add 56463: Property for disabling server information is added to the DefaultServlet. Server information is presented in the response sent to the client when directory listings is enabled. (violetagg)
add Add the org.apache.naming package to the packages requiring code to have the defineClassInPackage permission when running under a security manager. (markt)
add Add the org.apache.naming.resources package to the packages requiring code to have the accessClassInPackage permission when running under a security manager. (markt)
fix Make the naming context tokens for containers more robust. Require RuntimePermission when introducing a new token. (markt/kkolinko)
fix 56472: Allow NamingContextListener to clean up on stop if its start failed. (kkolinko)
add 56492: Avoid eclipse debugger pausing on uncaught exceptions when tomcat renews its threads. (slaurent)
fix Minor fixes to ThreadLocalLeakPreventionListener. Do not trigger threads renewal for failed contexts. Do not ignore threadRenewalDelay setting. Improve documentation. (kkolinko)
fix Correct regression introduced in r797162 that broke authentication of users when using the JAASMemoryLoginModule. (markt)
fix 56501: HttpServletRequest.getContextPath() should return the undecoded context path used by the user agent. (markt)
fix 56523: When using SPNEGO authentication, log the exceptions associated with failed user logins at debug level rather than error level. (markt)
fix 56536: Ensure that HttpSessionBindingListener.valueUnbound() uses the correct class loader when the SingleSignOn valve is used. (markt)
Coyote
add 56399: Assert that both Coyote and Catalina request objects have been properly recycled. (kkolinko)
fix 56416: Correct documentation for default value of socket linger for the AJP and HTTP connectors. (markt)
Jasper
fix 56334: Fix a regression in the handling of back-slash escaping introduced by the fix for 55735. (markt/kkolinko)
fix 56425: Improve method matching for EL expressions. When looking for matching methods, an exact match between parameter types is preferred followed by an assignable match followed by a coercible match. (markt)
fix Correct the handling of back-slash escaping in the EL parser and no longer require that \$ or \# must be followed by { in order for the back-slash escaping to take effect. (markt)
fix 56529: Avoid NoSuchElementException while handling attributes with empty string value in custom tags. Patch provided by Hariprasad Manchi. (violetagg)
Cluster
fix Remove cluster and replicationValve from cluster manager template. These instance are not necessary to template. (kfujino)
fix Add support for cross context session replication to org.apache.catalina.ha.session.BackupManager. (kfujino)
fix Remove the unnecessary cross context check. It does not matter whether the context that is referenced by other context is set to crossContext=true. The context that refers to the different context must be set to crossContext=true. (kfujino)
code Move to org.apache.catalina.ha.session.ClusterManagerBase common logics of org.apache.catalina.ha.session.BackupManager and org.apache.catalina.ha.session.DeltaManager. (kfujino)
code Simplify the code of o.a.c.ha.tcp.SimpleTcpCluster. In order to add or remove cluster valve to Container, use pipeline instead of IntrospectionUtils. (kfujino)
fix There is no need to set cluster instance when SimpleTcpCluster.unregisterClusterValve is called. Set null than cluster instance for cleanup. (kfujino)
code Backport refactoring of AbstractReplicatedMap to implement Map rather than extend ConcurrentHashMap to enable Tomcat 7 to be built with Java 8. (markt)
WebSocket
fix 56343: Avoid a NPE if Tomcat's Java WebSocket 1.0 implementation is used with the Java WebSocket 1.0 API JAR from the reference implementation. (markt)
fix Increase the default maximum size of the executor used by the WebSocket implementation for call backs associated with asynchronous writes from 10 to 200. (markt)
add Add a warning if the thread group created for WebSocket asynchronous write call backs can not be destroyed when the web application is stopped. (markt)
fix Ensure that threads created to support WebSocket clients are stopped when no longer required. This will happen automatically for WebSocket client connections initiated by web applications but stand alone clients must call WsWebSocketContainer.destroy(). (markt)
fix 56449: When creating a new session, add the message handlers to the session before calling Endpoint.onOpen() so the message handlers are in place should the onOpen() method trigger the sending of any messages. (markt)
fix 56458: Report WebSocket sessions that are created over secure connections as secure rather than as not secure. (markt)
fix Stop threads used for secure WebSocket client connections when they are no longer required and give them better names for easier debugging while they are running. (markt)
Web applications
fix Add Support for copyXML attribute of Host to Host Manager. (kfujino)
fix Ensure that "name" request parameter is used as a application base of host if "webapps" request parameter is not set when adding host in HostManager Application. (kfujino)
fix Correct documentation on Windows service options, aligning it with Apache Commons Daemon documentation. (kkolinko)
update 55215: Improve log4j configuration example. Clarify access logging documentation. Based on patches provided by Brian Burch. (kkolinko)
update 55383: Backport improved HTML markup for tables and code fragments from Tomcat 8 documentation. (kkolinko)
fix 56418: Ensure that the Manager web application does not report success for a web application deployment that fails. (slaurent)
fix Fix target and rel attributes on links in documentation. They were lost during XSLT transformation. (kkolinko)
update Improve valves documentation. Split valves into groups. (kkolinko)
Other
fix Align DisplayName of Tomcat installed by service.bat with one installed by the *.exe installer. Print a warning in case if neither server nor client jvm is found by service.bat. (kkolinko)
update 56363: Update to version 1.1.30 of Tomcat Native library. (schultz)
update Update package renamed Apache Commons BCEL to r1593495 to pick up some additional changes for Java 7 support and some code clean up. (markt)
add In tests: allow to configure directory where JUnit reports and access log are written to. (kkolinko)
Tomcat 7.0.53 (violetagg)released 2014-03-30
Catalina
add Make it easier for applications embedding and/or extending Tomcat to modify the javaseClassLoader attribute of the WebappClassLoader. (markt)
fix Improve the robustness of web application undeployment based on some code analysis triggered by the report for 54315. (markt)
fix 56219: Improve merging process for web.xml files to take account of the elements and attributes supported by the Servlet version of the merged file. (markt)
fix 56190: The response should be closed (i.e. no further output is permitted) when a call to AsyncContext.complete() takes effect. (markt)
fix 56236: Enable Tomcat to work with alternative Servlet and JSP API JARs that package the XML schemas in such as way as to require a dependency on the JSP API before enabling validation for web.xml. Tomcat has no such dependency. (markt)
fix 56246: Fix NullPointerException in MemoryRealm when authenticating an unknown user. (markt)
fix 56248: Allow the deployer to update an existing WAR file without undeploying the existing application if the update flag is set. This allows any existing custom context.xml for the application to be retained. To update an application and remove any existing context.xml simply undeploy the old version of the application before deploying the new version. (markt)
fix Fix CVE-2014-0096: Redefine the globalXsltFile initialisation parameter of the DefaultServlet as relative to CATALINA_BASE/conf or CATALINA_HOME/conf. Prevent user supplied XSLTs used by the DefaultServlet from defining external entities. (markt)
add Add a work around for validating XML documents (often TLDs) that use just the file name to refer to refer to the JavaEE schema on which they are based. (markt)
fix 56293: Cache resources loaded by the class loader from /META-INF/services/ for better performance for repeated look ups. (markt)
Coyote
fix 53119: Make sure the NIO AJP output buffer is cleared on any error to prevent any possible overflow if it is written to again before the connection is closed. This extends the original fix for the APR/native output buffer to the NIO connector. (kkolinko)
fix 56172: Avoid possible request corruption when using the AJP NIO connector and a request is sent using more than one AJP message. Patch provided by Amund Elstad. (markt)
fix 56213: Reduce garbage collection when the NIO connector is under heavy load. (markt)
fix Fix CVE-2014-0075: Improve processing of chuck size from chunked headers. Avoid overflow and use a bit shift instead of a multiplication as it is marginally faster. (markt/kkolinko)
fix Fix CVE-2014-0099: Fix possible overflow when parsing long values from a byte array. (markt)
Jasper
fix 54475: Add Java 8 support to SMAP generation for JSPs. Patch by Robbie Gibson. (markt)
fix 55483: Improve handing of overloaded methods and constructors in expression language implementation. (markt)
fix 56208: Restore the validateXml option to Jasper that was previously renamed validateTld. Both options are now supported. validateXml controls the validation of web.xml files when Jasper parses them and validateTld controls the validation of *.tld files when Jasper parses them. (markt)
fix 56223: Throw an IllegalStateException if a call is made to ServletContext.setInitParameter() after the ServletContext has been initialized. (markt)
fix 56265: Do not escape values of dynamic tag attributes containing EL expressions. (kkolinko)
fix Make the default compiler source and target versions for JSPs Java 6 since Tomcat 7 requires Java 6 as a minimum. (markt)
update 56283: Update to the Eclipse JDT Compiler P20140317-1600 which adds support for Java 8 syntax to JSPs. Add support for value "1.8" for the compilerSourceVM and compilerTargetVM options. (markt)
WebSocket
fix Avoid a possible deadlock when one thread is shutting down a connection while another thread is trying to write to it. (markt)
fix Call onError if an exception is thrown calling onClose when closing a session. (remm)
Web applications
code In the documentation: add support for several documentation tags from Tomcat 8. Such as <version-major/>. (kkolinko)
add 56093: Add the SSL Valve to the documentation web application. (markt)
fix 56217: Improve readability by using left alignment for the table cell containing the request information on the Manager application status page. (markt)
fix Fixed java.lang.NegativeArraySizeException when using "Expire sessions" command in the manager web application on a context where the session timeout is disabled. (kfujino)
fix Add support for LAST_ACCESS_AT_START system property to Manager web application. (kfujino)
fix Add definition of org.apache.catalina.ant.FindLeaksTask. (kfujino)
fix 56273: If the Manager web application does not perform an operation because the web application is already being serviced, report an error rather than reporting success. (markt)
fix 56304: Add a note to the documentation about not using WebSocket with BIO HTTP in production. (markt)
Other
fix 56143: Improve service.bat so that it can be launched from a non-UAC console. This includes using a single call to tomcat7.exe to install the Windows service rather than three calls, and using command line arguments instead of environment variables to pass the settings. (markt/kkolinko)
fix Fix regression in 7.0.52: when using service.bat install to install the service the values for --StdOutput, --StdError options were passed as blank instead of "auto". (kkolinko)
fix Align options between service.bat and exe Windows installer. For service.bat the changes are in --Classpath, --DisplayName, --StartPath, --StopPath. For exe installer the changes are in --JvmMs, --JvmMx options, which are now 128 Mb and 256 Mb respectively instead of being empty. Explicitly specify --LogPath path when uninstalling Windows service, avoiding default value for that option. (kkolinko)
code Simplify Windows *.bat files: remove %OS% checks, as java 6 does not run on ancient non-NT operating systems. (kkolinko)
fix 56137: Explicitly use the BIO connector in the SSL example in server.xml so it doesn't break if APR is enabled. (markt)
fix 56139: Avoid a web application class loader leak in some unit tests when running on Windows. (markt)
fix Correct build script to avoid building JARs with empty packages. (markt)
add Allow to limit JUnit test run to a number of selected test case methods. (kkolinko)
fix 56189: Remove used file cpappend.bat from the distribution. (markt)
Tomcat 7.0.52 (violetagg)released 2014-02-17
Catalina
fix Generate a valid root element for the effective web.xml for a web application for all supported versions of web.xml. (markt)
Coyote
code Pull up SocketWrapper to AbstractProcessor. (markt)
fix In some circumstances asynchronous requests could time out too soon. (markt)
Tomcat 7.0.51 (violetagg)not released
Catalina
fix 55287: ServletContainerInitializer defined in the container may not be found. (markt/jboynes)
fix 55855: Provide a per Context option (containerSciFilter) to exclude container SCIs. (markt)
fix 55937: When deploying applications, treat a context path of /ROOT as equivalent to /. (markt)
fix 55943: Improve the implementation of the class loader check that prevents web applications from trying to override J2SE implementation classes. As part of this fix, refactor the way a null parent class loader is handled which enables a number of null checks and object creation calls to be removed. Note that this change means that, by default, the web application class loader is now a higher priority for loading classes than the system class loader. (markt)
fix 55958: Differentiate between foo.war the WAR file and foo.war the directory. (markt)
fix 55960: Improve the single sign on (SSO) unit tests. Patch provided by Brian Burch. (markt)
fix 55974: Retain order when reporting errors and warnings while parsing XML configuration files. (markt)
fix 56013: Fix issue with SPNEGO authentication when using IBM JREs. IBM JREs only understand the option of infinite lifetime for Kerberos credentials. Based on a patch provided by Arunav Sanyal. (markt)
fix 56016: When loading resources for XML schema validation, take account of the possibility that servlet-api.jar and jsp-api.jar may not be loaded by the same class loader. Patch by Juan Carlos Estibariz. (markt)
fix 56025: When creating a WebSocket connection, always call ServerEndpointConfig.Configurator.getNegotiatedSubprotocol() and always create the EndPoint instance after calling ServerEndpointConfig.Configurator.modifyHandshake(). (markt)
fix 56032: Ensure that the WebSocket connection is closed after an IO error or an interrupt while sending a WebSocket message. (markt)
fix 56042: If a request in async mode has an error but has already been dispatched don't generate an error page in the ErrorReportValve so the dispatch target can handle it. (markt)
fix Add missing javax.annotation.sql.* classes to annotations-api.jar. (markt)
fix The type of logger attribute of Context MBean should be not org.apache.commons.logging.Log but org.apache.juli.logging.Log. (kfujino)
fix 56082: Fix a concurrency bug in JULI's LogManager implementation. (markt)
fix 56096: When the attribute rmiBindAddress of the JMX Remote Lifecycle Listener is specified it's value will be used when constructing the address of a JMX API connector server. Patch is provided by Jim Talbut. (violetagg)
fix When environment entry with one and the same name is defined in the web deployment descriptor and with annotation then the one specified in the web deployment descriptor is with priority. (violetagg)
fix Change default value of xmlBlockExternal attribute of Context. It is true now. (kkolinko)
Coyote
fix Avoid possible NPE if a content type is specified without a character set. (markt)
fix 55956: Make the forwarded remote IP address available to the Connectors via a request attribute. (markt)
fix 55976: Fix sendfile support for the HTTP NIO connector. (markt)
fix 55996: Ensure Async requests timeout correctly when using the NIO HTTP connector. (markt)
add 56021: Make it possible to use the Windows-MY key store with the BIO and NIO connectors for SSL configuration. It requires a keystoreFile="" keystoreType="Windows-My" to be set on the connector. Based on a patch provided by Asanka. (markt)
Jasper
fix Correct a regression in the XML refactoring that meant that errors in TLD files were swallowed. (markt)
fix 55671: Correct typo in the log message for a wrong value of genStringAsCharArray init-param of JspServlet. This parameter had a different name in Tomcat 6. (kkolinko)
fix 55973: Fix processing of XML schemas when validation is enabled in Jasper. (kkolinko)
fix 56010: Don't throw an IllegalArgumentException when JspFactory.getPageContext is used with JspWriter.DEFAULT_BUFFER. Based on a patch by Eugene Chung. (markt)
fix 56012: When using the extends attribute of the page directive do not import the super class if it is in an unnamed package as imports from unnamed packages are now explicitly illegal. (markt)
fix 56029: A regression in the fix for 55198 meant that when EL containing a ternary expression was used in an attribute a compilation error would occur for some expressions. (markt)
fix Correct several errors in jspxml Schema and DTD. (kkolinko)
fix Change default value of the blockExternal attribute of JspC task. The default value is true. Add support for -no-blockExternal switch when JspC is run as a standalone application. (kkolinko)
Cluster
code Simplify the code of o.a.c.ha.tcp.SimpleTcpCluster.createManager(String). Remove unnecessary class cast. (kfujino)
WebSocket
fix Do not return an empty string for the Sec-WebSocket-Protocol HTTP header when no sub-protocol has been requested or no sub-protocol could be agreed as RFC6455 requires that no Sec-WebSocket-Protocol header is returned in this case. (markt)
Web applications
fix Add index.xhtml to the welcome files list for the examples web application. (kkolinko)
fix Clarify that the connectionTimeout may also be used as the read timeout when reading a request body (if any) in the documentation web application. (markt)
fix Clarify the behaviour of the maxConnections attribute for a connector in the documentation web application. (markt)
fix 55888: Update the documentation web application to make it clearer that a Container may define no more than one Realm. (markt)
fix 55956: Where available, displayed the forwarded remote IP address available on the status page of the Manager web application. (markt)
fix Correct links to the Tomcat mailing lists in the ROOT web application. (kkolinko)
fix In Manager web application improve handling of file upload errors. Display a message instead of error 500 page. Simplify parts handling code, as it is known that Tomcat takes care of them when recycling a request. (kkolinko)
Extras
fix 55166, 56045: Copy the XML schemas used for validation that are packaged in jsp-api.jar to servlet-api.jar so that an embedded Tomcat instance can start without Jasper being available. This also enables validation to work without Jasper being available. (markt/kkolinko)
fix 56039: Enable the JmxRemoteLifecycleListener to work over SSL. Patch by esengstrom. (markt)
Other
fix 55743: Enable the stop script to work when the shutdown port is disabled and a PID file is defined. This is only available on platforms that use catalina.sh. (markt)
fix 55986: When forcing Tomcat to stop via kill -9 $CATALINA_PID, the catalina.sh script could incorrectly report that Tomcat had not yet completely stopped when it had. Based on a patch by jess. (markt)
fix Package correct license and notice files with embedded JARs. (markt)
code Remove svn keywords (such as $Id) from source files and documentation. (kkolinko)
fix Fix CVE-2014-0050, a denial of service with a malicious, malformed Content-Type header and multipart request processing. Fixed by merging latest code (r1565163) from Commons FileUpload. (markt)
fix 56115: Expose the httpusecaches property of Ant's get task as some users may need to change the default. Based on a suggestion by Anthony. (markt)
Tomcat 7.0.50 (violetagg)released 2014-01-08
Catalina
fix Handle the case where a context.xml file is added to a web application deployed from a directory. Previously the file was ignored until Tomcat was restarted. Now (assuming automatic deployment is enabled) it will trigger a redeploy of the web application. (markt)
fix Fix string comparison in HostConfig.setContextClass(). (kkolinko)
code Streamline handling of WebSocket messages when no handler is configured for the message currently being received. (markt)
fix Handle the case where a WebSocket annotation configures a message size limit larger than the default permitted by Tomcat. (markt)
fix 55855: This is a partial fix that bypasses the relatively expensive check for a WebSocket upgrade request if no WebSocket endpoints have been registered. (markt)
fix 55905: Prevent a NPE when web.xml references a taglib file that does not exist. Provide better error message. (violetagg)
Coyote
fix When using the BIO connector with an internal executor, do not display a warning that the executor has not shutdown as the default configuration for BIO connectors is not to wait. This is because threads in keep-alive connections cannot be interrupted and therefore the warning was nearly always displayed. (markt)
Jasper
fix JspC uses servlet context initialization parameters to pass configuration so ensure that the servlet context used supports initialization parameters. (markt)
Cluster
fix In AbstractReplicatedMap#finalize, remove rpcChannel from channel Listener of group channel before sending MapMessage.MSG_STOP message. This prevents that the node that sent the MapMessage.MSG_STOP by normal shutdown is added to member map again by ping at heartbeat thread in the node that received the MapMessage.MSG_STOP. (kfujino)
fix Add time stamp to GET_ALL_SESSIONS message. (kfujino)
Web applications
fix Fix the sample configuration of StaticMembershipInterceptor in order to prevent warning log. uniqueId must be 16 bytes. (kfujino)
Extras
update Update dependencies that are used to build tomcat-juli extras component. Apache Avalon Framework is updated to version 4.1.5, Apache Log4J to version 1.2.17. (rjung)
Tomcat 7.0.49 (violetagg)not released
Catalina
fix Correct a regression in the new XML local resolver that triggered false failures when XML validation was configured. (markt)
fix Prevent a NPE when destroying HTTP upgrade handler for WebSocket connections. (violetagg)
Tomcat 7.0.48 (violetagg)not released
Catalina
add 51294: Add support for unpacking WARs located outside of the Host's appBase in to the appBase. (markt)
fix 55656: Configure the Digester to use the server class loader when parsing server.xml rather than the class loader that loaded StandardServer. Patch provided by Roberto Benedetti. (markt)
fix 55664: Correctly handle JSR 356 WebSocket Encoder, Decoder and MessageHandler implementations that use a generic type such as Encoder.Text<List<String>>. Includes a test case by Niki Dokovski. (markt)
fix Correctly handle WebSocket Encoders, Decoders and MessageHandlers that use arrays of generic types. (markt)
fix 55681: Ensure that the WebSocket session is made available to MessageHandler method calls. (markt)
fix Updated servlet spec version and documentation section-number reported when JAR files are rejected for containing a trigger class (e.g. javax.servlet.Servlet). (schultz)
add Modify the WebSocket handshake process so that the user properties Map exposed by the ServerEndpointConfig during the call to Configurator.modifyHandshake() is unique to the connection rather than shared by all connections associated with the Endpoint. This allows for easier configuration of per connection properties from within modifyHandshake(). (markt)
fix 55684: Log a warning but continue if the memory leak detection code is unable to access all threads to check for possible memory leaks when a web application is stopped. (markt)
fix Define the web-fragment.xml in tomcat7-websocket.jar as a Servlet 3.0 web fragment rather than as a Servlet 3.1 web fragment. (markt)
fix 55715: Add a per web application executor to the WebSocket implementation and use it for calling SendHandler.onResult() when there is a chance that the current thread also initiated the write. (markt)
fix Prevent file descriptors leak and ensure that files are closed when configuring the web application. (violetagg)
fix Fixed the name of the provider-configuration file located in tomcat7-websocket.jar!/META-INF/services that exposes information for javax.websocket.server.ServerEndpointConfig$Configurator implementation. (violetagg)
fix 55760: Remove the unnecessary setting of the javax.security.auth.useSubjectCredsOnly system property in the SpnegoAuthenticator as in addition to it being unnecessary, it causes problems with using SPNEGO with IBM JDKs. Patch provided by Arunav Sanyal. (markt)
fix 55772: Ensure that the request and response are recycled after an error during asynchronous processing. Includes a test case based on code contributed by Todd West. (markt)
fix 55778: Add an option to the JNDI Realm to control the QOP used for the connection to the LDAP server after authentication when using SPNEGO with delegated credentials. This value is used to set the javax.security.sasl.qop environment property for the LDAP connection. (markt)
fix 55798: Log an error if the MemoryUserDatabase is unable to find the specified user database file. (markt)
fix 55799: Correctly enforce the restriction in JSR356 that no more than one data message may be sent to a remote WebSocket endpoint at a time. (markt)
fix When Catalina parses TLD files, always use a namespace aware parser to be consistent with how Jasper parses TLD files. The tldNamespaceAware attribute of the Context is now ignored. (markt)
fix Deprecate the tldNamespaceAware Context attribute as TLDs are always parsed with a namespace aware parser. (markt)
fix Correct a logic error that meant that unpackWARs was ignored and the WAR was always expanded if a WAR failed to deploy. (markt)
add Add support for defining copyXML on a per Context basis. (markt)
fix Define the expected behaviour of the automatic deployment and align the implementation to that definition. (markt)
add When running under a security manager, change the default value of the Host's deployXML attribute to false. (markt)
add If a Host is configured with a value of false for deployXML, a web application has an embedded descriptor at META-INF/context.xml and no explicit descriptor has been defined for this application, do not allow the application to start. The reason for this is that the embedded descriptor may contain configuration necessary for secure operation such as a RemoteAddrValve. (markt)
fix Prevent an NPE in the WebSocket ServerContainer when processing an HTTP session end event. (markt)
add 55801: Add the ability to set a custom SSLContext to use for client wss connections. Patch provided by Maciej Lypik. (markt)
fix 55804: If the GSSCredential for the cached Principal expires when using SPNEGO authentication, force a re-authentication. (markt)
add 55811: If the main web.xml contains an empty absolute-ordering element and validation of web.xml is not enabled, skip parsing any web-fragment.xml files as the result is never used. (markt)
fix 55839: Extend support for digest prefixes {MD5}, {SHA} and {SSHA} to all Realms rather than just the JNDIRealm. (markt)
fix 55842: Ensure that if a larger than default response buffer is configured that the full buffer is used when a Servlet outputs via a Writer. (markt)
fix 55851: Further fixes to enable SPNEGO authentication to work with IBM JDKs. Based on a patch by Arunav Sanyal. (markt)
add Fix CVE-2013-4590: Add an option to the Context to control the blocking of XML external entities when parsing XML configuration files and enable this blocking by default when a security manager is used. The block is implemented via a custom resolver to enable the logging of any blocked entities. (markt)
Coyote
code Implement a number of small refactorings to the APR/native handler for upgraded HTTP connections. (markt)
fix Fix an issue with upgraded HTTP connections over HTTPS (e.g. secure WebSocket) when using the APR/native connector that resulted in the unexpected closure of the connection. (markt)
fix Ensure that the application class loader is used when calling the ReadListener and WriteListener methods when using non-blocking IO. A side effect of not doing this was that JNDI was not available when processing WebSocket events. (markt)
add Make the time that the internal executor (if used) waits for request processing threads to terminate before continuing with the connector stop process configurable. (markt)
fix 55749: Improve the error message when SSLEngine is disabled in the AprLifecycleListener and SSL is configured for an APR/native connector. (markt)
add If a request that includes an Expect: 100-continue header receives anything other than a 2xx response, close the connection This protects against misbehaving clients that may not sent the request body in that case and send the next request instead. (markt)
fix Improve the parsing of trailing headers in HTTP requests. (markt)
Jasper
fix 55735: Fix a regression caused by the fix to 55198. When processing JSP documents, attributes in XML elements that are template content should have their text xml-escaped, but output of EL expressions in them should not be escaped. (markt)
fix 55807: The JSP compiler used a last modified time of -1 for TLDs in JARs expanded in to WEB-INF/classes (IDEs often do this expansion) when creating the dependency list for JSPs that used that TLD. This meant JSPs using that TLD were recompiled on every access. (markt)
Cluster
add Add log message that initialization of AbstractReplicatedMap has been completed. (kfujino)
fix The logger of AbstractReplicatedMap should be non-static in order to enable logging of each application. Side-effects of this change is to throw RuntimeException in MapMessage#getKey() and getValue() instead of Null return and error log. (kfujino)
code Simplify the code of DeltaManager#startInternal(). Reduce unnecessary nesting for acquisition of cluster instance. (kfujino)
fix Remove unnecessary attributes of stateTransferCreateSendTime and receiverQueue from cluster manager template. These attributes should not be defined as a template. (kfujino)
fix Fix MBean attribute definition of stateTransfered. The method name is not isStateTransfered() but getStateTransfered(). (kfujino)
fix Correct stop failure log of cluster. Failure cause is not only Valve. (kfujino)
fix Remove unnecessary sleep when sending session blocks on session sync phase. (kfujino)
fix Expose stateTimestampDrop of org.apache.catalina.ha.session.DeltaManager via JMX. (kfujino)
fix When the ping timeouted, make sure that memberDisappeared method is not called by specifying the members that has already been removed. (kfujino)
add Add log message of session relocation when member disappeared. (kfujino)
fix If ping message fails, prevent wrong timeout detection of normal member that is no failure members. (kfujino)
Web applications
add Add some documentation on the SSL configuration options for WebSocket clients. (markt)
add Add to cluster document a description of notifyLifecycleListenerOnFailure and heartbeatBackgroundEnabled. (kfujino)
fix Update the documentation with information for WebSocket 1.0 specification and javadoc. (violetagg)
fix 55703: Clarify the role of the singleton attribute for JNDI resource factories. (markt)
fix 55746: Add documentation on the allRolesMode to the CombinedRealm and LockOutRealm. Patch by Cédric Couralet. (markt)
add Expand the information on web applications that ship as part of Tomcat in the security how-to section of the documentation web application. (markt)
fix Expand the description of the WebSocket buffers in the documentation web application to clarify their purpose. (markt)
add Correct the documentation for Cluster manager. (kfujino)
add Add information on how to configure integrated Windows authentication when Tomcat is running on a non-Windows host. (markt)
Extras
update Update commons-logging to version 1.1.3. (rjung)
Other
add 52323: Add support for the Cobertura code coverage tool when running the unit tests. Based on a patch by mhasko. (markt/kkolinko)
update Update sample Eclipse IDE project. Explicitly use a Java 6 SE JDK. Exclude JSR356 WebSocket classes from build path, as they cannot be compiled with Java 6. (kkolinko)
update Update the Eclipse compiler to 4.3.1. (kkolinko/markt)
Tomcat 7.0.47 (violetagg)released 2013-10-24
Coyote
fix Fix regression with legacy WebSocket implementation in NIO and APR connectors. (markt)
Web applications
fix Avoid hang observed with Java 6 on Windows when stopping the Tomcat process via CTRL-C. (markt)
Other
fix 55663: NOTICE files are corrected according to NOTICE files requirements. (violetagg)
Tomcat 7.0.46 (violetagg)not released
Catalina
fix Only send a WebSocket close message on an IOException if the client has not yet received a close control message from the server as the IOException may be in response to the client continuing to send a message after the server sent a close control message. (markt)
fix 49134: Ensure nested realms are correctly destroyed, when a CombinedRealm is destroyed. This ensures that the associated MBeans are deregistered. (markt)
Coyote
code Refactor APR/native connector to reduce the scope of localAddList. (markt)
fix 55602: Ensure that sockets removed from the Poller and then closed in the APR/native connector are removed and then closed in a thread-safe manner. (markt)
fix Update the APR/native connector to version 1.1.29. (violetagg)
Jasper
fix 55642: Correct logic error in the JSP parser that was incorrectly identifying EL expressions in jsp:param element values as a literal string. (markt)
Cluster
add Add support for notify periodic event of cluster. (kfujino)
Web applications
fix Correct the javadoc for org.apache.catalina.Lifecycle. (kfujino)
add Add document for sessionIdAttribute attribute in org.apache.catalina.ha.session.JvmRouteBinderValve. (kfujino)
fix Handle the case when a user closes the browser whilst playing the snake game in the JSR356 WebSocket examples. (markt)
fix Ensure Javadoc comments are associated with the correct elements in org.apache.tomcat.jni.Poll. (markt)
add Expand Context documentation for the use of sessionCookiePath="/" to make the implications for session fixation protection clearer. (markt)
fix 55629: Ensure that the JMX notification listener added during initialization of the servlet org.apache.catalina.manager.StatusManagerServlet is removed in the destroy phase. (violetagg)
fix Correct the documentation for Deployment Organization in the App Dev Guide. (violetagg)
add 55639: Add a Drawboard WebSocket example. (kpreisser)
Tomcat 7.0.45 (violetagg)not released
Catalina
add 55576: Preserve the order in which request parameters were received when accessing them via the Servlet API. (markt)
Cluster
fix Logger instance of cluster session manager is changed to non-static in order to enable logging of each application. (kfujino)
Tomcat 7.0.44 (violetagg)not released
Jasper
fix 55582: Correct concurrency issue that can result in two instances of JspServletWrapper being created for one tag Patch provided by Sheldon Shao. (markt)
Tomcat 7.0.43 (violetagg)not released
Catalina
add 51526: o.a.catalina.startup.Tomcat#addWebapp methods now process the web application's META-INF/context.xml when it is available in the provided path. (violetagg)
fix 55186: Ensure local name is recycled between requests so IP virtual hosting works correctly. (markt)
fix 55210: Correct the processing of the provider-configuration file for javax.servlet.ServletContainerInitializer in the resource directory META-INF/services when this file contains comments and multiple SCIs. Patch provided by Nick Williams. (violetagg)
fix 55230: Use the correct resource path when obtaining an InputStream for resources served by a ProxyDirContext. (markt)
fix Ensure that the JAR scanning process scans the Apache Log4j version 2 JARs. Patch provided by Nick Williams. (markt)
fix 55261: Fix failing unit test for file upload checks when running on platform / JVM combinations that have large network buffers. (markt)
fix 55268: Added optional --service-start-wait-time command-line option to change service start wait time from default of 10 seconds.
fix The contextClass attribute of HostConfig refers to the value of the contextClass attribute of Host. (kfujino)
fix 55331: Dispatching to an asychronous servlet from AsyncListener.onTimeout() should not trigger an IllegalStateException. (markt)
fix 55333: Correct a regression in the fix for 55071. (markt)
fix When using a security manager, ensure that calls to the ServletContext that are routed via an AccessController.doPrivileged block do not result in a call to a different underlying method on the ServletContext. (markt)
fix 55354: Ensure that the naming context environment parameters are restored after associating the Principle with the user name. Based on patch provided by Richard Begg. (violetagg)
fix 55357: Ensure the web application class loader is set as a thread context class loader during session deserialization. (violetagg)
fix 55404: Log warnings about using security roles in web.xml without defining them as warnings. (markt)
fix 55439: Don't try a forced stop when stop -force is used if Tomcat has already been stopped. This avoids error messages when the PID file has been cleared. If a forced stop is required, improve handling of the case when the PID file can be read from or written to but not deleted. (markt)
fix 55454: Avoid NPE when parsing an incorrect content type. (violetagg)
update Back-port the JSR-356 Java WebSocket 1.0 implementation from Tomcat 8. Note that use of this functionality requires Java 7. (markt)
update Deprecate the Tomcat proprietary WebSocket API in favour of the new JSR-356 implementation. (markt)
fix 55494: Reduce severity of log message from warning to information for JNDI Realm connection issues where the JNDI Realm automatically re-tries the action that failed. Make clear in the log message that the action is being re-tried. (markt)
fix Correct several incorrect formats of JdkLoggerFormatter. (kfujino)
fix 55521: Ensure that calls to HttpSession.invalidate() do not return until the session has been invalidated. Also ensure that checks on the validity of a session return a result consistent with any previous call to HttpSession.invalidate(). (markt)
fix 55524: Refactor to avoid a possible deadlock when handling an IOException during output when using Tomcat' proprietary (and deprecated) WebSocket API. (markt)
fix The loaded attribute never exists in PersistentManager. isLoaded is defined as operation in mbeans-descriptors. (kfujino)
add Added logging of logging.properties location when system property org.apache.juli.ClassLoaderLogManager.debug=true is set.
fix 55570: Correctly log exceptions for all error conditions in the SPNEGO authenticator. (markt)
Coyote
fix 55228: Allow web applications to set a HTTP Date header. (markt)
add Expose the current connection count for each protocol handler via JMX. (markt)
fix 55267: If an application configures a timeout for a Comet connection ensure it is only used for read and not write operations. This prevents a long timeout delaying the closing of the socket associated with a Comet connection after an error occurs. (markt)
fix Ensure that java.lang.VirtualMachineErrors are not swallowed when using the HTTP or AJP NIO connectors. (markt)
fix 55399: Use the response locale to select the language to use for the status message in the HTTP response. (markt)
update Refactor the connectors to support the new JSR-356 Java WebSocket 1.0 implementation. The most noticeable change is that the AJP APR/native and HTTP APR/native connectors no longer support multiple poller threads. Both connectors now use a single poller thread. (markt)
fix Internally, content length is managed as a long. Fix a few places in the AJP connector where this was restricted to an int. (markt)
fix 55453: Ensure that the AJP connector does not permit response bodies to be included for responses with status codes and/or request methods that are not permitted to have a response body. (markt)
fix 55500: Don't ignore the value of an asynchronous context timeout when using the AJP NIO connector. (markt)
fix Fix CVE-2013-4286: Better adherence to RFC2616 for content-length headers. (markt)
fix Fix CVE-2013-4322: Add support for limiting the size of chunk extensions when using chunked encoding. (markt)
fix Update the APR/native connector to version 1.1.28. Make this the minimum acceptable version as the correct behaviour of the JSR-356 WebSocket implementation when using the APR/native HTTP connector depends on a bug fix in the 1.1.28 release. (markt)
Jasper
fix 55198: Ensure attribute values in tagx files that include EL and quoted XML characters are correctly quoted in the output. (markt)
fix Ensure that javax.el.ELContext.getContext(Class) will throw NullPointerException when the provided class is null. (violetagg)
fix Ensure that FeatureDescriptor objects returned by javax.el.MapELResolver.getFeatureDescriptors(ELContext,Object) will be created with a correct shortDescription - an empty string and a named attribute ELResolver.RESOLVABLE_AT_DESIGN_TIME - true. (violetagg)
fix Ensure that FeatureDescriptor objects returned by javax.el.ResourceBundleELResolver.getFeatureDescriptors(ELContext,Object) will be created with a correct shortDescription - an empty string. javax.el.ResourceBundleELResolver.isReadOnly(ELContext,Object,Object) returns true if the base object is an instance of ResourceBundle. (violetagg)
fix 55207: Enforce the restriction that a <jsp:text> element may not contain any sub-elements from any namespace. Patch provided by Jeremy Boynes. (markt)
fix Ensure that javax.el.ListELResolver.getFeatureDescriptors(ELContext,Object) will always return null. javax.el.ListELResolver.isReadOnly(ELContext,Object,Object) will return a result when the property cannot be coerced into an integer. (violetagg)
fix Ensure that javax.el.ArrayELResolver.getFeatureDescriptors(ELContext,Object) will always return null. javax.el.ArrayELResolver.isReadOnly(ELContext,Object,Object) and javax.el.ArrayELResolver.getType(ELContext,Object,Object) will return a result when the property cannot be coerced into an integer. (violetagg)
fix 55309: Fix concurrency issue with JSP compilation and the tag plug-in manager. Patch provided by Sheldon Shao. (markt)
fix Ensure that javax.el.BeanELResolver.getFeatureDescriptors(ELContext,Object) and javax.el.BeanELResolver.getCommonPropertyType(ELContext,Object) do not throw NullPointerException when the provided context is null. (violetagg)
Cluster
add Add new attribute terminateOnStartFailure. Set to true if you wish to terminate replication map when replication map fails to start. If replication map is terminated, associated context will fail to start. If you set this attribute to false, replication map does not end. It will try to join the map membership in the heartbeat. Default value is false. (kfujino)
fix Avoid ConcurrentModificationException when sending a heartbeat. (kfujino)
fix Avoid NPE when the channel fails to start. (kfujino)
fix 55301: Fix IllegalArgumentException thrown by simple test for McastService. (kfujino)
fix 55332: Fix NPE in FileMessageFactory.main when specify empty file as arguments. (kfujino)
fix More definite thread name for MessageDispatch15Interceptor. (kfujino)
Web applications
update Remove the experimental label from the AJP NIO connector documentation. (markt)
fix Correctly associated the default resource bundle with the English locale so that requests that specify an Accept-Language of English ahead of French, Spanish or Japanese get the English messages they asked for. (markt)
fix 55469: Fixed tags that were not properly closed. Based on a patch provided by Larry Shatzer, jr. (violetagg)
update The WebSocket examples in the examples web application have been changed to use the new JSR-356 Java WebSocket 1.0 implementation. (markt)
add Add document for org.apache.catalina.tribes.group.GroupChannel. (kfujino)
fix Correct Realm Component page of Tomcat documentation. (violetagg)
jdbc-pool
fix 54693: Add a validationQueryTimeout property. Patch provided by Daniel Mikusa. (kfujino)
fix 54693#c6: Avoid NPE caused by createConnection() method returns null. Patch provided by Daniel Mikusa. (kfujino)
fix 55342: Remove unnecessary reset of interrupted flag. If InterruptedException is thrown, the interrupted flag has been cleared. (kfujino)
fix 55343: Add flag to ignore exceptions of connection creation while initializing the pool. (kfujino)
fix Add undefined attributes and operations to mbeans-descriptor. (kfujino)
Other
add 45428: Trigger a thread dump written to standard out if Tomcat fails to stop in a timely manner to aid diagnostics. This is only available on platforms that use catalina.sh. (markt)
fix 55204: Correct namespace used in Servlet 2.4 test web application. Patch provided by Jeremy Boynes. (markt)
fix 55205: Reorder elements so web.xml complies with schema for Servlet 3.0 test web application. Patch provided by Jeremy Boynes. (markt)
fix 55211: Correct namespace in TLD files used in test web applications. Rename elements tagclass to tag-class so TLD files complies with DTD/schema. Patch provided by Jeremy Boynes. (violetagg)
update Update package renamed version of Commons BCEL to the latest code from Commons BCEL trunk. (markt)
update Update package renamed version of Commons FileUpload to the latest code from Commons FileUpload trunk. (markt)
fix 55297: When looking for the jsvc executable, if an explicit path is not set and it is not found in $CATALINA_BASE, look in $CATALINA_HOME as well. (markt)
fix 55336: Correctly escape parameters passed to eval in the catalina.sh script to ensure that Tomcat starts when installed on a path that contains multiple consecutive spaces. (markt)
Tomcat 7.0.42 (markt)released 2013-07-05
Catalina
fix Enforce the restriction described in section 4.4 of the Servlet 3.0 specification that requires the new pluggability methods only to be available to ServletContextListeners defined in one of the specified ways. (markt)
fix Better handle FORM authentication when requesting a resource as an unauthenticated user that is only protected for a sub-set of HTTP methods that does not include GET. (markt)
fix 53777: Add support for a JAAS Realm instance to use a dedicated configuration rather than the JVM global JAAS configuration. This is most likely to be useful for per web application JAAS Realms. Based on a patch by eolivelli. (markt)
fix 54745: Fix JAR file scanning when Tomcat is deployed via Java Web Start. Patch provided by Nick Williams. (markt)
add 55017: Add the ability to configure the RMI bind address when using the JMX remote lifecycle listener. Patch provided by Alexey Noskov. (markt)
fix 55071: Ensure original exception is reported if JDBC Realm fails to read a user's credentials. (markt)
fix 55073, 55108, 55109, 55110, 55158 & 55159: Small performance improvements. Patches provided by Adrian Nistor. (markt/violetagg)
add 55102: Add support for time to first byte in the AccessLogValve. Patch provided by Jeremy Boynes. (markt)
fix 55125: If the Server container fails to start, don't allow the Catalina wrapper to start (used when running from the command line and when running as a service) since Tomcat will not be able to do any useful work. (markt)
fix Update the JreMemoryLeakPreventionListener to take account of changes in the behaviour of java.beans.Introspector.flushCaches() and sun.awt.AppContext.getAppContext() in Java 7. (markt)
fix Avoid WARNING log message of Users:type=UserDatabase,database=UserDatabase at Tomcat shutdown. (pero)
fix Avoid ClassCastException when an asynchronous dispatch is invoked in an asynchronous cycle which is started by a call to ServletRequest.startAsync(ServletRequest,ServletResponse) where ServletRequest/ServletResponse are custom implementations. (violetagg)
fix Correct a regression introduced in 7.0.39 (refactoring of base 64 encoding and decoding) that broke the JNDI Realm when userPassword was set and passwords were hashed with MD5 or SHA1. (markt/kkolinko)
fix Correct the mechanism for the path calculation in AsyncContext.dispatch(). (violetagg)
fix 55155: Avoid constant focus grabbing when running the Tomcat unit tests under Java 6 on OSX. Patch provided by Casey Lucas. (markt)
fix 55160: Don't ignore connectionUploadTimeout setting when using HTTP NIO connector. (markt)
fix 55176: Correctly handle regular expressions within SSI expressions that contain an equals character. (markt)
Coyote
fix 55177: Correctly handle infinite soTimeout for BIO HTTP connector. Based on a patch by Nick Bunn. (markt)
fix 55180: Correctly handle infinite soTimeout when disableUploadTimeout is set to false. Patch provided by Nick Bunn. (violetagg)
Cluster
fix Delete leftover of war file from tempDir when removing invalid FileMessageFactory. (kfujino)
fix Ensure that the keepAlive of NioSender works correctly when keepAliveCount/keepAliveTime is set to a value greater than 0. (kfujino)
add Add logging of when a member is unable to join the cluster. (kfujino)
fix Replace Tribes's TaskQueue as executor's workQueue in order to ensure that executor's maxThread works correctly. (kfujino)
fix 54086: Fix an additional code path that could lead to multiple threads attempting to modify the same selector key set. (markt)
Web applications
add Complete the document for MessageDispatch15Interceptor. (kfujino)
add 53655: Document the circumstances under which Tomcat will add a javax.mail.Authenticator to mail sessions created via a JNDI resource. (markt)
fix 55179: Correct the Javadoc for the remote IP valve so the correct name is used to refer to the proxiesHeader property. (markt)
jdbc-pool
fix 55031: Fixed Export-Package header and uses directives in MANIFEST.MF. Change the version for package org.apache.juli.logging to "0" in Import-Package header. Thus any version of that package can be used. Patch provided by Martin Lichtin. (violetagg)
Other
update Update Maven Cental location used to download dependencies at build time to be repo.maven.apache.org. (kkolinko)
update Update JUnit to version 4.11. Configure separate download for Hamcrest 1.3 core library as its classes are no longer included in junit.jar. (kkolinko)
fix 54013: When using a forced stop, allow a short period of time (5s) for the process to die before returning. Patch provided by mukarram.baig. (markt)
fix 55119: Ensure that the build process produces Javadoc that is not vulnerable to CVE-2013-1571. Based on a patch by Uwe Schindler. (markt)
Tomcat 7.0.41 (markt)released 2013-06-10
Catalina
fix 54703: Make parsing of HTTP Content-Type headers tolerant of any CR or LF characters that appear in the value passed by the application. Also fix some whitespace parsing issues identified by the additional test cases. (markt)
fix Prevent possible WAR file locking when reading a context.xml file from an unexpanded WAR file. Note that in normal usage, the JreMemoryLeakPreventionListener would protect against this. (markt)
fix Ensure that when auto deployment runs for a Host, it uses the latest values for copyXML, deployXML and unpackWARs. (markt)
fix 54939: Provide logging (using a UserDataHelper) when HTTP header parsing fails (e.g. when maxHeaderCount is exceeded). (markt)
add 54944: Enhancements to the unit tests for FORM authentication. Patch provided by Brian Burch. (markt)
fix 54955: When a reload of the application is performed ensure that a subsequent request to the context root does not result in a 404 response. (violetagg)
fix 54971: Ensure that the correct location is used when writing files via javax.servlet.http.Part.write(String). (markt)
fix 54974: Ensure that SessionCookieConfig#set<methods> will throw IllegalStateException if the ServletContext from which this SessionCookieConfig was acquired has already been initialized. (violetagg)
fix 54981: Ensure that ServletContext#getJspConfigDescriptor() will return null when there is no jsp configuration provided by web.xml/web-fragment.xml. (violetagg)
fix Ensure that when Tomcat's anti-resource locking features are used that the temporary copy of the web application and not the original is removed when the web application stops. (markt)
fix 54984: Use the correct encoding when processing a form data posted as multipart/form-data even when the request parameters are not parsed. (violetagg)
fix 54999: The old JSESSIONIDSSO needs to be removed when SSO is being used and logout() and login() occur within a single request. Patch provided by Keith Mashinter. (markt)
add 55035: Add support for the version attribute to the deploy command of the Ant tasks for interfacing with the text based Manager application. Patch provided by Sergey Tcherednichenko. (markt)
add 55046: Add a Servlet Filter that implements CORS. Patch provided by Mohit Soni. (markt)
add 55052: JULI's LogManager now additionally looks for logging properties without prefixes if the property cannot be found with a prefix. (markt)
fix Ensure that only the first asynchronous dispatch operation for a given asynchronous cycle will be performed. Any subsequent asynchronous dispatch operation for the same asynchronous cycle will be ignored and IllegalStateException will be thrown. (violetagg)
Coyote
fix 54947: Fix the HTTP NIO connector that incorrectly rejected a request if the CRLF terminating the request line was split across multiple packets. Patch by Konstantin Preißer. (markt)
Jasper
fix 54964: Allow tag plug-ins to be packaged with a web application. Patch provided by Sheldon Shao. (markt)
fix 54968: Return the correct version number (2.2) of the JSP specification that is supported by the JSP engine when javax.servlet.jsp.JspEngineInfo#getSpecificationVersion() is invoked. (violetagg)
Cluster
add Add maxValidTime attribute to prevent the leak of FileMessageFactory in FarmWarDeployer. (kfujino)
code Simplify the code of ReplicationValve: Rather than get cluster instance from container on every request, use instance variable. (kfujino)
add Add maxWait attribute that the senderPool will wait when there are no available senders. (kfujino)
add Improve error message by including specified timeout if failed to retrieve a data sender. (kfujino)
add Add removeSuspectsTimeout attribute in order to remove a suspect node in TcpFailureDetector. (kfujino)
Web applications
fix 54931: Add information to the Window Service how-to about installing and running multiple instances. Based on a patch by Chris Derham. (markt)
fix 54932: Correct the link to Tribes documentation. (violetagg)
add Add document for o.a.c.tribes.group.interceptors.TcpFailureDetector. (kfujino)
Tomcat 7.0.40 (markt)released 2013-05-09
Catalina
update Update Tomcat's internal copy of Commons FileUpload to FileUpload 1.3. (markt)
fix 54178, CVE-2013-2071: Protect against AsyncListener implementations that throw RuntimeExceptions in response to an event. (markt)
fix 54791: Restore tools.jar entry in jarsToSkip property to prevent warnings when running Tomcat from Eclipse. (markt)
fix 54851: When scanning for web fragments, directories without any web-fragment.xml should not impact the status of distributable element. Patch provided by Trask Stalnaker. (violetagg)
fix When an error occurs during the sending of a WebSocket message, notify the Inbound side (where all the events occur that the application reacts to) that an error has occurred and that the connection is being closed. (markt)
fix 54906: Better error message if a ConcurrentModificationException occurs while checking for memory leaks when a web application stops. Also ensure that the exception does not cause remaining checks to be skipped. Based on a patch by NateC.
fix Allow 204 responses (no content) to include entity headers as required by RFC2616. (markt)
Coyote
fix Ensure write errors when using HTTP Upgrade with the APR/native connector result in IOExceptions rather than errors being silently swallowed. (markt)
Jasper
fix 54802: Provide location information for exceptions thrown by JspDocumentParser. (kkolinko)