Changelog

Tomcat 9.0.10 (markt)

Catalina

  • Fix: 62476: Use GMT timezone for the value of Expires header as required by HTTP specification (RFC 7231, 7234). (kkolinko)

not released Tomcat 9.0.9 (markt)

Catalina

  • Fix: Treat the <mapped-name> element of a <env-entry> in web.xml in the same way as the mappedName element of the equivalent @Resource annotation. Both now attempt to set the mappedName property of the resource. (markt)
  • Fix: Correct the processing of resources with <injection-target>s defined in web.xml. First look for a match using JavaBean property names and then, only if a match is not found, look for a match using fields. (markt)
  • Fix: When restoring a saved request with a request body after FORM authentication, ensure that calls to the HttpServletRequest methods getRequestURI(), getQueryString() and getProtocol() are not corrupted by the processing of the saved request body. (markt)
  • Fix: JNDI resources that are defined with injection targets but no value are now treated as if the resource is not defined. (markt)
  • Fix: Ensure that JNDI names used for <lookup-name> entries in web.xml and for lookup elements of @Resource annotations specify a name with an explicit java: namespace. (markt)
  • Fix: 50019: Add support for <lookup-name>. Based on a patch by Gurkan Erdogdu. (markt)
  • Add: Add the AuthenticatedUserRealm for use with CLIENT-CERT and SPNEGO when just the authenticated user name is required. (markt)
  • Fix: 50175: Add a new attribute to the standard context implementation, skipMemoryLeakChecksOnJvmShutdown, that allows the user to configure Tomcat to skip the memory leak checks usually performed during web application stop if that stop is triggered by a JVM shutdown. (markt)
  • Add: 51497: Add an option, ipv6Canonical, to the AccessLogValve that causes IPv6 addresses to be output in canonical form defined by RFC 5952. (ognjen/markt)
  • Add: 51953: Add the RemoteCIDRFilter and RemoteCIDRValve that can be used to allow/deny requests based on IPv4 and/or IPv6 client address where the IP ranges are defined using CIDR notation. Based on a patch by Francis Galiegue. (markt)
  • Fix: 62343: Make CORS filter defaults more secure. This is the fix for CVE-2018-8014. (markt)
  • Fix: Ensure that the web application resources implementation does not incorrectly cache results for resources that are only visible as class loader resources. (markt)
  • Fix: 62387: Do not log a warning message if the file based persistent session store fails to delete the file for a session when the session is invalidated because the file has not been created yet. (markt)
  • Fix: Make all loggers associated with Tomcat provided Filters non-static to ensure that log messages are not lost when a web application is reloaded. (markt)
  • Fix: Correct the manifest for the annotations-api.jar. The JAR implements the Common Annotations API 1.3 and the manifest should reflect that. (markt)
  • Fix: Switch to non-static loggers where there is a possibility of a logger becoming associated with a web application class loader causing log messages to be lost if the web application is stopped. (markt)
  • Add: 62389: Add the IPv6 loopback address to the default internalProxies regular expression. Patch by Craig Andrews. (markt)
  • Fix: In the RemoteIpValve and RemoteIpFilter, correctly handle the case when the request passes through one or more trustedProxies but no internalProxies. Based on a patch by zhanhb. (markt)
  • Fix: Correct the logic in MBeanFactory.removeConnector() to ensure that the correct Connector is removed when there are multiple Connectors using different addresses but the same port. (markt)
  • Fix: Make JAASRealm mis-configuration more obvious by requiring the authenticated Subject to include at least one Principal of a type specified by userClassNames. (markt)

Coyote

  • Fix: Correct a regression in the error page handling that prevented error pages from issuing redirects or taking other action that required the response status code to be changed. (markt)
  • Fix: Consistent exception propagation for NIO2 SSL close. (remm)
  • Fix: Followup sync fix for NIO2 async IO blocking read/writes. (remm)
  • Fix: Log an error message if the AJP connector detects the the reverse proxy is sending AJP messages that are too large for the configured packetSize. (markt)
  • Fix: Relax Host validation by removing the requirement that the final component of a FQDN must be alphabetic. (markt)
  • Fix: 62371: Improve logging of Host validation failures. (markt)
  • Fix: Fix a couple of unlikely edge cases in the shutting down of the APR/native connector. (markt)
  • Fix: Add missing handshake timeout for NIO2. (remm)
  • Fix: Correctly handle a digest authorization header when the user name contains an escaped character. (markt)
  • Fix: Correctly handle a digest authorization header when one of the hex field values ends the header with in an invalid character. (markt)
  • Fix: Correctly handle an invalid quality value in an Accept-Language header. (markt)
  • Docs: 62423: Fix SSL docs CRL attribute typo. (remm)
  • Fix: Improve IPv6 validation by ensuring that IPv4-Mapped IPv6 addresses do not contain leading zeros in the IPv4 part. Based on a patch by Katya Stoycheva. (markt)
  • Fix: Fix NullPointerException thrown from replaceSystemProperties() when trying to log messages. (csutherl)
  • Fix: Avoid unnecessary processing of async timeouts. (markt)

Jasper

  • Add: 50234: Add the capability to generate a web-fragment.xml file to JspC. (markt)
  • Fix: 62080: Ensure that all reads of the current thread's context class loader made by the UEL API and implementation are performed via a PrivilegedAction to ensure that a SecurityException is not triggered when running under a SecurityManager. (mark)
  • Fix: 62350: Refactor org.apache.jasper.runtime.BodyContentImpl so a SecurityException is not thrown when running under a SecurityManger and additional permissions are not required in the catalina.policy file. This is a follow-up to the fix for 43925. (kkolinko/markt)
  • Fix: Enable JspC from Tomcat 9 to work with Maven JspC compiler plug-ins written for Tomcat 8.5.x. Patch provided by Pavel Cibulka. (markt)
  • Fix: Update web.xml, web-fragment.xml and web.xml extracts generated by JspC to use the Servlet 4.0 version of the relevant schemas. (markt)

Cluster

  • Fix: Remove duplicate calls when creating a replicated session to reduce the time taken to create the session and thereby reduce the chances of a subsequent session update message being ignored because the session does not yet exist. (markt)
  • Add: Add the method to send a message with a specified sendOptions. (kfujino)
  • Fix: When sending the GET_ALL_SESSIONS message, make sure that sends with asynchronous option in order to avoid ack timeout. Waiting to receive the ALL_SESSION_DATA message should be done with waitForSendAllSessions instead of ACK. (kfujino)

WebSocket

  • Update: Use NIO2 API for websockets writes. (remm)
  • Fix: When decoding of path parameter failed, make sure to throw DecodeException instead of throwing ArrayIndexOutOfBoundsException. (kfujino)
  • Fix: Improve the handling of exceptions during TLS handshakes for the WebSocket client. (markt)
  • Fix: Enable host name verification when using TLS with the WebSocket client. (markt)

Web applications

62395: Clarify the meaning of the connector attribute minSpareThreads in the documentation web application. (markt) Correct the documentation for the allowHostHeaderMismatch attribute of the standard HTTP Connector implementations. (markt)

Tribes

  • Fix: Ensure that the correct default value is returned when retrieve unset properties in McastService. (kfujino)
  • Add: Make MembershipService more easily extensible. (kfujino)

jdbc-pool

  • Fix: When logValidationErrors is set to true, the connection validation error is logged as SEVERE instead of WARNING. (kfujino)

Other

  • Fix: Ensure that Apache Tomcat may be built from source with Java 11. (markt)
  • Add: 52381: Add OSGi metadata to JAR files, (markt)
  • Fix: 62391: Remove references to javaw.exe as this file is not required by Tomcat and the references prevent the use of the Server JRE. (markt)
  • Update: Update the packaged version of the Tomcat Native Library to 1.2.17 to pick up the latest Windows binaries built with APR 1.6.3 and OpenSSL 1.0.2o. (markt)
  • Update: 62458: Update the internal fork of Commons Pool 2 to dfef97b (2018-06-18) to pick up some bug fixes and enhancements. (markt)
  • Update: Update the internal fork of Commons DBCP 2 to 2.4.0. (markt)

2018-05-03 Tomcat 9.0.8 (markt)

Catalina

  • Fix: 62263: Avoid a NullPointerException when the RemoteIpValve processes a request for which no Context can be found. (markt)
  • Add: 62258: Don't trigger the standard error page mechanism when the error has caused the connection to the client to be closed as no-one will ever see the error page. (markt)
  • Fix: Register MBean when DataSource Resource type="javax.sql.XADataSource". Patch provided by Masafumi Miura. (csutherl)
  • Fix: Fix a rare edge case that is unlikely to occur in real usage. This edge case meant that writing long streams of UTF-8 characters to the HTTP response that consisted almost entirely of surrogate pairs could result in one surrogate pair being dropped. (markt)
  • Add: Update the internal fork of Apache Commons BCEL to r1829827 to add early access Java 11 support to the annotation scanning code. (markt)
  • Fix: 62297: Enable the CrawlerSessionManagerValve to correctly handle bots that crawl multiple hosts and/or web applications when the Valve is configured on a Host or an Engine. (fschumacher)
  • Fix: 62309: Fix a SecurityException when using JASPIC under a SecurityManager when authentication is not mandatory. (markt)
  • Fix: 62329: Correctly list resources in JAR files when directories do not have dedicated entries. Patch provided by Meelis Müür. (markt)
  • Add: Collapse multiple leading / characters to a single / in the return value of HttpServletRequest#getContextPath() to avoid issues if the value is used with HttpServletResponse#sendRedirect(). This behaviour is enabled by default and configurable via the new Context attribute allowMultipleLeadingForwardSlashInPath. (markt)
  • Fix: Improve handling of overflow in the UTF-8 decoder with supplementary characters. (markt)

Coyote

  • Fix: Correct off-by-one error in thread pool that allowed thread pools to increase in size to one more than the configured limit. Patch provided by usc. (markt)
  • Fix: Prevent unexpected TLS handshake failures caused by errors during a previous handshake that were not correctly cleaned-up when using the NIO or NIO2 connector with the OpenSSLImplementation. (markt)
  • Add: 62273: Implement configuration options to work-around specification non-compliant user agents (including all the major browsers) that do not correctly %nn encode URI paths and query strings as required by RFC 7230 and RFC 3986. (markt)
  • Fix: Fix sync for NIO2 async IO blocking read/writes. (remm)

Jasper

  • Update: Update the Eclipse Compiler for Java to 4.7.3a. (markt)
  • Update: Allow 9 to be used to specify Java 9 as the compiler source and/or compiler target for JSP compilation. The Early Access value of 1.9 is still supported. (markt)
  • Add: Add support for specifing Java 10 (with the value 10) as the compiler source and/or compiler target for JSP compilation. (markt)
  • Fix: 62287: Do not rely on hash codes to test instances of ValueExpressionImpl for equality. Patch provided by Mark Struberg. (markt)

WebSocket

  • Fix: 62301: Correct a regression in the fix for 61491 that didn't correctly handle a final empty message part in all circumstances when using PerMessageDeflate. (markt)
  • Fix: 62332: Ensure WebSocket connections are closed after an I/O error is experienced reading from the client. (markt)

Other

  • Fix: Avoid warning when running under Cygwin when the JAVA_ENDORSED_DIRS environment variable is not set. Patch provided by Zemian Deng. (markt)

2018-04-07 Tomcat 9.0.7 (markt)

Catalina

  • Fix: 51195: Avoid a false positive report of a web application memory leak by clearing ObjectStreamClass$Caches of classes loaded by the web application when the web application is stopped. (markt)
  • Fix: 52688: Add support for the maxDays attribute to the AccessLogValve and ExtendedAccessLogValve. This allows the maximum number of days for which rotated access logs should be retained before deletion to be defined. (markt)
  • Fix: Ensure the MBean names for the SSLHostConfig and SSLHostConfigCertificate are correctly formed when the Connector is bound to a specific IP address. (markt)
  • Fix: 62168: When using the PersistentManager honor a value of -1 for minIdleSwap and do not swap out sessions to keep the number of active sessions under maxActive. Patch provided by Holger Sunke. (markt)
  • Fix: 62172: Improve Javadoc for org.apache.catalina.startup.Constants and ensure that the constants are correctly used. (markt)
  • Fix: 62175: Avoid infinite recursion, when trying to validate a session while loading it with PersistentManager. (fschumacher)
  • Fix: Ensure that NamingContextListener instances are only notified once of property changes on the associated naming resources. (markt)
  • Add: 62224: Disable the forkJoinCommonPoolProtection of the JreMemoryLeakPreventionListener when running on Java 9 and above since the underlying JRE bug has been fixed. (markt)

Coyote

  • Fix: Avoid potential loop in APR/Native poller. (markt)
  • Fix: Ensure streams that are received but not processed are excluded from the tracking of maximum ID of processed streams. (markt)
  • Fix: Refactor the check for a paused connector to consistently prevent new streams from being created after the connector has been paused. (markt)
  • Fix: Improve debug logging for HTTP/2 pushed streams. (markt)
  • Fix: The OpenSSL engine SSL session will now ignore invalid accesses. (remm)
  • Fix: 62177: Correct two protocol errors with HTTP/2 PUSH_PROMISE frames. Firstly, the HTTP/2 protocol only permits pushes to be sent on peer initiated requests. Secondly, pushes must be sent in order of increasing stream ID. These restriction were not being enforced leading to protocol errors at the client. (markt)

Web applications

  • Add: Add document for FragmentationInterceptor. (kfujino)
  • Add: Document how the roles for an authenticated user are determined when the CombinedRealm is used. (markt)
  • Fix: 62163: Correct the Tomcat Setup documentation that incorrectly referred to Java 7 as the minimum version rather than Java 8. (markt)

Tribes

  • Fix: Add JMX support for FragmentationInterceptor in order to prevent warning of startup. (kfujino)

jdbc-pool

  • Fix: Ensure that SQLWarning has been cleared when connection returns to the pool. (kfujino)
  • Add: Enable clearing of SQLWarning via JMX. (kfujino)
  • Fix: Ensure that parameters have been cleared when PreparedStatement and/or CallableStatement are cached. (kfujino)
  • Fix: Enable PoolCleaner to be started even if validationQuery is not set. (kfujino)

Other

  • Update: Update the build script so MD5 hashes are no longer generated for releases as per the change in the ASF distribution policy. (markt)
  • Fix: 62164: Switch the build script to use TLS for downloads from SourceForge and Maven Central to avoid failures due to HTTP to HTTPS redirects. (markt)
  • Add: Always report the OS's umask when launching the JVM. (schultz)
  • Add: Add managed connections package to the package renamed DBCP2 to provide a complete DBCP2 in Tomcat. (remm)

2018-03-08 Tomcat 9.0.6 (markt)

Catalina

  • Fix: 43866: Add additional attributes to the Manager to provide control over which listeners are called when an attribute is added to the session when it has already been added under the same name. This is to aid clustering scenarios where setAttribute() is often called to signal that the attribute value has been mutated and needs to be replicated but it may not be required, or even desired, for the associated listeners to be triggered. The default behaviour has not been changed. (markt)
  • Fix: Minor optimization when calling class transformers. (rjung)
  • Add: Pass errors triggered by invalid requests or unavailable services to the application provided error handling and/or the container provided error handling (ErrorReportValve) as appropriate. (markt)
  • Add: 41007: Add the ability to specify static HTML responses for specific error codes and/or exception types with the ErrorReportValve. (markt)
  • Fix: Prevent Tomcat from applying gzip compression to content that is already compressed with brotli compression. Based on a patch provided by burka. (markt)
  • Fix: 62090: Null container names are not allowed. (remm)
  • Fix: 62104: Fix programmatic login regression as the NonLoginAuthenticator has to be set for it to work (if no login method is specified). (remm)
  • Fix: 62117: Improve error message in catalina.sh when calling kill -0 <pid> fails. Based on a suggestion from Mark Morschhaeuser. (markt)
  • Fix: 62118: Correctly create a JNDI ServiceRef using the specified interface rather than the concrete type. Based on a suggestion by Ángel Álvarez Páscua. (markt)
  • Fix: Fix for RequestDumperFilter log attribute. Patch provided by Kirill Romanov via Github. (violetagg)
  • Fix: 62123: Avoid ConcurrentModificationException when attempting to clean up application triggered RMI memory leaks on web application stop. (markt)
  • Add: When a deployment descriptor is deployed that includes a path attribute, log a warning that the path attribute will be ignored. (markt)
  • Add: When a deployment descriptor is deployed that references an external docBase and, as a result, a docBase under the appBase will be ignored, log a warning. (markt)
  • Fix: Correct a regression in the fix for 60276 that meant that compression was applied to all MIME types. Patch provided by Stefan Knoblich. (markt)

Coyote

  • Add: Add async HTTP/2 parser for NIO2. (remm)
  • Fix: Add minor HPACK fixes, based on fixes by Stuart Douglas. (remm)
  • Fix: 61751: Follow up fix so that OpenSSL engine returns underflow when unwrapping if no bytes were produced and the input is empty. (remm)
  • Fix: Minor OpenSSL engine cleanups. (remm)
  • Fix: NIO SSL handshake should throw an exception on overflow status, like NIO2 SSL. (remm)

Web applications

  • Add: 47467: When deploying a web application via the manager application and a path is not explicitly specified, derive it from the provided deployment descriptor or, if that is not present, the WAR or DIR. (markt)
  • Add: 48672: Add documentation for the Host Manager web application. Patch provided by Marek Czernek. (markt)
  • Add: Add support for specifying the application version when deploying an application via the Manager application HTML interface. (markt)
  • Add: Work-around a known, non-specification compliant behaviour in some versions of IE that can allow XSS when the Manager application generates a plain text response. Based on a suggestion from Muthukumar Marikani. (markt)

2018-02-11 Tomcat 9.0.5 (markt)

Catalina

  • Fix: Prevent a stack trace being written to standard out when running on Java 10 due to changes in the LogManager implementation. (markt)
  • Fix: Avoid duplicate load attempts if one has been made already. (remm)
  • Fix: Avoid NPE in ThreadLocalLeakPreventionListener if there is no Engine. (remm)
  • Fix: 62000: When a JNDI reference cannot be resolved, ensure that the root cause exception is reported rather than swallowed. (markt)
  • Fix: 62036: When caching an authenticated user Principal in the session when the web application is configured with the NonLoginAuthenticator, cache the internal Principal object rather than the user facing Principal object as Tomcat requires the internal object to correctly process later authorization checks. (markt)
  • Add: Refactor error handling to enable errors that occur before processing is passed to the application to be handled by the application provided error handling and/or the container provided error handling (ErrorReportValve) as appropriate. (markt)
  • Add: Pass 404 errors triggered by a missing ROOT web application to the container error handling to generate the response body. (markt)
  • Add: Pass 400 errors triggered by invalid request targets to the container error handling to generate the response body. (markt)
  • Fix: Provide a correct Allow header when responding to an HTTP TRACE request for a JSP with a 405 status code. (markt)
  • Fix: When using Tomcat embedded, only perform Authenticator configuration once during web application start. (markt)
  • Fix: 62067: Correctly apply security constraints mapped to the context root using a URL pattern of "". (markt)
  • Fix: Process all ServletSecurity annotations at web application start rather than at servlet load time to ensure constraints are applied consistently. (markt)

Coyote

  • Fix: 61751: Fix truncated request input streams when using NIO2 with TLS. (markt)
  • Fix: 62023: Log error reporting multiple SSLHostConfig elements when using the APR Connector instead of crashing Tomcat. (csutherl)
  • Fix: 62032: Fix NullPointerException when certificateFile is not defined on an SSLHostConfig and unify the behavior when a certificateFile is defined but the file does not exist for both JKS and PEM file types. (csutherl)
  • Fix: Ensure that the toString() method behaves consistently for ByteChunk and CharChunk and that null is returned when toString() is called both on newly created objects and immediately after a call to recycle(). This should not impact typical Tomcat users. It may impact users who use these classes directly in their own code. (markt)
  • Fix: Ensure that the toString(), toBytes() and toChars() methods of MessageBytes behave consistently and do not throw a NullPointerException both on newly created objects and immediately after a call to recycle(). This should not impact typical Tomcat users. It may impact users who use these classes directly in their own code. (markt)
  • Fix: When processing an HTTP 1.0 request in the HTTP connector and no host information is provided in the request, obtain the server port from the local port rather than the connector configuration since the configured value maybe zero. (markt)
  • Add: Enable strict validation of the provided host name and port for all connectors. Requests with invalid host names and/or ports will be rejected with a 400 response. (markt)
  • Fix: Update the host validation to permit host names and components of domain names (excluding top-level domains) to start with a number and to ensure that top-level domains are fully alphabetic. (markt)
  • Fix: 62053: Fix NPE when writing push headers with HTTP/2 NIO2. Patch submitted by Holger Sunke. (remm)

Jasper

  • Fix: Include an HTTP Allow header when a JSP generates a 405 response due to a request with an unsupported method. (markt)
  • Add: Add support for the HTTP OPTION method to JSPs. The JSP specification explicitly states that the behaviour for this method is undefined for JSPs so this is a Tomcat specific behaviour. (markt)

WebSocket

  • Fix: 62024: When closing a connection with an abnormal close, close the socket immediately rather than waiting for a close message from the client that may never arrive. (markt)

Webapps

  • Fix: 62049: Fix missing class from manager 404 JSP error page. (remm)

jdbc-pool

  • Add: Enhance the JMX support for jdbc-pool in order to expose PooledConnection and JdbcInterceptors. (kfujino)
  • Add: Add MBean for PooledConnection. (kfujino)
  • Add: 62011: Add MBean for StatementCache. (kfujino)
  • Add: Expose the cache size for each connection via JMX in StatementCache. (kfujino)
  • Add: Add MBean for ResetAbandonedTimer. (kfujino)

Other

  • Update: Update the list with the public interfaces in the RELEASE-NOTES. (violetagg)
  • Update: Update the NSIS Installer used to build the Windows installer to version 3.03. (kkolinko)

2018-01-22 Tomcat 9.0.4 (markt)

Catalina

  • Fix: Correct a regression in the previous fix for 61916 that meant that any call to addHeader() would have been replaced with a call to setHeader() for all requests mapped to the AddDefaultCharsetFilter. (markt)
  • Fix: 61999: maxSavePostSize set to 0 should disable saving POST data during authentication. (remm)

Coyote

  • Fix: Fix NIO2 HTTP/2 sendfile. (remm)
  • Fix: 61993: Improve handling for ByteChunk and CharChunk instances that grow close to the maximum size allowed by the JRE. (markt)

Jasper

  • Add: 43925: Add a new system property (org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE) to control the size of the buffer used by Jasper when buffering tag bodies. (markt)

Web applications

  • Fix: 62006: Document the new JvmOptions9 command line parameter for tomcat9.exe. (markt)

not released Tomcat 9.0.3 (markt)

Catalina

  • Add: 57619: Implement a small optimisation to how JAR URLs are processed to reduce the storage of duplicate String objects in memory. Patch provided by Dmitri Blinov. (markt)
  • Fix: Add some missing NPEs to ServletContext. (remm)
  • Fix: Update the Java EE 8 XML schema to the released versions. (markt)
  • Fix: Minor HTTP/2 push fixes. (remm)
  • Fix: 61916: Extend the AddDefaultCharsetFilter to add a character set when the content type is set via setHeader() or addHeader() as well as when it is set via setContentType(). (markt)
  • Fix: When using WebDAV to copy a file resource to a destination that requires a collection to be overwritten, ensure that the operation succeeds rather than fails (with a 500 response). This enables Tomcat to pass two additional tests from the Litmus WebDAV test suite. (markt)
  • Update: Modify the Default and WebDAV Servlets so that a 405 status code is returned for PUT and DELETE requests when disabled via the readonly initialisation parameter.
  • Fix: Align the contents of the Allow header with the response code for the Default and WebDAV Servlets. For any given resource a method that returns a 405 status code will not be listed in the Allow header and a method listed in the Allow header will not return a 405 status code. (markt)

Coyote

  • Add: 60276: Implement GZIP compression support for responses served over HTTP/2. (markt)
  • Fix: Do not call onDataAvailable without any data to read. (remm)
  • Fix: Correctly handle EOF when ServletInputStream.isReady() is called. (markt)
  • Fix: 61886: Log errors on non-container threads at DEBUG rather than INFO. The exception will be made available to the application via the asynchronous error handling mechanism. (markt)
  • Fix: 61914: Possible NPE with Java 9 when creating a SSL engine. Patch submitted by Evgenij Ryazanov. (remm)
  • Fix: 61918: Fix connectionLimitLatch counting when closing an already closed socket. Based on a patch by Ryan Fong. (remm)
  • Add: Add support for the OpenSSL ARIA ciphers to the OpenSSL to JSSE cipher mapping. (markt)
  • Fix: 61932: Allow a call to AsyncContext.dispatch() to terminate non-blocking I/O. (markt)
  • Fix: 61948: Improve the handling of malformed ClientHello messages in the code that extracts the SNI information from a TLS handshake for the JSSE based NIO and NIO2 connectors. (markt)
  • Fix: Fix NIO2 handshaking with a full input buffer. (remm)
  • Add: Return a simple, plain text error message if a client attempts to make a plain text HTTP connection to a TLS enabled NIO or NIO2 Connector. (markt)

Jasper

  • Fix: 61854: When using sets and/or maps in EL expressions, ensure that Jasper correctly parses the expression. Patch provided by Ricardo Martin Camarero. (markt)
  • Fix: Improve the handling of methods with varargs in EL expressions. In particular, the calling of a varargs method with no parameters now works correctly. Based on a patch by Nitkalya (Ing) Wiriyanuparb. (markt)
  • Fix: 61945: Fix prototype mode used to compile tags. (remm)

Web applications

  • Add: 61223: Add the mbeans-descriptors.dtd file to the custom MBean documentation so users have a reference to use when constructing mbeans-descriptors.xml files for custom components. (markt)
  • Add: 61565: Add the ability to trigger a reloading of TLS host configuration (certificate and key files, server.xml is not re-parsed) via the Manager web application. (markt)
  • Add: 61566: Expose the currently in use certificate chain and list of trusted certificates for all virtual hosts configured using the JSSE style (keystore) TLS configuration via the Manager web application. (markt)
  • Fix: Partial fix for 61886. Ensure that multiple threads do not attempt to complete the AsyncContext if an I/O error occurs in the stock ticker example Servlet. (markt)
  • Fix: 61886: Prevent ConcurrentModificationException when running the asynchronous stock ticker in the examples web application. (markt)
  • Fix: 61886: Prevent NullPointerException and other errors if the stock ticker example is running when the examples web application is stopped. (markt)
  • Fix: 61910: Clarify the meaning of the allowLinking option in the documentation web application. (markt)
  • Add: Add OCSP configuration information to the SSL How-To. Patch provided by Marek Czernek. (markt)

jdbc-pool

  • Fix: 61312: Prevent NullPointerExceptionn when using the statement cache of connection that has been closed. (kfujino)

Other

  • Fix: Add an additional system property for the system property replacement. (remm)
  • Fix: Add missing SHA-512 hash for release artifacts to the build script. (markt)
  • Update: Update the internal fork of Commons Pool 2 to 2.4.3. (markt)
  • Update: Update the internal fork of Commons DBCP 2 to 8a71764 (2017-10-18) to pick up some bug fixes and enhancements. (markt)
  • Update: Update the internal fork of Commons FileUpload to 6c00d57 (2017-11-23) to pick up some code clean-up. (markt)
  • Update: Update the internal fork of Commons Codec to r1817136 to pick up some code clean-up. (markt)
  • Fix: The native source bundles (for Commons Daemon and Tomcat Native) are no longer copied to the bin directory for the deploy target. They are now only copied to the bin directory for the release target. (markt)

2017-11-30 Tomcat 9.0.2 (markt)

Catalina

  • Fix: Fix possible SecurityException when using TLS related request attributes. (markt)
  • Fix: 61597: Extend the StandardJarScanner to scan JARs on the module path when running on Java 9 and class path scanning is enabled. (markt)
  • Fix: 61601: Add support for multi-release JARs in JAR scanning and web application class loading. (markt)
  • Fix: 61681: Allow HTTP/2 push when using request wrapping. (remm)
  • Add: Provide the SessionInitializerFilter that can be used to ensure that an HTTP session exists when initiating a WebSocket connection. Patch provided by isapir. (markt)
  • Fix: 61682: When re-prioritising HTTP/2 streams, ensure that both parent and children fields are correctly updated to avoid a possible StackOverflowError. (markt)
  • Fix: Improve concurrency by reducing the scope of the synchronisation for javax.security.auth.message.config.AuthConfigFactory in the JASPIC API implementation. Based on a patch by Pavan Kumar. (markt)
  • Fix: Avoid a possible NullPointerException when timing out AsyncContext instances during shut down. (markt)
  • Fix: 61777: Avoid a NullPointerException when detaching a JASPIC RegistrationListener. Patch provided by Lazar. (markt)
  • Fix: 61778: Correct the return value when detaching a JASPIC RegistrationListener. Patch provided by Lazar. (markt)
  • Fix: 61779: Avoid a NullPointerException when a null RegistrationListener is passed to AuthConfigFactory.getConfigProvider(). Patch provided by Lazar. (markt)
  • Fix: 61780: Only include the default JASPIC registration ID in the return value for a call to AuthConfigFactory.getRegistrationIDs() if a RegistrationContext has been registered using the default registration ID. Patch provided by Lazar. (markt)
  • Fix: 61781: Enable JASPIC provider registrations to be persisted when the layer and/or application context are null. Patch provided by Lazar. (markt)
  • Fix: 61782: When calling AuthConfigFactory.doRegisterConfigProvider() and the requested JASPIC config provider class is found by the web application class loader, do not attempt to load the class with the class loader that loaded the JASPIC API. Patch provided by Lazar. (markt)
  • Fix: 61783: When calling AuthConfigFactory.removeRegistration() and the registration is persistent, it should be removed from the persistent store. Patch provided by Lazar. (markt)
  • Fix: 61784: Correctly handle the case when AuthConfigFactoryImpl.registerConfigProvider() is called with a provider name of null. Patch provided by Lazar. (markt)
  • Add: 61795: Add a property to the Authenticator implementations to enable a custom JASPIC CallbackHandler to be specified. Patch provided by Lazar. (markt)

Coyote

  • Fix: 61568: Avoid a potential SecurityException when using the NIO2 connector and a new thread is added to the pool. (markt)
  • Fix: 61583: Correct a further regression in the fix to enable the use of Java key stores that contained multiple keys that did not all have the same password. This fixes PKCS11 key store handling with multiple keys selected with an alias. (markt)
  • Fix: Improve NIO2 syncing for async IO operations. (remm)
  • Add: Sendfile support for HTTP/2 and NIO2. (remm)
  • Fix: Reduce default HTTP/2 stream concurrent execution within a connection from 200 to 20. (remm)
  • Fix: 61668: Avoid a possible NPE when calling AbstractHttp11Protocol.getSSLProtocol(). (markt)
  • Fix: 61673: Avoid a possible ConcurrentModificationException when working with the streams associated with a connection. (markt)
  • Fix: 61719: Avoid possible NPE calling InputStream.setReadListener with HTTP/2. (remm)
  • Fix: 61736: Improve performance of NIO connector when clients leave large time gaps between network packets. Patch provided by Zilong Song. (markt)
  • Fix: 61740: Correct an off-by-one error in the Hpack header index validation that caused intermittent request failures when using HTTP/2. (markt)

Jasper

  • Fix: 61604: Fix SMAP generation for JSPs that generate no output. (markt)
  • Fix: 61816: Invalid expressions in attribute values or template text should trigger a translation (compile time) error, not a run time error. (markt)

WebSocket

  • Fix: 61604: Add support for authentication in the websocket client. Patch submitted by J Fernandez. (remm)

Web applications

  • Fix: Correct Javadoc links to point to Java SE 8 and Java EE 8. (markt)
  • Fix: Enable Javadoc to be built with Java 9. (markt)
  • Fix: 61603: Add XML filtering for the status servlet output where needed. (remm)
  • Fix: Correct the description of how the CGI servlet maps a request to a script in the CGI How-To. (markt)

Tribes

  • Fix: Fix incorrect behavior that attempts to resend channel messages more than the actual setting value of maxRetryAttempts. (kfujino)
  • Fix: Ensure that the remaining Sender can send channel messages by avoiding unintended ChannelException caused by comparing the number of failed members and the number of remaining Senders. (kfujino)
  • Fix: Ensure that remaining SelectionKeys that were not handled by throwing a ChannelException during SelectionKey processing are handled. (kfujino)

Other

  • Fix: Improve the fix for 61439 and exclude the JPA, JAX-WS and EJB annotations completely from the Tomcat distributions. (markt)
  • Fix: Improve handling of endorsed directories. The endorsed directory mechanism will only be used if the JAVA_ENDORSED_DIRS system property is explicitly set or if $CATALINA_HOME/endorsed exists. When running on Java 9, any such attempted use of the endorsed directory mechanism will trigger an error and Tomcat will fail to start. (rjung)
  • Add: 51496: When using the Windows installer, check if the requested service name already exists and, if it does, prompt the user to select an alternative service name. Patch provided by Ralph Plawetzki. (markt)
  • Fix: 61590: Enable service.bat to recognise when JAVA_HOME is configured for a Java 9 JDK. (markt)
  • Fix: 61598: Update the Windows installer to search the new (as of Java 9) registry locations when looking for a JRE. (markt)
  • Add: Add generation of a SHA-512 hash for release artifacts to the build script. (markt)
  • Fix: 61658: Update MIME mappings for fonts to use font/* as per RFC8081. (markt)
  • Update: Update the packaged version of the Tomcat Native Library to 1.2.16 to pick up the latest Windows binaries built with APR 1.6.3 and OpenSSL 1.0.2m. (markt)
  • Update: Update the NSIS Installer used to build the Windows installer to version 3.02.1. (kkolinko)
  • Update: Update the Windows installer to use "The Apache Software Foundation" as the Publisher when Tomcat is displayed in the list of installed applications in Microsoft Windows. (kkolinko)
  • Fix: 61803: Remove outdated SSL information from the Security documentation. (remm)

2017-09-30 Tomcat 9.0.1 (markt)

Catalina

  • Fix: Use the correct path when loading the JVM logging.properties file for Java 9. (rjung)
  • Fix: Add additional validation to the resource handling required to fix CVE-2017-12617 on Windows. The checks were being performed elsewhere but adding them to the resource handling ensures that the checks are always performed. (markt)

Other

  • Fix: 61563: Correct typos in Spanish translation. Patch provided by Gonzalo Vásquez. (csutherl)

not released Tomcat 9.0.0 (markt)

Catalina

  • Fix: 61542: Fix CVE-2017-12617 and prevent JSPs from being uploaded via a specially crafted request when HTTP PUT was enabled. (markt)
  • Fix: 61554: Exclude test files in unusual encodings and markdown files intended for display in GitHub from RAT analysis. Patch provided by Chris Thistlethwaite. (markt)

Coyote

  • Add: 60762: Add the ability to make changes to the TLS configuration of a connector at runtime without having to restart the Connector. (markt)
  • Add: Add an option to reject requests that contain HTTP headers with invalid (non-token) header names with a 400 response and reject such requests by default. (markt)
  • Fix: Implement the requirements of RFC 7230 (and RFC 2616) that HTTP/1.1 requests must include a Host header and any request that does not must be rejected with a 400 response. (markt)
  • Fix: Implement the requirements of RFC 7230 that any HTTP/1.1 request that specifies a host in the request line, must specify the same host in the Host header and that any such request that does not, must be rejected with a 400 response. This check is optional but enabled by default. It may be disabled with the allowHostHeaderMismatch attribute of the Connector. (markt)
  • Fix: Implement the requirements of RFC 7230 that any HTTP/1.1 request that contains multiple Host headers is rejected with a 400 response. (markt)
  • Update: Add a way to set the property source in embedded mode. (remm)
  • Fix: 61557: Correct a further regression in the fix to enable the use of Java key stores that contain multiple keys that do not all have the same password. The regression broke support for some FIPS compliant key stores. (markt)

jdbc-pool

  • Fix: 61545: Correctly handle invocations of methods defined in the PooledConnection interface when using pooled XA connections. Patch provided by Nils Winkler. (markt)

Other

  • Fix: Update fix for 59904 so that values less than zero are accepted instead of throwing a NegativeArraySizeException. (remm)
  • Add: Complete the implementation of the Servlet 4.0 specification. (markt)

2017-09-19 Tomcat 9.0.0.M27 (markt)

Catalina

  • Fix: Before generating an error page in the ErrorReportValve, check to see if I/O is still permitted for the associated connection before generating the error page so that the page generation can be skipped if the page is never going to be sent. (markt)
  • Add: 61189: Add the ability to set environment variables for individual CGI scripts. Based on a patch by jm009. (markt)
  • Fix: 61210: When running under a SecurityManager, do not print a warning about not being able to read a logging configuration file when that file does not exist. (markt)
  • Add: 61280: Add RFC 7617 support to the BasicAuthenticator. Note that the default configuration does not change the existing behaviour. (markt)
  • Fix: 61424: Avoid a possible StackOverflowError when running under a SecurityManager and using Subject.doAs(). (markt)
  • Add: When running under Java 9 or later, and the urlCacheProtection option of the JreMemoryLeakPreventionListener is enabled, use the API added in Java 9 to only disable the caching for JAR URL connections. (markt)
  • Add: 61489: When using the CGI servlet, make the generation of command line arguments from the query string (as per section 4.4 of RFC 3875) optional and disabled by default. Based on a patch by jm009. (markt)
  • Fix: 61503: This corrects a potential regression in the fix for 60940 with an alternative solution that adds the JarEntry objects normally skipped by a JarInputStream only if those entries exist. (markt)

Coyote

  • Update: The minimum required Tomcat Native version has been increased to 1.2.14. This version includes a new API needed for correct client certificate support when using a Java connector with OpenSSL TLS implementation and support for the SSL_CONF OpenSSL API. (rjung)
  • Add: Add support for the OpenSSL SSL_CONF API when using TLS with OpenSSL implementation. It can be used by adding OpenSSLConf elements underneath SSLHostConfig. The new element contains a list of OpenSSLConfCmd elements, each with the attributes name and value. (rjung)
  • Fix: When using a Java connector in combination with the OpenSSL TLS implementation, do not configure each SSL connection object via the OpenSSLEngine. For OpenSSL the SSL object inherits its settings from the SSL_CTX which we have already configured. (rjung)
  • Fix: When using JSSE TLS configuration with the OpenSSL implementation and client certificates: include client CA subjects in the TLS handshake so that the client can choose an appropriate client certificate to present. (rjung)
  • Fix: If an invalid option is specified for the certificateVerification attribute of an SSLHostConfig element, treat it as required which is the most secure / restrictive option in addition to reporting the configuration error. (markt)
  • Fix: Improve the handling of client disconnections during the TLS renegotiation handshake. (markt)
  • Fix: Prevent exceptions being thrown during normal shutdown of NIO connections. This enables TLS connections to close cleanly. (markt)
  • Fix: Fix possible race condition when setting IO listeners on an upgraded connection. (remm)
  • Fix: Ensure that the APR/native connector uses blocking I/O for TLS renegotiation. (markt)
  • Fix: 48655: Enable Tomcat to shutdown cleanly when using sendfile, the APR/native connector and a multi-part download is in progress. (markt)
  • Fix: 58244: Handle the case when OpenSSL resumes a TLS session using a ticket and the full client certificate chain is not available. In this case the client certificate without the chain will be presented to the application. (markt)
  • Fix: Improve the warning message when JSSE and OpenSSL configuration styles are mixed on the same SSLHostConfig. (markt)
  • Fix: 61415: Fix TLS renegotiation with OpenSSL based connections and session caching. (markt)
  • Fix: Delay checking that the configured attributes for an SSLHostConfig instance are consistent with the configured SSL implementation until Connector start to avoid incorrect warnings when the SSL implementation changes during initialisation. (markt)
  • Fix: 61450: Fix default key alias algorithm. (remm)
  • Fix: 61451: Correct a regression in the fix to enable the use of Java key stores that contained multiple keys that did not all have the same password. The regression broke support for any key store that did not store keys in PKCS #8 format such as hardware key stores and Windows key stores. (markt)

WebSocket

  • Fix: 60523: Reduce the number of packets used to send WebSocket messages by not flushing between the header and the payload when the two are written together. (markt)
  • Fix: 61491: When using the permessage-deflate extension, correctly handle the sending of empty messages after non-empty messages to avoid the IllegalArgumentException. (markt)

Web applications

  • Fix: Show connector cipher list in the manager web application in the correct cipher order. (rjung)

Tribes

  • Fix: To avoid unexpected session timeout notification from backup session, update the access time when receiving the map member notification message. (kfujino)
  • Fix: Add member info to the log message when the failure detection check fails in TcpFailureDetector. (kfujino)
  • Fix: Avoid Ping timeout until the added map member by receiving MSG_START message is completely started. (kfujino)
  • Fix: When sending a channel message, make sure that the Sender has connected. (kfujino)
  • Fix: Correct the backup node selection logic that node 0 is returned twice consecutively. (kfujino)
  • Fix: Fix race condition of responseMap in RpcChannel. (kfujino)

jdbc-pool

  • Fix: 61391: Ensure that failed queries are logged if the SlowQueryReport interceptor is configured to do so and the connection has been abandoned. Patch provided by Craig Webb. (markt)
  • Fix: 61425: Ensure that transaction of idle connection has terminated when the testWhileIdle is set to true and defaultAutoCommit is set to false. Patch provided by WangZheng. (kfujino)

Other

  • Fix: 61419: Replace a Unix style comment in the DOS bat file catalina.bat with the correct rem markup. (rjung)
  • Fix: 61439: Remove the Java Annotation API classes from tomcat-embed-core.jar and package them in a separate JAR in the embedded distribution to provide end users with greater flexibility to handle potential conflicts with the JRE and/or other JARs. (markt)
  • Fix: 61441: Improve the detection of JAVA_HOME by the daemon.sh script when running on a platform where Java has been installed from an RPM. (rjung)
  • Update: Update the packaged version of the Tomcat Native Library to 1.2.14 to pick up the latest Windows binaries built with APR 1.6.2 and OpenSSL 1.0.2l. (markt)
  • Update: 61599: Update to Commons Daemon 1.1.0 for improved Java 9 support. (markt)

2017-08-08 Tomcat 9.0.0.M26 (markt)

Catalina

  • Fix: Correct multiple regressions in the fix for 49464 that could corrupt static content served by the DefaultServlet.(markt)
  • Fix: Correct a bug in the PushBuilder implementation that meant push URLs containing %nn sequences were not correctly decoded. Identified by FindBugs. (markt)
  • Add: 61164: Add support for the %X pattern in the AccessLogValve that reports the connection status at the end of the request. Patch provided by Zemian Deng. (markt)
  • Fix: 61351: Correctly handle %nn decoding of URL patterns in web.xml and similar locations that may legitimately contain characters that are not permitted by RFC 3986. (markt)
  • Add: 61366: Add a new attribute, localDataSource, to the JDBCStore that allows the Store to be configured to use a DataSource defined by the web application rather than the default of using a globally defined DataSource. Patch provided by Jonathan Horowitz. (markt)

Coyote

  • Fix: 61086: Ensure to explicitly signal an empty request body for HTTP 205 responses. Additional fix to r1795278. Based on a patch provided by Alexandr Saperov. (violetagg)
  • Update: 61345: Add a server listener that can be used to do system property replacement from the property source configured in the digester. (remm)
  • Add: Add additional logging to record problems that occur while waiting for the NIO pollers to stop during the Connector stop process. (markt)

Jasper

  • Fix: 61364: Ensure that files are closed after detecting encoding of JSPs so that files do not remain locked by the file system. (markt)

WebSocket

  • Add: 57767: Add support to the WebSocket client for following redirects when attempting to establish a WebSocket connection. Patch provided by J Fernandez. (markt)

2017-07-28 Tomcat 9.0.0.M25 (markt)

Catalina

  • Fix: Performance improvements for service loader look-ups (and look-ups of other class loader resources) when the web application is deployed in a packed WAR file. (markt)
  • Fix: 60963: Add ExtractingRoot, a new WebResourceRoot implementation that extracts JARs to the work directory for improved performance when deploying packed WAR files. (markt)
  • Fix: 61253: Add warn message when Digester.updateAttributes throws an exception instead of ignoring it. (csutherl)
  • Fix: Correct a further regression in the fix for 49464 that could cause an byte order mark character to appear at the start of content included by the DefaultServlet. (markt)
  • Fix: 61313: Make the read timeout configurable in the JNDIRealm and ensure that a read timeout will result in an attempt to fail over to the alternateURL. Based on patches by Peter Maloney and Felix Schumacher. (markt)

Web applications

  • Fix: Correct the documentation for how StandardRoot is configured. (markt)

Other

  • Fix: 61316: Fix corruption of UTF-16 encoded source files in released source distributions. (markt)

not released Tomcat 9.0.0.M24 (markt)

Catalina

  • Add: 52924: Add support for a Tomcat specific deployment descriptor, /WEB-INF/tomcat-web.xml. This descriptor has an identical format to /WEB-INF/web.xml. The Tomcat descriptor takes precedence over any settings in conf/web.xml but does not take precedence over any settings in /WEB-INF/web.xml. (markt)
  • Fix: 61232: When log rotation is disabled only one separator will be used when generating the log file name. For example if the prefix is catalina. and the suffix is .log then the log file name will be catalina.log instead of catalina..log. Patch provided by Katya Stoycheva. (violetagg)
  • Fix: 61264: Correct a regression in the refactoring to use Charset rather than String to store request character encoding that prevented getReader() throwing an UnsupportedEncodingException if the user agent specifies an unsupported character encoding. (markt)
  • Fix: Correct a regression in the fix for 49464 that could cause an incorrect Content-Length header to be sent by the DefaultServlet if the encoding of a static is not consistent with the encoding of the response. (markt)

Coyote

  • Fix: Enable TLS connectors to use Java key stores that contain multiple keys where each key has a separate password. Based on a patch by Frank Taffelt. (markt)
  • Fix: Improve the handling of HTTP/2 stream resets due to excessive headers when a continuation frame is used. (markt)

Jasper

  • Add: 53031: Add support for the fork option when compiling JSPs with the Jasper Ant task and javac. (markt)

Other

  • Add: 52791: Add the ability to set the defaults used by the Windows installer from a configuration file. Patch provided by Sandra Madden. (markt)

not released Tomcat 9.0.0.M23 (markt)

Catalina

  • Fix: 49464: Improve the Default Servlet's handling of static files when the file encoding is not compatible with the required response encoding. (markt)
  • Fix: 61214: Remove deleted attribute servlets from the Context MBean description. Patch provided by Alexis Hassler. (markt)
  • Fix: 61215: Correctly define addConnectorPort and invalidAuthenticationWhenDeny in the mbean-descriptors.xml file for the org.apache.catalina.valves package so that the attributes are accessible via JMX. (markt)
  • Fix: 61216: Improve layout for CompositeData and TabularData when viewing via the JMX proxy servlet. Patch provided by Alexis Hassler. (markt)
  • Fix: Additional permission for deleting files is granted to JULI as it is required by FileHandler when running under a Security Manager. The thread that cleans the log files is marked as daemon thread. (violetagg)
  • Fix: 61229: Correct a regression in 9.0.0.M21 that broke WebDAV handling for resources with names that included a & character. (markt)

Coyote

  • Fix: Restore the ability to configure support for SSLv3. Enabling this protocol will trigger a warning in the logs since it is known to be insecure. (markt)
  • Add: Add LoadBalancerDrainingValve, a Valve designed to reduce the amount of time required for a node to drain its authenticated users. (schultz)
  • Fix: Do not log a warning when a null session is returned for an OpenSSL based TLS session since this is expected when session tickets are enabled. (markt)
  • Fix: When the access log valve logs a TLS related request attribute and the NIO2 connector is used with OpenSSL, ensure that the TLS attributes are available to the access log valve when the connection is closing. (markt)
  • Fix: 60461: Sync SSL session access for the APR connector. (remm)
  • Fix: 61224: Make the GlobalRequestProcessor MBean attributes read-only. Patch provided by Alexis Hassler. (markt)

Jasper

  • Fix: 49176: When generating JSP runtime error messages that quote the relevant JSP source code, switch from using the results of the JSP page parsing process to using the JSR 045 source map data to identify the correct part of the JSP source from the stack trace. This significantly reduces the memory footprint of Jasper in development mode, provides a small performance improvement for error page generation and enables source quotes to continue to be provided after a Tomcat restart. (markt)

Web applications

  • Fix: Remove references to the Loader attribute searchExternalFirst from the documentation since the attribute is no longer supported. (markt)

Tribes

  • Add: 51513: Add support for the compressionMinSize attribute to the GzipInterceptor, add optional statistics collection and expose the Interceptor over JMX. Based on a patch by Christian Stöber. (markt)
  • Add: 61127Allow human-readable names for channelSendOptions and mapSendOptions. Patch provided by Igal Sapir. (schultz)

Other

  • Code: Restore the local definition of the web service annotations since the JRE provided versions are deprecated and Java 9 does not provide them by default. (markt)
  • Fix: Add necessary Java 9 configuration options to the startup scripts to prevent warnings being generated on web application stop. (markt)

2017-06-26 Tomcat 9.0.0.M22 (markt)

Catalina

  • Fix: 48543: Add the option to specify an alternative file name for the catalina.config system property. Also document that relative, as well as absolute, URLs are permitted. (markt)
  • Fix: 61072: Respect the documentation statements that allow using the platform default secure random for session id generation. (remm)
  • Fix: Correct the javadoc for o.a.c.connector.CoyoteAdapter#parseSessionCookiesId. Patch provided by John Andrew (XUZHOUWANG) via Github. (violetagg)
  • Fix: 61101: CORS filter should set Vary header in response. Submitted by Rick Riemer. (remm)
  • Add: 61105: Add a new JULI FileHandler configuration for specifying the maximum number of days to keep the log files. By default the log files will be kept 90 days as configured in logging.properties. (violetagg)
  • Update: Update the Servlet 4.0 implementation to add support for setting trailer fields for HTTP responses. (markt)
  • Fix: 61125: Ensure that WarURLConnection returns the correct value for calls to getLastModified() as this is required for the correct detection of JSP modifications when the JSP is packaged in a WAR file. (markt)
  • Fix: Improve the SSLValve so it is able to handle client certificate headers from Nginx. Based on a patch by Lucas Ventura Carro. (markt)
  • Fix: 61134: Do not use '[' and ']' symbols around substituted text fragments when generating the default error pages. Patch provided by Katya Todorova. (violetagg)
  • Fix: 61154: Allow the Manager and Host Manager web applications to start by default when running under a security manager. This was accomplished by adding a custom permission, org.apache.catalina.security.DeployXmlPermission, that permits an application to use a META-INF/context.xml file and then granting that permission to the Manager and Host Manager. (markt)
  • Fix: 61173: Polish the javadoc for o.a.catalina.startup.Tomcat. Patch provided by peterhansson_se. (violetagg)
  • Add: A new configuration property crawlerIps is added to the o.a.catalina.valves.CrawlerSessionManagerValve. Using this property one can specify a regular expression that will be used to identify crawlers based on their IP address. Based on a patch provided by Tetradeus. (violetagg)
  • Fix: 61180: Log a warning message rather than an information message if it takes more than 100ms to initialised a SecureRandom instance for a web application to use to generate session identifiers. Patch provided by Piotr Chlebda. (markt)
  • Fix: 61185: When an asynchronous request is dispatched via AsyncContext.dispatch() ensure that getRequestURI() for the dispatched request matches that of the original request. (markt)
  • Fix: 61197: Ensure that the charset name used in the Content-Type header has exactly the same form as that provided by the application. This reverts a behavioural change in 9.0.0.M21 that caused problems for some clients. (markt)
  • Fix: 61201: Ensure that the SCRIPT_NAME environment variable for CGI executables is populated in a consistent way regardless of how the CGI servlet is mapped to a request. (markt)
  • Fix: Ensure to send a space between trailer field name and field value for HTTP responses trailer fields. (huxing)

Coyote

  • Fix: 61086: Explicitly signal an empty request body for HTTP 205 responses. (markt)
  • Fix: 61120: Do not ignore path parameters when processing HTTP/2 requests. (markt)
  • Fix: Revert a change introduced in the fix for bug 60718 that changed the status code recorded in the access log when the client dropped the connection from 200 to 500. (markt)
  • Fix: Make asynchronous error handling more robust. In particular ensure that onError() is called for any registered AsyncListeners after an I/O error on a non-container thread. (markt)
  • Fix: Add additional syncs to the SSL session object provided by the OpenSSL engine so that a concurrent destruction cannot cause a JVM crash. (remm)

Jasper

  • Fix: 44787: Improve error message when JSP compiler configuration options are not valid. (markt)
  • Add: 45931: Extend Jasper's timeSpaces option to add support for single which replaces template text that consists entirely of whitespace with a single space character. Based on a patch by Meetesh Karia. (markt)
  • Fix: 53011: When pre-compiling with JspC, report all compilation errors rather than stopping after the first error. A new option -failFast can be used to restore the previous behaviour of stopping after the first error. Based on a patch provided by Marc Pompl. (markt)
  • Fix: 61137: j.s.jsp.tagext.TagLibraryInfo#uri and j.s.jsp.tagext.TagLibraryInfo#prefix fields should not be final. Patch provided by Katya Todorova. (violetagg)

WebSocket

  • Fix: Correct the log message when a MessageHandler for PongMessage does not implement MessageHandler.Whole. (rjung)
  • Fix: Improve thread-safety of Futures used to report the result of sending WebSocket messages. (markt)
  • Fix: 61183: Correct a regression in the previous fix for 58624 that could trigger a deadlock depending on the locking strategy employed by the client code. (markt)

Web applications

  • Fix: Better document the meaning of the trimSpaces option for Jasper. (markt)
  • Fix: 61150: Configure the Manager and Host-Manager web applications to permit serialization and deserialization of CRSFPreventionFilter related session objects to avoid warning messages and/or stack traces on web application stop and/or start when running under a security manager. (markt)
  • Fix: Correct the TLS configuration documentation to remove SSLv2 and SSLv3 from the list of supported protocols. (markt)

Other

  • Add: 45832: Add HTTP DIGEST authentication support to the Catalina Ant tasks used to communicate with the Manager application. (markt)
  • Fix: 45879: Add the RELEASE-NOTES file to the root of the installation created by the Tomcat installer for Windows to make it easier for users to identify the installed Tomcat version. (markt)
  • Fix: 61055: Clarify the code comments in the rewrite valve to make clear that there are no plans to provide proxy support for this valve since Tomcat does not have proxy capabilities. (markt)
  • Fix: 61076: Document the altDDName attribute for the Context element. (markt)
  • Fix: Correct typo in Jar Scan Filter Configuration Reference. Issue reported via comments.apache.org. (violetagg)
  • Fix: Correct the requirement for the minimum Java SE version in Application Developer's Guide. Issue reported via comments.apache.org. (violetagg)
  • Fix: 61145: Add missing @Documented annotation to annotations in the annotations API. Patch provided by Katya Todorova. (markt)
  • Fix: 61146: Add missing lookup() method to @EJB annotation in the annotations API. Patch provided by Katya Todorova. (markt)
  • Fix: Correct typo in Context Container Configuration Reference. Patch provided by Katya Todorova. (violetagg)

2017-05-10 Tomcat 9.0.0.M21 (markt)

General

  • Add: Allow to exclude JUnit test classes using the build property test.exclude and document the property in BUILDING.txt. (rjung)

Catalina

  • Fix: Review those places where Tomcat re-encodes a URI or URI component and ensure that that correct encoding (path differs from query string) is applied and that the encoding is applied consistently. (markt)
  • Fix: Avoid a NullPointerException when reading attributes for a initialised HTTP connector where TLS is enabled. (markt)
  • Fix: Always quote the hostName of an SSLHostConfig element when using it as part of the JMX object name to avoid errors that prevent the associated TLS connector from starting if a wild card hostName is configured (because * is a reserved character for JMX object names). (markt)
  • Update: Update the default URIEncoding for a Connector to UTF-8 as required by the Servlet 4.0 specification. (markt)
  • Code: Switch to using Charset rather than String to store encoding settings (including for configuration and for the Content-Type header) to reduce the number of places the associated Charset needs to be looked up. (markt)
  • Fix: Use a more reliable mechanism for the DefaultServlet when determining if the current request is for custom error page or not. (markt)
  • Fix: Ensure that when the Default or WebDAV servlets process an error dispatch that the error resource is processed via the doGet() method irrespective of the method used for the original request that triggered the error. (markt)
  • Fix: If a static custom error page is specified that does not exist or cannot be read, ensure that the intended error status is returned rather than a 404 or 403. (markt)
  • Fix: When the WebDAV servlet is configured and an error dispatch is made to a custom error page located below WEB-INF, ensure that the target error page is displayed rather than a 404 response. (markt)
  • Update: Update the Servlet 4.0 implementation to add support for obtaining trailer fields from chunked HTTP requests. (markt)
  • Add: 61047: Add MIME mapping for woff2 fonts in the default web.xml. Patch provided by Justin Williamson. (violetagg)
  • Fix: Correct the logic that selects the encoding to use to decode the query string in the SSIServletExternalResolver so that the useBodyEncodingForURI attribute of the Connector is correctly taken into account. (markt)
  • Fix: Within the Expires filter, make the content type value specified with the ExpiresByType parameter, case insensitive. (markt)

Coyote

  • Fix: When a TrustManager is configured that does not support certificateVerificationDepth only log a warning about that lack of support when certificateVerificationDepth has been explicitly set. (markt)
  • Fix: 60970: Extend the fix for large headers to push requests. (markt)
  • Fix: Do not include a Date header in HTTP/2 responses with status codes less than 200. (markt)
  • Fix: When sending an HTTP/2 push promise with the NIO2 connector, the pushed stream ID should only be included with the initial push promise frame and not any subsequent continuation frames. (markt)

Jasper

  • Fix: When no BOM is present and an encoding is detected, do not skip the bytes used to detect the encoding since they are not part of a BOM. (markt)
  • Update: 61057: Update to Eclipse JDT Compiler 4.6.3. (violetagg)
  • Fix: 61065: Ensure that once the class is resolved by javax.el.ImportHandler#resolveClass it will be cached with the proper name. (violetagg)

WebSocket

  • Add: Introduce new API o.a.tomcat.websocket.WsSession#suspend/ o.a.tomcat.websocket.WsSession#resume that can be used to suspend/resume reading of the incoming messages. (violetagg)
  • Fix: 61003: Ensure the flags for reading/writing in o.a.t.websocket.AsyncChannelWrapperSecure are correctly reset even if some exceptions occurred during processing. (markt/violetagg)

Web Applications

  • Add: Add documents for maxIdleTime attribute to Channel Receiver docs. (kfujino)

Tribes

  • Add: Add features to get the statistics of the thread pool of the Receiver component and MessageDispatchInterceptor. These statistics information can be acquired via JMX. (kfujino)
  • Add: Add maxIdleTime attribute to NioReceiverMBean in order to expose to JMX. (kfujino)
  • Add: Add JMX support for Channel Interceptors. The Interceptors that implement JMX support are TcpFailureDetector, ThroughputInterceptor, TcpPingInterceptor, StaticMembershipInterceptor, MessageDispatchInterceptor and DomainFilterInterceptor. (kfujino)

Other

  • Add: Modify the Ant build script used to publish to a Maven repository so that it no longer requires artifacts to be GPG signed. This is make it possible for the CI system to upload snapshot builds to the ASF Maven repository. (markt)

2017-04-18 Tomcat 9.0.0.M20 (markt)

Catalina

  • Update: Update the Servlet 4.0 API implementation to reflect the change in method name from getPushBuilder() to newPushBuilder(). (markt)
  • Fix: Correct various edge cases in the new HTTP Host header validation parser. Patch provided by Katya Todorova. (martk)
  • Fix: Correct a regression in the X to comma refactoring that broke JMX operations that take parameters. (markt)
  • Fix: Avoid a NullPointerException when reading attributes for a running HTTP connector where TLS is not enabled. (markt)
  • Fix: 47214: Refactor code so that explicitly referenced inner classes are given explicit names rather than being anonymous. (markt)
  • Fix: 59825: Log a message that lists the components in the processing chain that do not support async processing when a call to ServletRequest.startAsync() fails. (markt)
  • Fix: 60940: Improve the handling of the META-INF/ and META-INF/MANIFEST.MF entries for Jar files located in /WEB-INF/lib when running a web application from a packed WAR file. (markt)
  • Fix: Pre-load the ExceptionUtils class. Since the class is used extensively in error handling, it is prudent to pre-load it to avoid any failure to load this class masking the true problem during error handling. (markt)
  • Fix: Avoid potential NullPointerExceptions rel