This is an automated email from the ASF dual-hosted git repository.
rmaucher pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new 5cd2588520 Fix the few actually legitimate issues from CodeQL
5cd2588520 is described below
commit 5cd25885200b41dceef0018c491f4e54a85225d8
Author: remm <[email protected]>
AuthorDate: Wed May 27 15:06:10 2026 +0200
Fix the few actually legitimate issues from CodeQL
Everything else is invalid, false positive, intentional, and so on.
---
java/jakarta/servlet/jsp/tagext/TagData.java | 14 +++-
java/org/apache/catalina/connector/Request.java | 2 +-
java/org/apache/catalina/core/StandardWrapper.java | 5 +-
.../catalina/mbeans/MemoryUserDatabaseMBean.java | 2 +-
.../catalina/session/PersistentManagerBase.java | 86 ++++++++++------------
.../tribes/membership/McastServiceImpl.java | 10 +--
.../catalina/tribes/transport/PooledSender.java | 2 +-
java/org/apache/jasper/compiler/Validator.java | 2 +-
.../dbcp/pool2/impl/DefaultPooledObject.java | 10 +++
.../tomcat/util/modeler/NotificationInfo.java | 20 ++---
java/org/apache/tomcat/util/net/NioEndpoint.java | 2 +-
.../tomcat/websocket/WsRemoteEndpointImplBase.java | 4 +-
12 files changed, 89 insertions(+), 70 deletions(-)
diff --git a/java/jakarta/servlet/jsp/tagext/TagData.java
b/java/jakarta/servlet/jsp/tagext/TagData.java
index 9c9f6fff40..fcdf94c4c6 100644
--- a/java/jakarta/servlet/jsp/tagext/TagData.java
+++ b/java/jakarta/servlet/jsp/tagext/TagData.java
@@ -136,7 +136,19 @@ public class TagData implements Cloneable {
return attributes.keys();
}
+ @Override
+ public TagData clone() {
+ try {
+ TagData clone = (TagData) super.clone();
+ clone.attributes = new Hashtable<>(attributes);
+ return clone;
+ } catch (CloneNotSupportedException e) {
+ // Should never happen
+ throw new InternalError(e);
+ }
+ }
+
// private data
- private final Hashtable<String,Object> attributes; // the tagname/value map
+ private Hashtable<String,Object> attributes; // the tagname/value map
}
diff --git a/java/org/apache/catalina/connector/Request.java
b/java/org/apache/catalina/connector/Request.java
index 209a693445..ae19b2e1d6 100644
--- a/java/org/apache/catalina/connector/Request.java
+++ b/java/org/apache/catalina/connector/Request.java
@@ -2224,7 +2224,7 @@ public class Request implements HttpServletRequest {
// If the role is "**" then, unless the application defines a role with
// that name, only check if the user is authenticated
if ("**".equals(role) && !context.findSecurityRole("**")) {
- return userPrincipal != null;
+ return true;
}
Realm realm = context.getRealm();
diff --git a/java/org/apache/catalina/core/StandardWrapper.java
b/java/org/apache/catalina/core/StandardWrapper.java
index 2b904f7b5a..3575ef79b8 100644
--- a/java/org/apache/catalina/core/StandardWrapper.java
+++ b/java/org/apache/catalina/core/StandardWrapper.java
@@ -918,7 +918,8 @@ public class StandardWrapper extends ContainerBase
implements ServletConfig, Wra
}
unloading = true;
- // Loaf a while if the current instance is allocated
+ // Loaf a while if the current instance is allocated. Use wait() to
+ // release the lock while waiting to avoid blocking other threads.
if (countAllocated.get() > 0) {
int nRetries = 0;
long delay = unloadDelay / 20;
@@ -927,7 +928,7 @@ public class StandardWrapper extends ContainerBase
implements ServletConfig, Wra
log.info(sm.getString("standardWrapper.waiting",
countAllocated.toString(), getName()));
}
try {
- Thread.sleep(delay);
+ wait(delay);
} catch (InterruptedException e) {
// Ignore
}
diff --git a/java/org/apache/catalina/mbeans/MemoryUserDatabaseMBean.java
b/java/org/apache/catalina/mbeans/MemoryUserDatabaseMBean.java
index 7bc45fc926..8be1738df0 100644
--- a/java/org/apache/catalina/mbeans/MemoryUserDatabaseMBean.java
+++ b/java/org/apache/catalina/mbeans/MemoryUserDatabaseMBean.java
@@ -35,6 +35,6 @@ public class MemoryUserDatabaseMBean extends
SparseUserDatabaseMBean {
/**
* The <code>ManagedBean</code> information describing this MBean.
*/
- protected final ManagedBean managed =
registry.findManagedBean("MemoryUserDatabase");
+ protected final ManagedBean managedMemory =
registry.findManagedBean("MemoryUserDatabase");
}
diff --git a/java/org/apache/catalina/session/PersistentManagerBase.java
b/java/org/apache/catalina/session/PersistentManagerBase.java
index 6b2c8a2129..7c988d863b 100644
--- a/java/org/apache/catalina/session/PersistentManagerBase.java
+++ b/java/org/apache/catalina/session/PersistentManagerBase.java
@@ -759,33 +759,30 @@ public abstract class PersistentManagerBase extends
ManagerBase implements Store
Session[] sessions = findSessions();
// Swap out all sessions idle longer than maxIdleSwap
- if (maxIdleSwap >= 0) {
- for (Session value : sessions) {
- StandardSession session = (StandardSession) value;
- synchronized (session) {
- if (!session.isValid()) {
+ for (Session value : sessions) {
+ StandardSession session = (StandardSession) value;
+ synchronized (session) {
+ if (!session.isValid()) {
+ continue;
+ }
+ int timeIdle = (int) (session.getIdleTimeInternal() / 1000L);
+ if (timeIdle >= maxIdleSwap && timeIdle >= minIdleSwap) {
+ if (session.accessCount != null &&
session.accessCount.get() > 0) {
+ // Session is currently being accessed - skip it
continue;
}
- int timeIdle = (int) (session.getIdleTimeInternal() /
1000L);
- if (timeIdle >= maxIdleSwap && timeIdle >= minIdleSwap) {
- if (session.accessCount != null &&
session.accessCount.get() > 0) {
- // Session is currently being accessed - skip it
- continue;
- }
- if (log.isTraceEnabled()) {
-
log.trace(sm.getString("persistentManager.swapMaxIdle", session.getIdInternal(),
- Integer.valueOf(timeIdle)));
- }
- try {
- swapOut(session);
- } catch (IOException ignore) {
- // This is logged in writeSession()
- }
+ if (log.isTraceEnabled()) {
+
log.trace(sm.getString("persistentManager.swapMaxIdle", session.getIdInternal(),
+ Integer.valueOf(timeIdle)));
+ }
+ try {
+ swapOut(session);
+ } catch (IOException ignore) {
+ // This is logged in writeSession()
}
}
}
}
-
}
@@ -851,37 +848,34 @@ public abstract class PersistentManagerBase extends
ManagerBase implements Store
Session[] sessions = findSessions();
// Back up all sessions idle longer than maxIdleBackup
- if (maxIdleBackup >= 0) {
- for (Session value : sessions) {
- StandardSession session = (StandardSession) value;
- synchronized (session) {
- if (!session.isValid()) {
- continue;
- }
- long lastAccessedTime =
session.getLastAccessedTimeInternal();
- Long persistedLastAccessedTime = (Long)
session.getNote(PERSISTED_LAST_ACCESSED_TIME);
- if (persistedLastAccessedTime != null &&
- lastAccessedTime ==
persistedLastAccessedTime.longValue()) {
- continue;
+ for (Session value : sessions) {
+ StandardSession session = (StandardSession) value;
+ synchronized (session) {
+ if (!session.isValid()) {
+ continue;
+ }
+ long lastAccessedTime = session.getLastAccessedTimeInternal();
+ Long persistedLastAccessedTime = (Long)
session.getNote(PERSISTED_LAST_ACCESSED_TIME);
+ if (persistedLastAccessedTime != null && lastAccessedTime ==
persistedLastAccessedTime.longValue()) {
+ continue;
+ }
+ int timeIdle = (int) (session.getIdleTimeInternal() / 1000L);
+ if (timeIdle >= maxIdleBackup) {
+ if (log.isTraceEnabled()) {
+
log.trace(sm.getString("persistentManager.backupMaxIdle",
session.getIdInternal(),
+ Integer.valueOf(timeIdle)));
}
- int timeIdle = (int) (session.getIdleTimeInternal() /
1000L);
- if (timeIdle >= maxIdleBackup) {
- if (log.isTraceEnabled()) {
-
log.trace(sm.getString("persistentManager.backupMaxIdle",
session.getIdInternal(),
- Integer.valueOf(timeIdle)));
- }
- try {
- writeSession(session);
- } catch (IOException ignore) {
- // This is logged in writeSession()
- }
- session.setNote(PERSISTED_LAST_ACCESSED_TIME,
Long.valueOf(lastAccessedTime));
+ try {
+ writeSession(session);
+ } catch (IOException ignore) {
+ // This is logged in writeSession()
}
+ session.setNote(PERSISTED_LAST_ACCESSED_TIME,
Long.valueOf(lastAccessedTime));
}
}
}
-
}
}
+
diff --git a/java/org/apache/catalina/tribes/membership/McastServiceImpl.java
b/java/org/apache/catalina/tribes/membership/McastServiceImpl.java
index d2304f88f6..fde65f96c3 100644
--- a/java/org/apache/catalina/tribes/membership/McastServiceImpl.java
+++ b/java/org/apache/catalina/tribes/membership/McastServiceImpl.java
@@ -107,7 +107,7 @@ public class McastServiceImpl extends
MembershipProviderBase {
/**
* The actual listener, for callback when stuff goes down
*/
- protected final MembershipListener service;
+ protected final MembershipListener memberService;
/**
* The actual listener for broadcast callbacks
*/
@@ -183,7 +183,7 @@ public class McastServiceImpl extends
MembershipProviderBase {
this.mcastTTL = ttl;
this.mcastBindAddress = bind;
this.timeToExpiration = expireTime;
- this.service = service;
+ this.memberService = service;
this.msgservice = msgservice;
this.sendFrequency = sendFrequency;
this.localLoopbackDisabled = localLoopbackDisabled;
@@ -418,7 +418,7 @@ public class McastServiceImpl extends
MembershipProviderBase {
String name = currentThread.getName();
try {
currentThread.setName("Membership-MemberDisappeared");
- service.memberDisappeared(m);
+ memberService.memberDisappeared(m);
} finally {
currentThread.setName(name);
}
@@ -431,7 +431,7 @@ public class McastServiceImpl extends
MembershipProviderBase {
String name = currentThread.getName();
try {
currentThread.setName("Membership-MemberAdded");
- service.memberAdded(m);
+ memberService.memberAdded(m);
} finally {
currentThread.setName(name);
}
@@ -503,7 +503,7 @@ public class McastServiceImpl extends
MembershipProviderBase {
String name = currentThread.getName();
try {
currentThread.setName("Membership-MemberExpired");
- service.memberDisappeared(member);
+ memberService.memberDisappeared(member);
} finally {
currentThread.setName(name);
}
diff --git a/java/org/apache/catalina/tribes/transport/PooledSender.java
b/java/org/apache/catalina/tribes/transport/PooledSender.java
index f54b24d1c7..6a3a832f1f 100644
--- a/java/org/apache/catalina/tribes/transport/PooledSender.java
+++ b/java/org/apache/catalina/tribes/transport/PooledSender.java
@@ -196,7 +196,7 @@ public abstract class PooledSender extends AbstractSender
implements MultiPointS
DataSender[] list = notinuse.toArray(new DataSender[0]);
boolean result = false;
for (DataSender dataSender : list) {
- result = result | dataSender.keepalive();
+ result = result || dataSender.keepalive();
}
return result;
}
diff --git a/java/org/apache/jasper/compiler/Validator.java
b/java/org/apache/jasper/compiler/Validator.java
index 69f87b143e..4ce9bb42c3 100644
--- a/java/org/apache/jasper/compiler/Validator.java
+++ b/java/org/apache/jasper/compiler/Validator.java
@@ -1516,9 +1516,9 @@ class Validator {
TagInfo tagInfo = n.getTagInfo();
if (tagInfo == null) {
err.jspError(n, "jsp.error.missing.tagInfo", n.getQName());
+ return;
}
- @SuppressWarnings("null") // tagInfo can't be null here
ValidationMessage[] errors = tagInfo.validate(n.getTagData());
if (errors != null && errors.length != 0) {
StringBuilder errMsg = new StringBuilder();
diff --git a/java/org/apache/tomcat/dbcp/pool2/impl/DefaultPooledObject.java
b/java/org/apache/tomcat/dbcp/pool2/impl/DefaultPooledObject.java
index e7a239414f..3f308e4d4f 100644
--- a/java/org/apache/tomcat/dbcp/pool2/impl/DefaultPooledObject.java
+++ b/java/org/apache/tomcat/dbcp/pool2/impl/DefaultPooledObject.java
@@ -100,6 +100,16 @@ public class DefaultPooledObject<T> implements
PooledObject<T> {
return compareTo;
}
+ @Override
+ public boolean equals(final Object obj) {
+ return this == obj;
+ }
+
+ @Override
+ public int hashCode() {
+ return System.identityHashCode(this);
+ }
+
/**
* Deallocates the object and sets it {@link PooledObjectState#IDLE IDLE}
* if it is currently {@link PooledObjectState#ALLOCATED ALLOCATED}
diff --git a/java/org/apache/tomcat/util/modeler/NotificationInfo.java
b/java/org/apache/tomcat/util/modeler/NotificationInfo.java
index bda3a392c8..8855b70a35 100644
--- a/java/org/apache/tomcat/util/modeler/NotificationInfo.java
+++ b/java/org/apache/tomcat/util/modeler/NotificationInfo.java
@@ -46,7 +46,7 @@ public class NotificationInfo extends FeatureInfo {
* The <code>ModelMBeanNotificationInfo</code> object that corresponds to
this <code>NotificationInfo</code>
* instance.
*/
- transient MBeanNotificationInfo info = null;
+ transient MBeanNotificationInfo notifInfo = null;
/**
* Array of notification types.
*/
@@ -62,14 +62,14 @@ public class NotificationInfo extends FeatureInfo {
@Override
public void setDescription(String description) {
super.setDescription(description);
- this.info = null;
+ this.notifInfo = null;
}
@Override
public void setName(String name) {
super.setName(name);
- this.info = null;
+ this.notifInfo = null;
}
@@ -107,7 +107,7 @@ public class NotificationInfo extends FeatureInfo {
System.arraycopy(notifTypes, 0, results, 0, notifTypes.length);
results[notifTypes.length] = notifType;
notifTypes = results;
- this.info = null;
+ this.notifInfo = null;
} finally {
writeLock.unlock();
}
@@ -123,16 +123,16 @@ public class NotificationInfo extends FeatureInfo {
public MBeanNotificationInfo createNotificationInfo() {
// Return our cached information (if any)
- if (info != null) {
- return info;
+ if (notifInfo != null) {
+ return notifInfo;
}
// Create and return a new information object
- info = new MBeanNotificationInfo(getNotifTypes(), getName(),
getDescription());
- // Descriptor descriptor = info.getDescriptor();
+ notifInfo = new MBeanNotificationInfo(getNotifTypes(), getName(),
getDescription());
+ // Descriptor descriptor = notifInfo.getDescriptor();
// addFields(descriptor);
- // info.setDescriptor(descriptor);
- return info;
+ // notifInfo.setDescriptor(descriptor);
+ return notifInfo;
}
diff --git a/java/org/apache/tomcat/util/net/NioEndpoint.java
b/java/org/apache/tomcat/util/net/NioEndpoint.java
index 09b4750f33..0c55f89af1 100644
--- a/java/org/apache/tomcat/util/net/NioEndpoint.java
+++ b/java/org/apache/tomcat/util/net/NioEndpoint.java
@@ -925,7 +925,7 @@ public class NioEndpoint extends
AbstractNetworkChannelEndpoint<NioChannel,Socke
}
// Either we timed out or we woke up, process events first
if (keyCount == 0) {
- hasEvents = (hasEvents | events());
+ hasEvents = (hasEvents || events());
}
} catch (Throwable x) {
ExceptionUtils.handleThrowable(x);
diff --git a/java/org/apache/tomcat/websocket/WsRemoteEndpointImplBase.java
b/java/org/apache/tomcat/websocket/WsRemoteEndpointImplBase.java
index c4fbfe1021..5b1dc5511a 100644
--- a/java/org/apache/tomcat/websocket/WsRemoteEndpointImplBase.java
+++ b/java/org/apache/tomcat/websocket/WsRemoteEndpointImplBase.java
@@ -451,7 +451,9 @@ public abstract class WsRemoteEndpointImplBase implements
RemoteEndpoint {
try {
messageParts = transformation.sendMessagePart(messageParts);
} catch (IOException ioe) {
- handler.onResult(new SendResult(getSession(), ioe));
+ if (handler != null) {
+ handler.onResult(new SendResult(getSession(), ioe));
+ }
return;
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
