This is an automated email from the ASF dual-hosted git repository.
rmaucher pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new b4e83cf1b0 Fix the few actually legitimate issues from CodeQL
b4e83cf1b0 is described below
commit b4e83cf1b0605b49bda48893112318fce53526f7
Author: remm <[email protected]>
AuthorDate: Wed May 27 15:06:10 2026 +0200
Fix the few actually legitimate issues from CodeQL
Everything else is invalid, false positive, intentional, and so on.
---
java/javax/servlet/jsp/tagext/TagData.java | 14 +++-
java/org/apache/catalina/connector/Request.java | 2 +-
java/org/apache/catalina/core/StandardWrapper.java | 6 +-
.../catalina/mbeans/MemoryUserDatabaseMBean.java | 2 +-
.../catalina/session/PersistentManagerBase.java | 86 ++++++++++------------
.../tribes/membership/McastServiceImpl.java | 10 +--
.../catalina/tribes/transport/PooledSender.java | 2 +-
java/org/apache/jasper/compiler/Validator.java | 2 +-
.../dbcp/pool2/impl/DefaultPooledObject.java | 10 +++
.../tomcat/util/modeler/NotificationInfo.java | 20 ++---
java/org/apache/tomcat/util/net/NioEndpoint.java | 2 +-
.../tomcat/websocket/WsRemoteEndpointImplBase.java | 6 +-
12 files changed, 90 insertions(+), 72 deletions(-)
diff --git a/java/javax/servlet/jsp/tagext/TagData.java
b/java/javax/servlet/jsp/tagext/TagData.java
index 4ea79fd05f..325401ee16 100644
--- a/java/javax/servlet/jsp/tagext/TagData.java
+++ b/java/javax/servlet/jsp/tagext/TagData.java
@@ -136,7 +136,19 @@ public class TagData implements Cloneable {
return attributes.keys();
}
+ @Override
+ public TagData clone() {
+ try {
+ TagData clone = (TagData) super.clone();
+ clone.attributes = new Hashtable<>(attributes);
+ return clone;
+ } catch (CloneNotSupportedException e) {
+ // Should never happen
+ throw new InternalError(e);
+ }
+ }
+
// private data
- private final Hashtable<String,Object> attributes; // the tagname/value map
+ private Hashtable<String,Object> attributes; // the tagname/value map
}
diff --git a/java/org/apache/catalina/connector/Request.java
b/java/org/apache/catalina/connector/Request.java
index becf17d8b9..4e97018b74 100644
--- a/java/org/apache/catalina/connector/Request.java
+++ b/java/org/apache/catalina/connector/Request.java
@@ -2470,7 +2470,7 @@ public class Request implements HttpServletRequest {
// If the role is "**" then, unless the application defines a role with
// that name, only check if the user is authenticated
if ("**".equals(role) && !context.findSecurityRole("**")) {
- return userPrincipal != null;
+ return true;
}
Realm realm = context.getRealm();
diff --git a/java/org/apache/catalina/core/StandardWrapper.java
b/java/org/apache/catalina/core/StandardWrapper.java
index 3f1d5b0c57..3ab863a5a5 100644
--- a/java/org/apache/catalina/core/StandardWrapper.java
+++ b/java/org/apache/catalina/core/StandardWrapper.java
@@ -1085,8 +1085,8 @@ public class StandardWrapper extends ContainerBase
implements ServletConfig, Wra
}
unloading = true;
- // Loaf a while if the current instance is allocated
- // (possibly more than once if non-STM)
+ // Loaf a while if the current instance is allocated. Use wait() to
+ // release the lock while waiting to avoid blocking other threads.
if (countAllocated.get() > 0) {
int nRetries = 0;
long delay = unloadDelay / 20;
@@ -1095,7 +1095,7 @@ public class StandardWrapper extends ContainerBase
implements ServletConfig, Wra
log.info(sm.getString("standardWrapper.waiting",
countAllocated.toString(), getName()));
}
try {
- Thread.sleep(delay);
+ wait(delay);
} catch (InterruptedException e) {
// Ignore
}
diff --git a/java/org/apache/catalina/mbeans/MemoryUserDatabaseMBean.java
b/java/org/apache/catalina/mbeans/MemoryUserDatabaseMBean.java
index 7bc45fc926..8be1738df0 100644
--- a/java/org/apache/catalina/mbeans/MemoryUserDatabaseMBean.java
+++ b/java/org/apache/catalina/mbeans/MemoryUserDatabaseMBean.java
@@ -35,6 +35,6 @@ public class MemoryUserDatabaseMBean extends
SparseUserDatabaseMBean {
/**
* The <code>ManagedBean</code> information describing this MBean.
*/
- protected final ManagedBean managed =
registry.findManagedBean("MemoryUserDatabase");
+ protected final ManagedBean managedMemory =
registry.findManagedBean("MemoryUserDatabase");
}
diff --git a/java/org/apache/catalina/session/PersistentManagerBase.java
b/java/org/apache/catalina/session/PersistentManagerBase.java
index a68cebdf99..225f69c4f1 100644
--- a/java/org/apache/catalina/session/PersistentManagerBase.java
+++ b/java/org/apache/catalina/session/PersistentManagerBase.java
@@ -890,33 +890,30 @@ public abstract class PersistentManagerBase extends
ManagerBase implements Store
Session[] sessions = findSessions();
// Swap out all sessions idle longer than maxIdleSwap
- if (maxIdleSwap >= 0) {
- for (Session value : sessions) {
- StandardSession session = (StandardSession) value;
- synchronized (session) {
- if (!session.isValid()) {
+ for (Session value : sessions) {
+ StandardSession session = (StandardSession) value;
+ synchronized (session) {
+ if (!session.isValid()) {
+ continue;
+ }
+ int timeIdle = (int) (session.getIdleTimeInternal() / 1000L);
+ if (timeIdle >= maxIdleSwap && timeIdle >= minIdleSwap) {
+ if (session.accessCount != null &&
session.accessCount.get() > 0) {
+ // Session is currently being accessed - skip it
continue;
}
- int timeIdle = (int) (session.getIdleTimeInternal() /
1000L);
- if (timeIdle >= maxIdleSwap && timeIdle >= minIdleSwap) {
- if (session.accessCount != null &&
session.accessCount.get() > 0) {
- // Session is currently being accessed - skip it
- continue;
- }
- if (log.isTraceEnabled()) {
-
log.trace(sm.getString("persistentManager.swapMaxIdle", session.getIdInternal(),
- Integer.valueOf(timeIdle)));
- }
- try {
- swapOut(session);
- } catch (IOException ignore) {
- // This is logged in writeSession()
- }
+ if (log.isTraceEnabled()) {
+
log.trace(sm.getString("persistentManager.swapMaxIdle", session.getIdInternal(),
+ Integer.valueOf(timeIdle)));
+ }
+ try {
+ swapOut(session);
+ } catch (IOException ignore) {
+ // This is logged in writeSession()
}
}
}
}
-
}
@@ -982,37 +979,34 @@ public abstract class PersistentManagerBase extends
ManagerBase implements Store
Session[] sessions = findSessions();
// Back up all sessions idle longer than maxIdleBackup
- if (maxIdleBackup >= 0) {
- for (Session value : sessions) {
- StandardSession session = (StandardSession) value;
- synchronized (session) {
- if (!session.isValid()) {
- continue;
- }
- long lastAccessedTime =
session.getLastAccessedTimeInternal();
- Long persistedLastAccessedTime = (Long)
session.getNote(PERSISTED_LAST_ACCESSED_TIME);
- if (persistedLastAccessedTime != null &&
- lastAccessedTime ==
persistedLastAccessedTime.longValue()) {
- continue;
+ for (Session value : sessions) {
+ StandardSession session = (StandardSession) value;
+ synchronized (session) {
+ if (!session.isValid()) {
+ continue;
+ }
+ long lastAccessedTime = session.getLastAccessedTimeInternal();
+ Long persistedLastAccessedTime = (Long)
session.getNote(PERSISTED_LAST_ACCESSED_TIME);
+ if (persistedLastAccessedTime != null && lastAccessedTime ==
persistedLastAccessedTime.longValue()) {
+ continue;
+ }
+ int timeIdle = (int) (session.getIdleTimeInternal() / 1000L);
+ if (timeIdle >= maxIdleBackup) {
+ if (log.isTraceEnabled()) {
+
log.trace(sm.getString("persistentManager.backupMaxIdle",
session.getIdInternal(),
+ Integer.valueOf(timeIdle)));
}
- int timeIdle = (int) (session.getIdleTimeInternal() /
1000L);
- if (timeIdle >= maxIdleBackup) {
- if (log.isTraceEnabled()) {
-
log.trace(sm.getString("persistentManager.backupMaxIdle",
session.getIdInternal(),
- Integer.valueOf(timeIdle)));
- }
- try {
- writeSession(session);
- } catch (IOException ignore) {
- // This is logged in writeSession()
- }
- session.setNote(PERSISTED_LAST_ACCESSED_TIME,
Long.valueOf(lastAccessedTime));
+ try {
+ writeSession(session);
+ } catch (IOException ignore) {
+ // This is logged in writeSession()
}
+ session.setNote(PERSISTED_LAST_ACCESSED_TIME,
Long.valueOf(lastAccessedTime));
}
}
}
-
}
}
+
diff --git a/java/org/apache/catalina/tribes/membership/McastServiceImpl.java
b/java/org/apache/catalina/tribes/membership/McastServiceImpl.java
index fda13db7cd..c5bd18a79d 100644
--- a/java/org/apache/catalina/tribes/membership/McastServiceImpl.java
+++ b/java/org/apache/catalina/tribes/membership/McastServiceImpl.java
@@ -106,7 +106,7 @@ public class McastServiceImpl extends
MembershipProviderBase {
/**
* The actual listener, for callback when stuff goes down
*/
- protected final MembershipListener service;
+ protected final MembershipListener memberService;
/**
* The actual listener for broadcast callbacks
*/
@@ -182,7 +182,7 @@ public class McastServiceImpl extends
MembershipProviderBase {
this.mcastTTL = ttl;
this.mcastBindAddress = bind;
this.timeToExpiration = expireTime;
- this.service = service;
+ this.memberService = service;
this.msgservice = msgservice;
this.sendFrequency = sendFrequency;
this.localLoopbackDisabled = localLoopbackDisabled;
@@ -417,7 +417,7 @@ public class McastServiceImpl extends
MembershipProviderBase {
String name = currentThread.getName();
try {
currentThread.setName("Membership-MemberDisappeared");
- service.memberDisappeared(m);
+ memberService.memberDisappeared(m);
} finally {
currentThread.setName(name);
}
@@ -430,7 +430,7 @@ public class McastServiceImpl extends
MembershipProviderBase {
String name = currentThread.getName();
try {
currentThread.setName("Membership-MemberAdded");
- service.memberAdded(m);
+ memberService.memberAdded(m);
} finally {
currentThread.setName(name);
}
@@ -505,7 +505,7 @@ public class McastServiceImpl extends
MembershipProviderBase {
String name = currentThread.getName();
try {
currentThread.setName("Membership-MemberExpired");
- service.memberDisappeared(member);
+ memberService.memberDisappeared(member);
} finally {
currentThread.setName(name);
}
diff --git a/java/org/apache/catalina/tribes/transport/PooledSender.java
b/java/org/apache/catalina/tribes/transport/PooledSender.java
index b08c6fc513..46e296a279 100644
--- a/java/org/apache/catalina/tribes/transport/PooledSender.java
+++ b/java/org/apache/catalina/tribes/transport/PooledSender.java
@@ -196,7 +196,7 @@ public abstract class PooledSender extends AbstractSender
implements MultiPointS
DataSender[] list = notinuse.toArray(new DataSender[0]);
boolean result = false;
for (DataSender dataSender : list) {
- result = result | dataSender.keepalive();
+ result = result || dataSender.keepalive();
}
return result;
}
diff --git a/java/org/apache/jasper/compiler/Validator.java
b/java/org/apache/jasper/compiler/Validator.java
index 802884c2fc..475b2a661f 100644
--- a/java/org/apache/jasper/compiler/Validator.java
+++ b/java/org/apache/jasper/compiler/Validator.java
@@ -1563,9 +1563,9 @@ class Validator {
TagInfo tagInfo = n.getTagInfo();
if (tagInfo == null) {
err.jspError(n, "jsp.error.missing.tagInfo", n.getQName());
+ return;
}
- @SuppressWarnings("null") // tagInfo can't be null here
ValidationMessage[] errors = tagInfo.validate(n.getTagData());
if (errors != null && errors.length != 0) {
StringBuilder errMsg = new StringBuilder();
diff --git a/java/org/apache/tomcat/dbcp/pool2/impl/DefaultPooledObject.java
b/java/org/apache/tomcat/dbcp/pool2/impl/DefaultPooledObject.java
index f04b89292f..0a4be12514 100644
--- a/java/org/apache/tomcat/dbcp/pool2/impl/DefaultPooledObject.java
+++ b/java/org/apache/tomcat/dbcp/pool2/impl/DefaultPooledObject.java
@@ -100,6 +100,16 @@ public class DefaultPooledObject<T> implements
PooledObject<T> {
return compareTo;
}
+ @Override
+ public boolean equals(final Object obj) {
+ return this == obj;
+ }
+
+ @Override
+ public int hashCode() {
+ return System.identityHashCode(this);
+ }
+
/**
* Deallocates the object and sets it {@link PooledObjectState#IDLE IDLE}
* if it is currently {@link PooledObjectState#ALLOCATED ALLOCATED}
diff --git a/java/org/apache/tomcat/util/modeler/NotificationInfo.java
b/java/org/apache/tomcat/util/modeler/NotificationInfo.java
index 4699a71e8c..5816eeade2 100644
--- a/java/org/apache/tomcat/util/modeler/NotificationInfo.java
+++ b/java/org/apache/tomcat/util/modeler/NotificationInfo.java
@@ -44,7 +44,7 @@ public class NotificationInfo extends FeatureInfo {
* The <code>ModelMBeanNotificationInfo</code> object that corresponds to
this <code>NotificationInfo</code>
* instance.
*/
- transient MBeanNotificationInfo info = null;
+ transient MBeanNotificationInfo notifInfo = null;
/**
* Array of notification types.
*/
@@ -65,7 +65,7 @@ public class NotificationInfo extends FeatureInfo {
@Override
public void setDescription(String description) {
super.setDescription(description);
- this.info = null;
+ this.notifInfo = null;
}
@@ -77,7 +77,7 @@ public class NotificationInfo extends FeatureInfo {
@Override
public void setName(String name) {
super.setName(name);
- this.info = null;
+ this.notifInfo = null;
}
@@ -115,7 +115,7 @@ public class NotificationInfo extends FeatureInfo {
System.arraycopy(notifTypes, 0, results, 0, notifTypes.length);
results[notifTypes.length] = notifType;
notifTypes = results;
- this.info = null;
+ this.notifInfo = null;
} finally {
writeLock.unlock();
}
@@ -131,16 +131,16 @@ public class NotificationInfo extends FeatureInfo {
public MBeanNotificationInfo createNotificationInfo() {
// Return our cached information (if any)
- if (info != null) {
- return info;
+ if (notifInfo != null) {
+ return notifInfo;
}
// Create and return a new information object
- info = new MBeanNotificationInfo(getNotifTypes(), getName(),
getDescription());
- // Descriptor descriptor = info.getDescriptor();
+ notifInfo = new MBeanNotificationInfo(getNotifTypes(), getName(),
getDescription());
+ // Descriptor descriptor = notifInfo.getDescriptor();
// addFields(descriptor);
- // info.setDescriptor(descriptor);
- return info;
+ // notifInfo.setDescriptor(descriptor);
+ return notifInfo;
}
diff --git a/java/org/apache/tomcat/util/net/NioEndpoint.java
b/java/org/apache/tomcat/util/net/NioEndpoint.java
index 50e12c67eb..c1f1c7e605 100644
--- a/java/org/apache/tomcat/util/net/NioEndpoint.java
+++ b/java/org/apache/tomcat/util/net/NioEndpoint.java
@@ -978,7 +978,7 @@ public class NioEndpoint extends
AbstractJsseEndpoint<NioChannel,SocketChannel>
}
// Either we timed out or we woke up, process events first
if (keyCount == 0) {
- hasEvents = (hasEvents | events());
+ hasEvents = (hasEvents || events());
}
} catch (Throwable x) {
ExceptionUtils.handleThrowable(x);
diff --git a/java/org/apache/tomcat/websocket/WsRemoteEndpointImplBase.java
b/java/org/apache/tomcat/websocket/WsRemoteEndpointImplBase.java
index ed397ab770..183c12b34e 100644
--- a/java/org/apache/tomcat/websocket/WsRemoteEndpointImplBase.java
+++ b/java/org/apache/tomcat/websocket/WsRemoteEndpointImplBase.java
@@ -443,8 +443,10 @@ public abstract class WsRemoteEndpointImplBase implements
RemoteEndpoint {
try {
messageParts = transformation.sendMessagePart(messageParts);
} catch (IOException ioe) {
- handler.onResult(new SendResult(ioe));
- return;
+ if (handler != null) {
+ handler.onResult(new SendResult(ioe));
+ return;
+ }
}
// Some extensions/transformations may buffer messages so it is
possible
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
