Tomcat Use of Log4j v1.2.17

2021-12-10 Thread Naresh Annangar 
Hi Team,

While checking for CVE-2021-44228, we noticed the presence of Log4j v1.2.17
packaged along with Tomcat. Log4j lists 1.x as unsupported. Is there any
analysis or information available if this is vulnerable or exploitable?

Regards,
Naresh

[Bug 65714] HTTPS connection error using NIO2 with security manager enabled

2021-12-10 Thread bugzilla 
https://bz.apache.org/bugzilla/show_bug.cgi?id=65714

--- Comment #24 from Allan  ---
Thanks. Will work on it.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 65714] HTTPS connection error using NIO2 with security manager enabled

2021-12-10 Thread bugzilla 
https://bz.apache.org/bugzilla/show_bug.cgi?id=65714

--- Comment #23 from Mark Thomas  ---
8.5.x:
https://people.apache.org/~markt/dev/v8.5.72-4795df9/

9.0.x:
https://people.apache.org/~markt/dev/v9.0.57-115334b/

These are not official releases. They are development builds solely to test
whether this bug has been fully fixed.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 65736] Improve org.apache.naming.factory.BeanFactory to mitigate JNDI injection

2021-12-10 Thread bugzilla 
https://bz.apache.org/bugzilla/show_bug.cgi?id=65736

Mark Thomas  changed:

   What|Removed |Added

   Severity|normal  |enhancement

--- Comment #2 from Mark Thomas  ---
To be crystal clear:

There is no Apache Tomcat vulnerability here.

To quote from the linked article:

The actual problem here is not within the JDK or Apache Tomcat library, but
rather in custom applications that pass user-controllable data to the
"InitialContext.lookup()" function, as it still represents a security risk even
in fully patched JDK installations.


Moving this to an enhancement request.

It is highly unlikely Tomcat will remove/disable existing functionality.

Suggestions for mitigation / hardening that can improve security without
impacting legitimate uses will be welcomed.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 65714] HTTPS connection error using NIO2 with security manager enabled

2021-12-10 Thread bugzilla 
https://bz.apache.org/bugzilla/show_bug.cgi?id=65714

--- Comment #22 from Allan  ---
How about 8.5.74 and 9.0.57 on RHEL 7 and Windows?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 65714] HTTPS connection error using NIO2 with security manager enabled

2021-12-10 Thread bugzilla 
https://bz.apache.org/bugzilla/show_bug.cgi?id=65714

--- Comment #21 from Mark Thomas  ---
Which version do you need and I'll create a test build for you.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 65714] HTTPS connection error using NIO2 with security manager enabled

2021-12-10 Thread bugzilla 
https://bz.apache.org/bugzilla/show_bug.cgi?id=65714

--- Comment #20 from Allan  ---
Thanks Mark. This sounds promising. For test in advance, where can we pull this
image?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 65714] HTTPS connection error using NIO2 with security manager enabled

2021-12-10 Thread bugzilla 
https://bz.apache.org/bugzilla/show_bug.cgi?id=65714

Mark Thomas  changed:

   What|Removed |Added

 Resolution|--- |FIXED
 Status|REOPENED|RESOLVED

--- Comment #19 from Mark Thomas  ---
I have a solution and it has been committed for all current branches.

Fixed in:
- 10.1.x for 10.1.0-M9 onwards
- 10.0.x for 10.0.15 onwards
- 9.0.x for 9.0.57 onwards
- 8.5.x for 8.5.74 onwards

Any testing in advance of those releases would be helpful. I can provide test
builds if that helps.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[tomcat] branch 10.0.x updated: Fix backport

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch 10.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/10.0.x by this push:
 new 3de7930  Fix backport
3de7930 is described below

commit 3de79307819577149ceb56362d048980d9e1da8b
Author: Mark Thomas 
AuthorDate: Fri Dec 10 16:06:52 2021 +

Fix backport
---
 .../apache/tomcat/util/security/PrivilegedSetAccessControlContext.java  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git 
a/java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java 
b/java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java
index 2f53480..9f9f4c9 100644
--- 
a/java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java
+++ 
b/java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java
@@ -38,7 +38,7 @@ public class PrivilegedSetAccessControlContext implements 
PrivilegedAction
 Field f = null;
 try {
 f = Thread.class.getDeclaredField("inheritedAccessControlContext");
-f.trySetAccessible();
+f.setAccessible(true);
 } catch (NoSuchFieldException | SecurityException e) {
 
log.warn(sm.getString("privilegedSetAccessControlContext.lookupFailed"), e);
 }

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[tomcat] branch 9.0.x updated: Fix backport

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/9.0.x by this push:
 new 115334b  Fix backport
115334b is described below

commit 115334b1b5c1888bee600d0b9e9613da2fd4b968
Author: Mark Thomas 
AuthorDate: Fri Dec 10 16:06:52 2021 +

Fix backport
---
 .../apache/tomcat/util/security/PrivilegedSetAccessControlContext.java  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git 
a/java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java 
b/java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java
index 2f53480..9f9f4c9 100644
--- 
a/java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java
+++ 
b/java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java
@@ -38,7 +38,7 @@ public class PrivilegedSetAccessControlContext implements 
PrivilegedAction
 Field f = null;
 try {
 f = Thread.class.getDeclaredField("inheritedAccessControlContext");
-f.trySetAccessible();
+f.setAccessible(true);
 } catch (NoSuchFieldException | SecurityException e) {
 
log.warn(sm.getString("privilegedSetAccessControlContext.lookupFailed"), e);
 }

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[tomcat] 02/03: Revert the previous fix for BZ 65714.

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch 8.5.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit 07747b8ca36ffd29350af24d1c9fd05a174ba25d
Author: Mark Thomas 
AuthorDate: Fri Dec 10 14:55:53 2021 +

Revert the previous fix for BZ 65714.

Dispatching from the handshake completion handler was addressing the
symptom of the lack of permissions rather than the cause.
---
 java/org/apache/tomcat/util/net/SecureNio2Channel.java | 18 --
 1 file changed, 4 insertions(+), 14 deletions(-)

diff --git a/java/org/apache/tomcat/util/net/SecureNio2Channel.java 
b/java/org/apache/tomcat/util/net/SecureNio2Channel.java
index 21a4ba1..1f537e4 100644
--- a/java/org/apache/tomcat/util/net/SecureNio2Channel.java
+++ b/java/org/apache/tomcat/util/net/SecureNio2Channel.java
@@ -101,17 +101,12 @@ public class SecureNio2Channel extends Nio2Channel  {
 if (result.intValue() < 0) {
 failed(new EOFException(), attachment);
 } else {
-// When running under a security manager always dispatch so the
-// processing occurs on a thread with the correct security
-// context.
-endpoint.processSocket(attachment, SocketEvent.OPEN_READ, 
Constants.IS_SECURITY_ENABLED);
+endpoint.processSocket(attachment, SocketEvent.OPEN_READ, 
false);
 }
 }
 @Override
 public void failed(Throwable exc, SocketWrapperBase 
attachment) {
-// When running under a security manager always dispatch so the
-// processing occurs on a thread with the correct security context.
-endpoint.processSocket(attachment, SocketEvent.ERROR, 
Constants.IS_SECURITY_ENABLED);
+endpoint.processSocket(attachment, SocketEvent.ERROR, false);
 }
 }
 
@@ -123,17 +118,12 @@ public class SecureNio2Channel extends Nio2Channel  {
 if (result.intValue() < 0) {
 failed(new EOFException(), attachment);
 } else {
-// When running under a security manager always dispatch so the
-// processing occurs on a thread with the correct security
-// context.
-endpoint.processSocket(attachment, SocketEvent.OPEN_WRITE, 
Constants.IS_SECURITY_ENABLED);
+endpoint.processSocket(attachment, SocketEvent.OPEN_WRITE, 
false);
 }
 }
 @Override
 public void failed(Throwable exc, SocketWrapperBase 
attachment) {
-// When running under a security manager always dispatch so the
-// processing occurs on a thread with the correct security context.
-endpoint.processSocket(attachment, SocketEvent.ERROR, 
Constants.IS_SECURITY_ENABLED);
+endpoint.processSocket(attachment, SocketEvent.ERROR, false);
 }
 }
 

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[tomcat] 03/03: Improved fix for BZ 65714

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch 8.5.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit 4795df9bf89f84decafa276805d0c265f93eb368
Author: Mark Thomas 
AuthorDate: Fri Dec 10 15:24:51 2021 +

Improved fix for BZ 65714

https://bz.apache.org/bugzilla/show_bug.cgi?id=65714
When running under a SecurityManager, ensure that newly created threads
inherit an appropriate AccessControlContext
---
 .../catalina/security/SecurityClassLoad.java   |  1 +
 .../tomcat/util/security/LocalStrings.properties   | 17 ++
 .../PrivilegedSetAccessControlContext.java | 67 ++
 .../tomcat/util/threads/TaskThreadFactory.java | 12 +++-
 4 files changed, 94 insertions(+), 3 deletions(-)

diff --git a/java/org/apache/catalina/security/SecurityClassLoad.java 
b/java/org/apache/catalina/security/SecurityClassLoad.java
index c2cb0fc..e24aae1 100644
--- a/java/org/apache/catalina/security/SecurityClassLoad.java
+++ b/java/org/apache/catalina/security/SecurityClassLoad.java
@@ -199,6 +199,7 @@ public final class SecurityClassLoad {
 // security
 loader.loadClass(basePackage + "util.security.PrivilegedGetTccl");
 loader.loadClass(basePackage + "util.security.PrivilegedSetTccl");
+loader.loadClass(basePackage + 
"util.security.PrivilegedSetAccessControlContext");
 }
 
 private static final void loadAnonymousInnerClasses(ClassLoader loader, 
String enclosingClass) {
diff --git a/java/org/apache/tomcat/util/security/LocalStrings.properties 
b/java/org/apache/tomcat/util/security/LocalStrings.properties
new file mode 100644
index 000..9d8090a
--- /dev/null
+++ b/java/org/apache/tomcat/util/security/LocalStrings.properties
@@ -0,0 +1,17 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+privilegedSetAccessControlContext.lookupFailed=Unable to obtain reference to 
field Thread.inheritedAccessControlContext
+privilegedSetAccessControlContext.setFailed=Unable to set field 
Thread.inheritedAccessControlContext
diff --git 
a/java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java 
b/java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java
new file mode 100644
index 000..9f9f4c9
--- /dev/null
+++ 
b/java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java
@@ -0,0 +1,67 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.tomcat.util.security;
+
+import java.lang.reflect.Field;
+import java.security.AccessControlContext;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+
+import org.apache.juli.logging.Log;
+import org.apache.juli.logging.LogFactory;
+import org.apache.tomcat.util.res.StringManager;
+
+public class PrivilegedSetAccessControlContext implements 
PrivilegedAction {
+
+private static final Log log = 
LogFactory.getLog(PrivilegedSetAccessControlContext.class);
+private static final StringManager sm = 
StringManager.getManager(PrivilegedSetAccessControlContext.class);
+
+private static final AccessControlContext acc;
+private static final Field field;
+
+static {
+acc = AccessController.getContext();
+Field f = null;
+try {
+f = Thread.class.getDeclaredField("inheritedAccessControlContext");
+f.setAccessible(true);
+} catch (NoSuchFieldException | SecurityException e) {
+

[tomcat] 01/03: Restore pre-starting of core threads lost in fix for BZ 65454

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch 8.5.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit 23c78507b5d3dc4c0bd36d263e4f99aa8221205c
Author: Mark Thomas 
AuthorDate: Fri Dec 10 14:52:06 2021 +

Restore pre-starting of core threads lost in fix for BZ 65454
---
 java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java | 2 ++
 webapps/docs/changelog.xml  | 4 
 2 files changed, 6 insertions(+)

diff --git a/java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java 
b/java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java
index 49a10af..d800cad 100644
--- a/java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java
+++ b/java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java
@@ -1366,6 +1366,8 @@ public class ThreadPoolExecutor extends 
AbstractExecutorService {
 this.keepAliveTime = unit.toNanos(keepAliveTime);
 this.threadFactory = threadFactory;
 this.handler = handler;
+
+prestartAllCoreThreads();
 }
 
 
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index a897d6c..4935c3d 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -181,6 +181,10 @@
 request includes a body. The maximum permitted size of the body is
 controlled by maxSavePostSize. (markt)
   
+  
+Restore pre-starting of minSpareThreads lost in the fix 
for
+65454. (markt)
+  
 
   
   

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[tomcat] branch 8.5.x updated (d0cbf5e -> 4795df9)

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a change to branch 8.5.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git.


from d0cbf5e  Document BZ 65714 as a known issue
 new 23c7850  Restore pre-starting of core threads lost in fix for BZ 65454
 new 07747b8  Revert the previous fix for BZ 65714.
 new 4795df9  Improved fix for BZ 65714

The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Summary of changes:
 .../catalina/security/SecurityClassLoad.java   |  1 +
 .../apache/tomcat/util/net/SecureNio2Channel.java  | 18 ++
 .../util/security}/LocalStrings.properties |  4 +-
 .../PrivilegedSetAccessControlContext.java | 67 ++
 .../tomcat/util/threads/TaskThreadFactory.java | 12 +++-
 .../tomcat/util/threads/ThreadPoolExecutor.java|  2 +
 webapps/docs/changelog.xml |  4 ++
 7 files changed, 89 insertions(+), 19 deletions(-)
 copy java/org/apache/{catalina/ha/authenticator => 
tomcat/util/security}/LocalStrings.properties (77%)
 create mode 100644 
java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[tomcat] 01/04: Restore pre-starting of core threads lost in fix for BZ 65454

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit 9bca801bd4f7d0adbbad686110aa476b2829cad9
Author: Mark Thomas 
AuthorDate: Fri Dec 10 14:52:06 2021 +

Restore pre-starting of core threads lost in fix for BZ 65454
---
 java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java | 2 ++
 webapps/docs/changelog.xml  | 4 
 2 files changed, 6 insertions(+)

diff --git a/java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java 
b/java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java
index 49a10af..d800cad 100644
--- a/java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java
+++ b/java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java
@@ -1366,6 +1366,8 @@ public class ThreadPoolExecutor extends 
AbstractExecutorService {
 this.keepAliveTime = unit.toNanos(keepAliveTime);
 this.threadFactory = threadFactory;
 this.handler = handler;
+
+prestartAllCoreThreads();
 }
 
 
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 76786f5..ad95126 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -112,6 +112,10 @@
 request includes a body. The maximum permitted size of the body is
 controlled by maxSavePostSize. (markt)
   
+  
+Restore pre-starting of minSpareThreads lost in the fix 
for
+65454. (markt)
+  
 
   
   

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[tomcat] 03/04: Improved fix for BZ 65714

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit 9eb49f93f910df9f5408642a798bf39cbeb10804
Author: Mark Thomas 
AuthorDate: Fri Dec 10 15:24:51 2021 +

Improved fix for BZ 65714

https://bz.apache.org/bugzilla/show_bug.cgi?id=65714
When running under a SecurityManager, ensure that newly created threads
inherit an appropriate AccessControlContext
---
 .../catalina/security/SecurityClassLoad.java   |  1 +
 .../tomcat/util/security/LocalStrings.properties   |  3 +
 .../PrivilegedSetAccessControlContext.java | 67 ++
 .../tomcat/util/threads/TaskThreadFactory.java | 12 +++-
 webapps/docs/changelog.xml |  4 ++
 5 files changed, 84 insertions(+), 3 deletions(-)

diff --git a/java/org/apache/catalina/security/SecurityClassLoad.java 
b/java/org/apache/catalina/security/SecurityClassLoad.java
index bf86414..9529cb6 100644
--- a/java/org/apache/catalina/security/SecurityClassLoad.java
+++ b/java/org/apache/catalina/security/SecurityClassLoad.java
@@ -200,5 +200,6 @@ public final class SecurityClassLoad {
 // security
 loader.loadClass(basePackage + "util.security.PrivilegedGetTccl");
 loader.loadClass(basePackage + "util.security.PrivilegedSetTccl");
+loader.loadClass(basePackage + 
"util.security.PrivilegedSetAccessControlContext");
 }
 }
diff --git a/java/org/apache/tomcat/util/security/LocalStrings.properties 
b/java/org/apache/tomcat/util/security/LocalStrings.properties
index 577cd38..39e92df 100644
--- a/java/org/apache/tomcat/util/security/LocalStrings.properties
+++ b/java/org/apache/tomcat/util/security/LocalStrings.properties
@@ -14,3 +14,6 @@
 # limitations under the License.
 
 concurrentMessageDigest.noDigest=Digest algorithm unavailable
+
+privilegedSetAccessControlContext.lookupFailed=Unable to obtain reference to 
field Thread.inheritedAccessControlContext
+privilegedSetAccessControlContext.setFailed=Unable to set field 
Thread.inheritedAccessControlContext
diff --git 
a/java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java 
b/java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java
new file mode 100644
index 000..2f53480
--- /dev/null
+++ 
b/java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java
@@ -0,0 +1,67 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.tomcat.util.security;
+
+import java.lang.reflect.Field;
+import java.security.AccessControlContext;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+
+import org.apache.juli.logging.Log;
+import org.apache.juli.logging.LogFactory;
+import org.apache.tomcat.util.res.StringManager;
+
+public class PrivilegedSetAccessControlContext implements 
PrivilegedAction {
+
+private static final Log log = 
LogFactory.getLog(PrivilegedSetAccessControlContext.class);
+private static final StringManager sm = 
StringManager.getManager(PrivilegedSetAccessControlContext.class);
+
+private static final AccessControlContext acc;
+private static final Field field;
+
+static {
+acc = AccessController.getContext();
+Field f = null;
+try {
+f = Thread.class.getDeclaredField("inheritedAccessControlContext");
+f.trySetAccessible();
+} catch (NoSuchFieldException | SecurityException e) {
+
log.warn(sm.getString("privilegedSetAccessControlContext.lookupFailed"), e);
+}
+field = f;
+}
+
+private final Thread t;
+
+
+public PrivilegedSetAccessControlContext(Thread t) {
+this.t = t;
+}
+
+
+@Override
+public Void run() {
+try {
+if (field != null) {
+field.set(t,  acc);
+}
+} catch (IllegalArgumentException | IllegalAccessException e) {
+
log.warn(sm.getString("privilegedSetAccessControlContext.setFailed"), e);
+}
+return null;
+}
+}
\ No newline at end of file
diff --git a/java/org/apache/tomcat/util/threads/TaskThreadFactory.java

[tomcat] 04/04: Remove BZ 65714 from the known issues

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit c244c3093531a35eb79f3a6204b9b1e69f3bed01
Author: Mark Thomas 
AuthorDate: Fri Dec 10 15:37:03 2021 +

Remove BZ 65714 from the known issues
---
 webapps/docs/security-manager-howto.xml | 4 
 1 file changed, 4 deletions(-)

diff --git a/webapps/docs/security-manager-howto.xml 
b/webapps/docs/security-manager-howto.xml
index f0c0779..6b81dd7 100644
--- a/webapps/docs/security-manager-howto.xml
+++ b/webapps/docs/security-manager-howto.xml
@@ -71,10 +71,6 @@
   that it will be removed in a future Java version. Users currently using a
   SecurityManager are recommended to start planning for its removal.
 
-  There is a known issue (bug 65714) using NIO2 with TLS under a
-  SecurityManager. The recommendation for users affected by this issue is to
-  either move away from using a SecurityManager or switch from NIO2 to NIO.
-
 
 
 

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[tomcat] 02/04: Revert the previous fix for BZ 65714.

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit e87af1001a09041ae221f024b10602f42b28d077
Author: Mark Thomas 
AuthorDate: Fri Dec 10 14:55:53 2021 +

Revert the previous fix for BZ 65714.

Dispatching from the handshake completion handler was addressing the
symptom of the lack of permissions rather than the cause.
---
 java/org/apache/tomcat/util/net/SecureNio2Channel.java | 18 --
 1 file changed, 4 insertions(+), 14 deletions(-)

diff --git a/java/org/apache/tomcat/util/net/SecureNio2Channel.java 
b/java/org/apache/tomcat/util/net/SecureNio2Channel.java
index 66daeb4..f0e4bb7 100644
--- a/java/org/apache/tomcat/util/net/SecureNio2Channel.java
+++ b/java/org/apache/tomcat/util/net/SecureNio2Channel.java
@@ -101,17 +101,12 @@ public class SecureNio2Channel extends Nio2Channel  {
 if (result.intValue() < 0) {
 failed(new EOFException(), attachment);
 } else {
-// When running under a security manager always dispatch so the
-// processing occurs on a thread with the correct security
-// context.
-endpoint.processSocket(attachment, SocketEvent.OPEN_READ, 
Constants.IS_SECURITY_ENABLED);
+endpoint.processSocket(attachment, SocketEvent.OPEN_READ, 
false);
 }
 }
 @Override
 public void failed(Throwable exc, SocketWrapperBase 
attachment) {
-// When running under a security manager always dispatch so the
-// processing occurs on a thread with the correct security context.
-endpoint.processSocket(attachment, SocketEvent.ERROR, 
Constants.IS_SECURITY_ENABLED);
+endpoint.processSocket(attachment, SocketEvent.ERROR, false);
 }
 }
 
@@ -123,17 +118,12 @@ public class SecureNio2Channel extends Nio2Channel  {
 if (result.intValue() < 0) {
 failed(new EOFException(), attachment);
 } else {
-// When running under a security manager always dispatch so the
-// processing occurs on a thread with the correct security
-// context.
-endpoint.processSocket(attachment, SocketEvent.OPEN_WRITE, 
Constants.IS_SECURITY_ENABLED);
+endpoint.processSocket(attachment, SocketEvent.OPEN_WRITE, 
false);
 }
 }
 @Override
 public void failed(Throwable exc, SocketWrapperBase 
attachment) {
-// When running under a security manager always dispatch so the
-// processing occurs on a thread with the correct security context.
-endpoint.processSocket(attachment, SocketEvent.ERROR, 
Constants.IS_SECURITY_ENABLED);
+endpoint.processSocket(attachment, SocketEvent.ERROR, false);
 }
 }
 

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[tomcat] branch 9.0.x updated (9400421 -> c244c30)

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a change to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git.


from 9400421  Document BZ 65714 as a known issue
 new 9bca801  Restore pre-starting of core threads lost in fix for BZ 65454
 new e87af10  Revert the previous fix for BZ 65714.
 new 9eb49f9  Improved fix for BZ 65714
 new c244c30  Remove BZ 65714 from the known issues

The 4 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Summary of changes:
 .../catalina/security/SecurityClassLoad.java   |  1 +
 .../apache/tomcat/util/net/SecureNio2Channel.java  | 18 ++
 .../tomcat/util/security/LocalStrings.properties   |  3 +
 .../PrivilegedSetAccessControlContext.java | 67 ++
 .../tomcat/util/threads/TaskThreadFactory.java | 12 +++-
 .../tomcat/util/threads/ThreadPoolExecutor.java|  2 +
 webapps/docs/changelog.xml |  8 +++
 webapps/docs/security-manager-howto.xml|  4 --
 8 files changed, 94 insertions(+), 21 deletions(-)
 create mode 100644 
java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[tomcat] 04/04: Remove BZ 65714 from the known issues

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch 10.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit 56c50a8fb9deb73844cddd2e1ea59331a69f4dc9
Author: Mark Thomas 
AuthorDate: Fri Dec 10 15:37:03 2021 +

Remove BZ 65714 from the known issues
---
 webapps/docs/security-manager-howto.xml | 4 
 1 file changed, 4 deletions(-)

diff --git a/webapps/docs/security-manager-howto.xml 
b/webapps/docs/security-manager-howto.xml
index f0c0779..6b81dd7 100644
--- a/webapps/docs/security-manager-howto.xml
+++ b/webapps/docs/security-manager-howto.xml
@@ -71,10 +71,6 @@
   that it will be removed in a future Java version. Users currently using a
   SecurityManager are recommended to start planning for its removal.
 
-  There is a known issue (bug 65714) using NIO2 with TLS under a
-  SecurityManager. The recommendation for users affected by this issue is to
-  either move away from using a SecurityManager or switch from NIO2 to NIO.
-
 
 
 

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[tomcat] 03/04: Improved fix for BZ 65714

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch 10.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit 9fa8196f024ce30c929c3543d0a41f41a0640d78
Author: Mark Thomas 
AuthorDate: Fri Dec 10 15:24:51 2021 +

Improved fix for BZ 65714

https://bz.apache.org/bugzilla/show_bug.cgi?id=65714
When running under a SecurityManager, ensure that newly created threads
inherit an appropriate AccessControlContext
---
 .../catalina/security/SecurityClassLoad.java   |  1 +
 .../tomcat/util/security/LocalStrings.properties   |  3 +
 .../PrivilegedSetAccessControlContext.java | 67 ++
 .../tomcat/util/threads/TaskThreadFactory.java | 12 +++-
 webapps/docs/changelog.xml |  4 ++
 5 files changed, 84 insertions(+), 3 deletions(-)

diff --git a/java/org/apache/catalina/security/SecurityClassLoad.java 
b/java/org/apache/catalina/security/SecurityClassLoad.java
index fe5dc61..9b76ba7 100644
--- a/java/org/apache/catalina/security/SecurityClassLoad.java
+++ b/java/org/apache/catalina/security/SecurityClassLoad.java
@@ -200,5 +200,6 @@ public final class SecurityClassLoad {
 // security
 loader.loadClass(basePackage + "util.security.PrivilegedGetTccl");
 loader.loadClass(basePackage + "util.security.PrivilegedSetTccl");
+loader.loadClass(basePackage + 
"util.security.PrivilegedSetAccessControlContext");
 }
 }
diff --git a/java/org/apache/tomcat/util/security/LocalStrings.properties 
b/java/org/apache/tomcat/util/security/LocalStrings.properties
index 577cd38..39e92df 100644
--- a/java/org/apache/tomcat/util/security/LocalStrings.properties
+++ b/java/org/apache/tomcat/util/security/LocalStrings.properties
@@ -14,3 +14,6 @@
 # limitations under the License.
 
 concurrentMessageDigest.noDigest=Digest algorithm unavailable
+
+privilegedSetAccessControlContext.lookupFailed=Unable to obtain reference to 
field Thread.inheritedAccessControlContext
+privilegedSetAccessControlContext.setFailed=Unable to set field 
Thread.inheritedAccessControlContext
diff --git 
a/java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java 
b/java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java
new file mode 100644
index 000..2f53480
--- /dev/null
+++ 
b/java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java
@@ -0,0 +1,67 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.tomcat.util.security;
+
+import java.lang.reflect.Field;
+import java.security.AccessControlContext;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+
+import org.apache.juli.logging.Log;
+import org.apache.juli.logging.LogFactory;
+import org.apache.tomcat.util.res.StringManager;
+
+public class PrivilegedSetAccessControlContext implements 
PrivilegedAction {
+
+private static final Log log = 
LogFactory.getLog(PrivilegedSetAccessControlContext.class);
+private static final StringManager sm = 
StringManager.getManager(PrivilegedSetAccessControlContext.class);
+
+private static final AccessControlContext acc;
+private static final Field field;
+
+static {
+acc = AccessController.getContext();
+Field f = null;
+try {
+f = Thread.class.getDeclaredField("inheritedAccessControlContext");
+f.trySetAccessible();
+} catch (NoSuchFieldException | SecurityException e) {
+
log.warn(sm.getString("privilegedSetAccessControlContext.lookupFailed"), e);
+}
+field = f;
+}
+
+private final Thread t;
+
+
+public PrivilegedSetAccessControlContext(Thread t) {
+this.t = t;
+}
+
+
+@Override
+public Void run() {
+try {
+if (field != null) {
+field.set(t,  acc);
+}
+} catch (IllegalArgumentException | IllegalAccessException e) {
+
log.warn(sm.getString("privilegedSetAccessControlContext.setFailed"), e);
+}
+return null;
+}
+}
\ No newline at end of file
diff --git a/java/org/apache/tomcat/util/threads/TaskThreadFactory.java

[tomcat] 02/04: Revert the previous fix for BZ 65714.

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch 10.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit eb4cab1db0eb9c65a0ea3350f418f04a788a28ef
Author: Mark Thomas 
AuthorDate: Fri Dec 10 14:55:53 2021 +

Revert the previous fix for BZ 65714.

Dispatching from the handshake completion handler was addressing the
symptom of the lack of permissions rather than the cause.
---
 java/org/apache/tomcat/util/net/SecureNio2Channel.java | 18 --
 1 file changed, 4 insertions(+), 14 deletions(-)

diff --git a/java/org/apache/tomcat/util/net/SecureNio2Channel.java 
b/java/org/apache/tomcat/util/net/SecureNio2Channel.java
index 66daeb4..f0e4bb7 100644
--- a/java/org/apache/tomcat/util/net/SecureNio2Channel.java
+++ b/java/org/apache/tomcat/util/net/SecureNio2Channel.java
@@ -101,17 +101,12 @@ public class SecureNio2Channel extends Nio2Channel  {
 if (result.intValue() < 0) {
 failed(new EOFException(), attachment);
 } else {
-// When running under a security manager always dispatch so the
-// processing occurs on a thread with the correct security
-// context.
-endpoint.processSocket(attachment, SocketEvent.OPEN_READ, 
Constants.IS_SECURITY_ENABLED);
+endpoint.processSocket(attachment, SocketEvent.OPEN_READ, 
false);
 }
 }
 @Override
 public void failed(Throwable exc, SocketWrapperBase 
attachment) {
-// When running under a security manager always dispatch so the
-// processing occurs on a thread with the correct security context.
-endpoint.processSocket(attachment, SocketEvent.ERROR, 
Constants.IS_SECURITY_ENABLED);
+endpoint.processSocket(attachment, SocketEvent.ERROR, false);
 }
 }
 
@@ -123,17 +118,12 @@ public class SecureNio2Channel extends Nio2Channel  {
 if (result.intValue() < 0) {
 failed(new EOFException(), attachment);
 } else {
-// When running under a security manager always dispatch so the
-// processing occurs on a thread with the correct security
-// context.
-endpoint.processSocket(attachment, SocketEvent.OPEN_WRITE, 
Constants.IS_SECURITY_ENABLED);
+endpoint.processSocket(attachment, SocketEvent.OPEN_WRITE, 
false);
 }
 }
 @Override
 public void failed(Throwable exc, SocketWrapperBase 
attachment) {
-// When running under a security manager always dispatch so the
-// processing occurs on a thread with the correct security context.
-endpoint.processSocket(attachment, SocketEvent.ERROR, 
Constants.IS_SECURITY_ENABLED);
+endpoint.processSocket(attachment, SocketEvent.ERROR, false);
 }
 }
 

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[tomcat] 01/04: Restore pre-starting of core threads lost in fix for BZ 65454

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch 10.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit 5003b83495df9be4a5caa4c72ddd48726171e965
Author: Mark Thomas 
AuthorDate: Fri Dec 10 14:52:06 2021 +

Restore pre-starting of core threads lost in fix for BZ 65454
---
 java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java | 2 ++
 webapps/docs/changelog.xml  | 4 
 2 files changed, 6 insertions(+)

diff --git a/java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java 
b/java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java
index 49a10af..d800cad 100644
--- a/java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java
+++ b/java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java
@@ -1366,6 +1366,8 @@ public class ThreadPoolExecutor extends 
AbstractExecutorService {
 this.keepAliveTime = unit.toNanos(keepAliveTime);
 this.threadFactory = threadFactory;
 this.handler = handler;
+
+prestartAllCoreThreads();
 }
 
 
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 94a4b41..2c46eec 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -112,6 +112,10 @@
 request includes a body. The maximum permitted size of the body is
 controlled by maxSavePostSize. (markt)
   
+  
+Restore pre-starting of minSpareThreads lost in the fix 
for
+65454. (markt)
+  
 
   
   

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[tomcat] branch 10.0.x updated (b00cc6a -> 56c50a8)

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a change to branch 10.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git.


from b00cc6a  Document BZ 65714 as a known issue
 new 5003b83  Restore pre-starting of core threads lost in fix for BZ 65454
 new eb4cab1  Revert the previous fix for BZ 65714.
 new 9fa8196  Improved fix for BZ 65714
 new 56c50a8  Remove BZ 65714 from the known issues

The 4 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Summary of changes:
 .../catalina/security/SecurityClassLoad.java   |  1 +
 .../apache/tomcat/util/net/SecureNio2Channel.java  | 18 ++
 .../tomcat/util/security/LocalStrings.properties   |  3 +
 .../PrivilegedSetAccessControlContext.java | 67 ++
 .../tomcat/util/threads/TaskThreadFactory.java | 12 +++-
 .../tomcat/util/threads/ThreadPoolExecutor.java|  2 +
 webapps/docs/changelog.xml |  8 +++
 webapps/docs/security-manager-howto.xml|  4 --
 8 files changed, 94 insertions(+), 21 deletions(-)
 create mode 100644 
java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[tomcat] 04/04: Remove BZ 65714 from the known issues

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit 6f9eb19a47ed8d414d718a782d671daa345d5940
Author: Mark Thomas 
AuthorDate: Fri Dec 10 15:37:03 2021 +

Remove BZ 65714 from the known issues
---
 webapps/docs/security-manager-howto.xml | 4 
 1 file changed, 4 deletions(-)

diff --git a/webapps/docs/security-manager-howto.xml 
b/webapps/docs/security-manager-howto.xml
index 8f8351b..b5d534c 100644
--- a/webapps/docs/security-manager-howto.xml
+++ b/webapps/docs/security-manager-howto.xml
@@ -71,10 +71,6 @@
   that it will be removed in a future Java version. Users currently using a
   SecurityManager are recommended to start planning for its removal.
 
-  There is a known issue (bug 65714) using NIO2 with TLS under a
-  SecurityManager. The recommendation for users affected by this issue is to
-  either move away from using a SecurityManager or switch from NIO2 to NIO.
-
 
 
 

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[tomcat] 03/04: Improved fix for BZ 65714

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit 0be5c8d8b24ef961a97d55535689e7520c60921b
Author: Mark Thomas 
AuthorDate: Fri Dec 10 15:24:51 2021 +

Improved fix for BZ 65714

https://bz.apache.org/bugzilla/show_bug.cgi?id=65714
When running under a SecurityManager, ensure that newly created threads
inherit an appropriate AccessControlContext
---
 .../catalina/security/SecurityClassLoad.java   |  1 +
 .../tomcat/util/security/LocalStrings.properties   |  3 +
 .../PrivilegedSetAccessControlContext.java | 67 ++
 .../tomcat/util/threads/TaskThreadFactory.java | 12 +++-
 webapps/docs/changelog.xml |  4 ++
 5 files changed, 84 insertions(+), 3 deletions(-)

diff --git a/java/org/apache/catalina/security/SecurityClassLoad.java 
b/java/org/apache/catalina/security/SecurityClassLoad.java
index 62951ec..67d5f37 100644
--- a/java/org/apache/catalina/security/SecurityClassLoad.java
+++ b/java/org/apache/catalina/security/SecurityClassLoad.java
@@ -199,5 +199,6 @@ public final class SecurityClassLoad {
 // security
 loader.loadClass(basePackage + "util.security.PrivilegedGetTccl");
 loader.loadClass(basePackage + "util.security.PrivilegedSetTccl");
+loader.loadClass(basePackage + 
"util.security.PrivilegedSetAccessControlContext");
 }
 }
diff --git a/java/org/apache/tomcat/util/security/LocalStrings.properties 
b/java/org/apache/tomcat/util/security/LocalStrings.properties
index 577cd38..39e92df 100644
--- a/java/org/apache/tomcat/util/security/LocalStrings.properties
+++ b/java/org/apache/tomcat/util/security/LocalStrings.properties
@@ -14,3 +14,6 @@
 # limitations under the License.
 
 concurrentMessageDigest.noDigest=Digest algorithm unavailable
+
+privilegedSetAccessControlContext.lookupFailed=Unable to obtain reference to 
field Thread.inheritedAccessControlContext
+privilegedSetAccessControlContext.setFailed=Unable to set field 
Thread.inheritedAccessControlContext
diff --git 
a/java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java 
b/java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java
new file mode 100644
index 000..2f53480
--- /dev/null
+++ 
b/java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java
@@ -0,0 +1,67 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.tomcat.util.security;
+
+import java.lang.reflect.Field;
+import java.security.AccessControlContext;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+
+import org.apache.juli.logging.Log;
+import org.apache.juli.logging.LogFactory;
+import org.apache.tomcat.util.res.StringManager;
+
+public class PrivilegedSetAccessControlContext implements 
PrivilegedAction {
+
+private static final Log log = 
LogFactory.getLog(PrivilegedSetAccessControlContext.class);
+private static final StringManager sm = 
StringManager.getManager(PrivilegedSetAccessControlContext.class);
+
+private static final AccessControlContext acc;
+private static final Field field;
+
+static {
+acc = AccessController.getContext();
+Field f = null;
+try {
+f = Thread.class.getDeclaredField("inheritedAccessControlContext");
+f.trySetAccessible();
+} catch (NoSuchFieldException | SecurityException e) {
+
log.warn(sm.getString("privilegedSetAccessControlContext.lookupFailed"), e);
+}
+field = f;
+}
+
+private final Thread t;
+
+
+public PrivilegedSetAccessControlContext(Thread t) {
+this.t = t;
+}
+
+
+@Override
+public Void run() {
+try {
+if (field != null) {
+field.set(t,  acc);
+}
+} catch (IllegalArgumentException | IllegalAccessException e) {
+
log.warn(sm.getString("privilegedSetAccessControlContext.setFailed"), e);
+}
+return null;
+}
+}
\ No newline at end of file
diff --git a/java/org/apache/tomcat/util/threads/TaskThreadFactory.java

[tomcat] 01/04: Restore pre-starting of core threads lost in fix for BZ 65454

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit 1fd977d6947b3c44462f7695f79c33804eb0369c
Author: Mark Thomas 
AuthorDate: Fri Dec 10 14:52:06 2021 +

Restore pre-starting of core threads lost in fix for BZ 65454
---
 java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java | 2 ++
 webapps/docs/changelog.xml  | 4 
 2 files changed, 6 insertions(+)

diff --git a/java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java 
b/java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java
index f17c881..1a92b89 100644
--- a/java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java
+++ b/java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java
@@ -1366,6 +1366,8 @@ public class ThreadPoolExecutor extends 
AbstractExecutorService {
 this.keepAliveTime = unit.toNanos(keepAliveTime);
 this.threadFactory = threadFactory;
 this.handler = handler;
+
+prestartAllCoreThreads();
 }
 
 
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index e7ab2d7..6750da3 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -121,6 +121,10 @@
 request includes a body. The maximum permitted size of the body is
 controlled by maxSavePostSize. (markt)
   
+  
+Restore pre-starting of minSpareThreads lost in the fix 
for
+65454. (markt)
+  
 
   
   

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[tomcat] branch main updated (ec74b01 -> 6f9eb19)

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a change to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git.


from ec74b01  Document BZ 65714 as a known issue
 new 1fd977d  Restore pre-starting of core threads lost in fix for BZ 65454
 new 072fcce  Revert the previous fix for BZ 65714.
 new 0be5c8d  Improved fix for BZ 65714
 new 6f9eb19  Remove BZ 65714 from the known issues

The 4 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Summary of changes:
 .../catalina/security/SecurityClassLoad.java   |  1 +
 .../apache/tomcat/util/net/SecureNio2Channel.java  | 18 ++
 .../tomcat/util/security/LocalStrings.properties   |  3 +
 .../PrivilegedSetAccessControlContext.java | 67 ++
 .../tomcat/util/threads/TaskThreadFactory.java | 12 +++-
 .../tomcat/util/threads/ThreadPoolExecutor.java|  2 +
 webapps/docs/changelog.xml |  8 +++
 webapps/docs/security-manager-howto.xml|  4 --
 8 files changed, 94 insertions(+), 21 deletions(-)
 create mode 100644 
java/org/apache/tomcat/util/security/PrivilegedSetAccessControlContext.java

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[tomcat] 02/04: Revert the previous fix for BZ 65714.

2021-12-10 Thread markt 
This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit 072fcce0ef6569e4c6110a505c91799e21fc5e30
Author: Mark Thomas 
AuthorDate: Fri Dec 10 14:55:53 2021 +

Revert the previous fix for BZ 65714.

Dispatching from the handshake completion handler was addressing the
symptom of the lack of permissions rather than the cause.
---
 java/org/apache/tomcat/util/net/SecureNio2Channel.java | 18 --
 1 file changed, 4 insertions(+), 14 deletions(-)

diff --git a/java/org/apache/tomcat/util/net/SecureNio2Channel.java 
b/java/org/apache/tomcat/util/net/SecureNio2Channel.java
index 5f1037f..56a9ebf 100644
--- a/java/org/apache/tomcat/util/net/SecureNio2Channel.java
+++ b/java/org/apache/tomcat/util/net/SecureNio2Channel.java
@@ -100,17 +100,12 @@ public class SecureNio2Channel extends Nio2Channel  {
 if (result.intValue() < 0) {
 failed(new EOFException(), attachment);
 } else {
-// When running under a security manager always dispatch so the
-// processing occurs on a thread with the correct security
-// context.
-endpoint.processSocket(attachment, SocketEvent.OPEN_READ, 
Constants.IS_SECURITY_ENABLED);
+endpoint.processSocket(attachment, SocketEvent.OPEN_READ, 
false);
 }
 }
 @Override
 public void failed(Throwable exc, SocketWrapperBase 
attachment) {
-// When running under a security manager always dispatch so the
-// processing occurs on a thread with the correct security context.
-endpoint.processSocket(attachment, SocketEvent.ERROR, 
Constants.IS_SECURITY_ENABLED);
+endpoint.processSocket(attachment, SocketEvent.ERROR, false);
 }
 }
 
@@ -122,17 +117,12 @@ public class SecureNio2Channel extends Nio2Channel  {
 if (result.intValue() < 0) {
 failed(new EOFException(), attachment);
 } else {
-// When running under a security manager always dispatch so the
-// processing occurs on a thread with the correct security
-// context.
-endpoint.processSocket(attachment, SocketEvent.OPEN_WRITE, 
Constants.IS_SECURITY_ENABLED);
+endpoint.processSocket(attachment, SocketEvent.OPEN_WRITE, 
false);
 }
 }
 @Override
 public void failed(Throwable exc, SocketWrapperBase 
attachment) {
-// When running under a security manager always dispatch so the
-// processing occurs on a thread with the correct security context.
-endpoint.processSocket(attachment, SocketEvent.ERROR, 
Constants.IS_SECURITY_ENABLED);
+endpoint.processSocket(attachment, SocketEvent.ERROR, false);
 }
 }
 

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 65714] HTTPS connection error using NIO2 with security manager enabled

2021-12-10 Thread bugzilla 
https://bz.apache.org/bugzilla/show_bug.cgi?id=65714

--- Comment #18 from Mark Thomas  ---
I now have a clearer picture of what is going on.

The fix for bug 65454 included an unintended change. The pre-starting of the
core thread pool was removed. I'll restore that shortly. It also made a bug
that was already present more obvious.

When running under a security manager, the NIO2 acceptor uses an
InnocuousThread to execute the completion handler for the acceptor. By design,
the access control context associated with InnocuousThread instances is empty.
When the accepted connection is passed to the executor, if a worker thread
needs to be created, that thread inherits the access control context of the
calling thread. When the calling thread is an InnocuousThread that access
control context is empty so the work thread does not have the permissions it
needs. That leads to security exceptions and failed requests.

If the core threads are pre-started they have the correct permissions and
depending on timing new threads that are started will either be started from
those threads and have the correct permissions or from the Acceptor and have
the wrong permissions.

The next step is to see if I can find a way to avoid this issue.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

Re: [External] : Re: JDK 18: Rampdown Phase 1 & Early-Access builds 27

2021-12-10 Thread David Delabassee 

Great! Thanks for the prompt feedback!

Regards,

--David

On 10/12/2021 09:54, Martin Grigorov wrote:

Hi David,

Apache Tomcat build and tests pass successfully with JDK 18-ea+27-1924 
on both Linux x86_64 and aarch64!


Regards,
Martin

On Fri, Dec 10, 2021 at 9:58 AM David Delabassee 
 wrote:


Mark,

Thank you for being part of the OpenJDK Quality Outreach Program. As
year-end 2021 approaches, I'd like to share some updates on JDK 18,
which is scheduled for General Availability on March 22, 2022.

JDK 18 has now entered Rampdown Phase One (RDP1) [1], which means
that
the main-line has been forked into a dedicated JDK 18 stabilization
repository. At this point, the overall JDK 18 feature set is now
frozen
and no additional JEPs will be targeted to JDK 18. Only low-risk
enhancements that add small bits of missing functionality or improve
usability might still be considered. The next few weeks should be
leveraged to try to identify and resolve as many issues as possible
(i.e. before JDK 18 enters the Release Candidates phase).

And as you can see below, JDK 18 EA Builds 26 & 27 include fixes for
issues that were reported by you! So thank you for your help
contributing to the overall quality of OpenJDK!

[1]
https://mail.openjdk.java.net/pipermail/jdk-dev/2021-December/006287.html


## JEP 400 - UTF-8 by Default

All JEPs are now integrated, but we would like to draw your
attention to
JEP 400 especially if you are deploying on Windows as it might induce
some incompatible behavior on that platform.

JEP 400 [2] is changing the default charset to UTF-8. This aligns
with
the existing `newBufferedReader`/`Writer` methods of the
`java.nio.file.Files` class where UTF-8 is the default when no
explicit
charset is set. By making UTF-8 the default charset, the JDK I/O APIs
will now always work in the same, predictable manner, with no need to
pay attention to the host and or user’s environment!

Further, we encourage you to test your project(s) with the latest
JDK 18
Early Access builds. We don't expect issues on macOS and Linux as
their
default encoding is already UTF-8. On Windows, especially for East
Asian
locales such as Chinese/Japanese/Korean, some incompatible behavior
could be anticipated. If that’s the case, please consider a
mitigation
strategy [3].

[2] https://openjdk.java.net/jeps/400
[3] https://inside.java/2021/10/04/the-default-charset-jep400/




## JDK 18

JDK 18 Early-Access builds 27 are now available [4], and are provided
under the GNU General Public License v2, with the Classpath
Exception.
Make sure to check the Release Notes [5]. As usual, we encourage
you to
test your project(s) using those EA builds and provide us feedback.

[4] https://jdk.java.net/18/


[5] https://jdk.java.net/18/release-notes



### JEPs integrated to JDK 18:

- JEP 400: UTF-8 by Default
- JEP 408: Simple Web Server
- JEP 413: Code Snippets in Java API Documentation
- JEP 416: Reimplement Core Reflection with Method Handles
- JEP 417: Vector API (Third Incubator)
- JEP 418: Internet-Address Resolution SPI
- JEP 419: Foreign Function & Memory API (Second Incubator)
- JEP 420: Pattern Matching for switch (Second Preview)
- JEP 421: Deprecate Finalization for Removal

### Changes in recent builds that maybe of interest:

 Build 27:

- JDK-8266435: WBMPImageReader.read() should not truncate the input
stream [Reported by PDFBox]
- JDK-8278078: Cannot reference super before supertype constructor
has
been called
- JDK-8177819: DateTimeFormatterBuilder zone parsing should
recognise DST
- JDK-8277965: Enclosing instance optimization affects serialization
- JDK-8275821: Optimize random number generators developed in
JDK-8248862 using Math.unsignedMultiplyHigh()
- JDK-8225181: KeyStore should have a getAttributes method
- JDK-8275082: Update XML Security for Java to 2.3.0
- JDK-8278270: ServerSocket is not thread safe
- JDK-8277863: Deprecate sun.misc.Unsafe methods that return offsets

 Build 26:

- JDK-8277451: j.l.r.Field::set on static field with invalid argument
type should throw IAE [Reported by Hibernate & ByteBuddy]
- JDK-8258117: jar tool sets the time stamp of module-info.class
entries
to the

[Bug 65736] Improve org.apache.naming.factory.BeanFactory to mitigate JNDI injection

2021-12-10 Thread bugzilla 
https://bz.apache.org/bugzilla/show_bug.cgi?id=65736

--- Comment #1 from quaff  ---
Can we drop "forceString" supports?

https://github.com/apache/tomcat/blob/f5a732e74e2a36442b2bf562c665917c4bb1167a/java/org/apache/naming/factory/BeanFactory.java#L150

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

Re: JDK 18: Rampdown Phase 1 & Early-Access builds 27

2021-12-10 Thread Rémy Maucherat 
On Fri, Dec 10, 2021 at 8:58 AM David Delabassee
 wrote:
>
> Mark,
>
> Thank you for being part of the OpenJDK Quality Outreach Program. As
> year-end 2021 approaches, I'd like to share some updates on JDK 18,
> which is scheduled for General Availability on March 22, 2022.
>
> JDK 18 has now entered Rampdown Phase One (RDP1) [1], which means that
> the main-line has been forked into a dedicated JDK 18 stabilization
> repository. At this point, the overall JDK 18 feature set is now frozen
> and no additional JEPs will be targeted to JDK 18. Only low-risk
> enhancements that add small bits of missing functionality or improve
> usability might still be considered. The next few weeks should be
> leveraged to try to identify and resolve as many issues as possible
> (i.e. before JDK 18 enters the Release Candidates phase).
>
> And as you can see below, JDK 18 EA Builds 26 & 27 include fixes for
> issues that were reported by you! So thank you for your help
> contributing to the overall quality of OpenJDK!
>
> [1]
> https://mail.openjdk.java.net/pipermail/jdk-dev/2021-December/006287.html
>
>
> ## JEP 400 - UTF-8 by Default
>
> All JEPs are now integrated, but we would like to draw your attention to
> JEP 400 especially if you are deploying on Windows as it might induce
> some incompatible behavior on that platform.
>
> JEP 400 [2] is changing the default charset to UTF-8. This aligns with
> the existing `newBufferedReader`/`Writer` methods of the
> `java.nio.file.Files` class where UTF-8 is the default when no explicit
> charset is set. By making UTF-8 the default charset, the JDK I/O APIs
> will now always work in the same, predictable manner, with no need to
> pay attention to the host and or user’s environment!
>
> Further, we encourage you to test your project(s) with the latest JDK 18
> Early Access builds. We don't expect issues on macOS and Linux as their
> default encoding is already UTF-8. On Windows, especially for East Asian
> locales such as Chinese/Japanese/Korean, some incompatible behavior
> could be anticipated. If that’s the case, please consider a mitigation
> strategy [3].
>
> [2] https://openjdk.java.net/jeps/400
> [3] https://inside.java/2021/10/04/the-default-charset-jep400/
>
>
> ## JDK 18
>
> JDK 18 Early-Access builds 27 are now available [4], and are provided
> under the GNU General Public License v2, with the Classpath Exception.
> Make sure to check the Release Notes [5]. As usual, we encourage you to
> test your project(s) using those EA builds and provide us feedback.
>
> [4] https://jdk.java.net/18/
> [5] https://jdk.java.net/18/release-notes
>
> ### JEPs integrated to JDK 18:
>
> - JEP 400: UTF-8 by Default
> - JEP 408: Simple Web Server
> - JEP 413: Code Snippets in Java API Documentation
> - JEP 416: Reimplement Core Reflection with Method Handles
> - JEP 417: Vector API (Third Incubator)
> - JEP 418: Internet-Address Resolution SPI
> - JEP 419: Foreign Function & Memory API (Second Incubator)

So this was a significant build for this one. No issues found, now
hoping for a smooth transition to java.base (in Java 19 ?).

Rémy

> - JEP 420: Pattern Matching for switch (Second Preview)
> - JEP 421: Deprecate Finalization for Removal
>
> ### Changes in recent builds that maybe of interest:
>
>  Build 27:
>
> - JDK-8266435: WBMPImageReader.read() should not truncate the input
> stream [Reported by PDFBox]
> - JDK-8278078: Cannot reference super before supertype constructor has
> been called
> - JDK-8177819: DateTimeFormatterBuilder zone parsing should recognise DST
> - JDK-8277965: Enclosing instance optimization affects serialization
> - JDK-8275821: Optimize random number generators developed in
> JDK-8248862 using Math.unsignedMultiplyHigh()
> - JDK-8225181: KeyStore should have a getAttributes method
> - JDK-8275082: Update XML Security for Java to 2.3.0
> - JDK-8278270: ServerSocket is not thread safe
> - JDK-8277863: Deprecate sun.misc.Unsafe methods that return offsets
>
>  Build 26:
>
> - JDK-8277451: j.l.r.Field::set on static field with invalid argument
> type should throw IAE [Reported by Hibernate & ByteBuddy]
> - JDK-8258117: jar tool sets the time stamp of module-info.class entries
> to the current time [Reported by Apache Maven]
> - JDK-8268743: Require a better way for copying data between
> MemorySegments and on-heap arrays [Reported by Apache Lucene]
> - JDK-8277986: Typo in javadoc of java.util.zip.ZipEntry#setTime
> [Reported by Apache Ant]
> - JDK-8277861: Terminally deprecate Thread.stop
> - JDK-8276665: ObjectInputStream.GetField.get(name, object) should throw
> ClassNotFoundException
> - JDK-8271623: Omit enclosing instance fields from inner classes that
> don't use it
> - JDK-8231107: Allow store password to be null when saving a PKCS12 KeyStore
> - JDK-8193682: Infinite loop in ZipOutputStream.close()
> - JDK-8277459: Add `jwebserver` tool [see Topics of Interest]
>
>  Build 25:
>
> - JDK-8259643: ZGC can return metaspace OOM prematurely
> -

Re: JDK 18: Rampdown Phase 1 & Early-Access builds 27

2021-12-10 Thread Martin Grigorov 
Hi David,

Apache Tomcat build and tests pass successfully with JDK 18-ea+27-1924 on
both Linux x86_64 and aarch64!

Regards,
Martin

On Fri, Dec 10, 2021 at 9:58 AM David Delabassee <
david.delabas...@oracle.com> wrote:

> Mark,
>
> Thank you for being part of the OpenJDK Quality Outreach Program. As
> year-end 2021 approaches, I'd like to share some updates on JDK 18,
> which is scheduled for General Availability on March 22, 2022.
>
> JDK 18 has now entered Rampdown Phase One (RDP1) [1], which means that
> the main-line has been forked into a dedicated JDK 18 stabilization
> repository. At this point, the overall JDK 18 feature set is now frozen
> and no additional JEPs will be targeted to JDK 18. Only low-risk
> enhancements that add small bits of missing functionality or improve
> usability might still be considered. The next few weeks should be
> leveraged to try to identify and resolve as many issues as possible
> (i.e. before JDK 18 enters the Release Candidates phase).
>
> And as you can see below, JDK 18 EA Builds 26 & 27 include fixes for
> issues that were reported by you! So thank you for your help
> contributing to the overall quality of OpenJDK!
>
> [1]
> https://mail.openjdk.java.net/pipermail/jdk-dev/2021-December/006287.html
>
>
> ## JEP 400 - UTF-8 by Default
>
> All JEPs are now integrated, but we would like to draw your attention to
> JEP 400 especially if you are deploying on Windows as it might induce
> some incompatible behavior on that platform.
>
> JEP 400 [2] is changing the default charset to UTF-8. This aligns with
> the existing `newBufferedReader`/`Writer` methods of the
> `java.nio.file.Files` class where UTF-8 is the default when no explicit
> charset is set. By making UTF-8 the default charset, the JDK I/O APIs
> will now always work in the same, predictable manner, with no need to
> pay attention to the host and or user’s environment!
>
> Further, we encourage you to test your project(s) with the latest JDK 18
> Early Access builds. We don't expect issues on macOS and Linux as their
> default encoding is already UTF-8. On Windows, especially for East Asian
> locales such as Chinese/Japanese/Korean, some incompatible behavior
> could be anticipated. If that’s the case, please consider a mitigation
> strategy [3].
>
> [2] https://openjdk.java.net/jeps/400
> [3] https://inside.java/2021/10/04/the-default-charset-jep400/
>
>
> ## JDK 18
>
> JDK 18 Early-Access builds 27 are now available [4], and are provided
> under the GNU General Public License v2, with the Classpath Exception.
> Make sure to check the Release Notes [5]. As usual, we encourage you to
> test your project(s) using those EA builds and provide us feedback.
>
> [4] https://jdk.java.net/18/
> [5] https://jdk.java.net/18/release-notes
>
> ### JEPs integrated to JDK 18:
>
> - JEP 400: UTF-8 by Default
> - JEP 408: Simple Web Server
> - JEP 413: Code Snippets in Java API Documentation
> - JEP 416: Reimplement Core Reflection with Method Handles
> - JEP 417: Vector API (Third Incubator)
> - JEP 418: Internet-Address Resolution SPI
> - JEP 419: Foreign Function & Memory API (Second Incubator)
> - JEP 420: Pattern Matching for switch (Second Preview)
> - JEP 421: Deprecate Finalization for Removal
>
> ### Changes in recent builds that maybe of interest:
>
>  Build 27:
>
> - JDK-8266435: WBMPImageReader.read() should not truncate the input
> stream [Reported by PDFBox]
> - JDK-8278078: Cannot reference super before supertype constructor has
> been called
> - JDK-8177819: DateTimeFormatterBuilder zone parsing should recognise DST
> - JDK-8277965: Enclosing instance optimization affects serialization
> - JDK-8275821: Optimize random number generators developed in
> JDK-8248862 using Math.unsignedMultiplyHigh()
> - JDK-8225181: KeyStore should have a getAttributes method
> - JDK-8275082: Update XML Security for Java to 2.3.0
> - JDK-8278270: ServerSocket is not thread safe
> - JDK-8277863: Deprecate sun.misc.Unsafe methods that return offsets
>
>  Build 26:
>
> - JDK-8277451: j.l.r.Field::set on static field with invalid argument
> type should throw IAE [Reported by Hibernate & ByteBuddy]
> - JDK-8258117: jar tool sets the time stamp of module-info.class entries
> to the current time [Reported by Apache Maven]
> - JDK-8268743: Require a better way for copying data between
> MemorySegments and on-heap arrays [Reported by Apache Lucene]
> - JDK-8277986: Typo in javadoc of java.util.zip.ZipEntry#setTime
> [Reported by Apache Ant]
> - JDK-8277861: Terminally deprecate Thread.stop
> - JDK-8276665: ObjectInputStream.GetField.get(name, object) should throw
> ClassNotFoundException
> - JDK-8271623: Omit enclosing instance fields from inner classes that
> don't use it
> - JDK-8231107: Allow store password to be null when saving a PKCS12
> KeyStore
> - JDK-8193682: Infinite loop in ZipOutputStream.close()
> - JDK-8277459: Add `jwebserver` tool [see Topics of Interest]
>
>  Build 25:
>
> - JDK-8259643: ZGC can return

[Bug 65736] New: Improve org.apache.naming.factory.BeanFactory to mitigate JNDI injection

2021-12-10 Thread bugzilla 
https://bz.apache.org/bugzilla/show_bug.cgi?id=65736

Bug ID: 65736
   Summary: Improve org.apache.naming.factory.BeanFactory to
mitigate JNDI injection
   Product: Tomcat 9
   Version: 9.0.55
  Hardware: PC
OS: Mac OS X 10.1
Status: NEW
  Severity: normal
  Priority: P2
 Component: Catalina
  Assignee: dev@tomcat.apache.org
  Reporter: zhouyanm...@gmail.com
  Target Milestone: -

I can reproduce that vulnerability which leverage
"org.apache.naming.factory.BeanFactory" and "javax.el.ELProcessor" described in
https://www.veracode.com/blog/research/exploiting-jndi-injections-java
It would be great if tomcat can do something to mitigate it.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 59569] isWrapperFor/unwrap implementations incorrect

2021-12-10 Thread bugzilla 
https://bz.apache.org/bugzilla/show_bug.cgi?id=59569

martin.gantenb...@gmail.com changed:

   What|Removed |Added

 CC||martin.gantenb...@gmail.com

--- Comment #1 from martin.gantenb...@gmail.com ---
This bug affects Tomcat DataSources used in a wrapping DataSource (example:
https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/jdbc/datasource/DelegatingDataSource.html).

If you wrap a Tomcat DataSource in such a DataSource, there are the following
problems:

1. wrapper.isWrapperFor(org.apache.tomcat.jdbc.pool.DataSource.class) wrongly
returns false
2. wrapper.unwrap(org.apache.tomcat.jdbc.pool.DataSource.class) wrongly returns
null instead of the Tomcat DataSource
3. wrapper.unwrap(org.apache.tomcat.jdbc.pool.DataSource) wrongly returns null
instead of throwing an SQLException

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org