You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2006/10/02 00:43:12 UTC
svn commit: r451831 - in
/tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core:
ApplicationDispatcher.java ApplicationFilterChain.java
LocalStrings.properties
Author: markt
Date: Sun Oct 1 15:43:11 2006
New Revision: 451831
URL: http://svn.apache.org/viewvc?view=rev&rev=451831
Log:
Fix bug 34956. Ensure requestDispatchers are called with original or wrapped original request/response objects as per SRV.8.2 and SRV.14.2.5.1
Modified:
tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core/ApplicationDispatcher.java
tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core/ApplicationFilterChain.java
tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core/LocalStrings.properties
Modified: tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core/ApplicationDispatcher.java
URL: http://svn.apache.org/viewvc/tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core/ApplicationDispatcher.java?view=diff&rev=451831&r1=451830&r2=451831
==============================================================================
--- tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core/ApplicationDispatcher.java (original)
+++ tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core/ApplicationDispatcher.java Sun Oct 1 15:43:11 2006
@@ -323,6 +323,9 @@
// Set up to handle the specified request and response
setup(request, response, false);
+
+ // Check SRV.8.2 / SRV.14.2.5.1 compliance
+ checkSameObjects();
// Identify the HTTP-specific request and response objects (if any)
HttpServletRequest hrequest = null;
@@ -506,6 +509,9 @@
// Set up to handle the specified request and response
setup(request, response, true);
+ // Check SRV.8.2 / SRV.14.2.5.1 compliance
+ checkSameObjects();
+
// Create a wrapped response to use for this request
// ServletResponse wresponse = null;
ServletResponse wresponse = wrapResponse();
@@ -958,4 +964,50 @@
}
+ private void checkSameObjects() throws ServletException {
+ ServletRequest originalRequest =
+ ApplicationFilterChain.getLastServicedRequest();
+ ServletResponse originalResponse =
+ ApplicationFilterChain.getLastServicedResponse();
+
+ boolean same = false;
+ ServletRequest dispatchedRequest = appRequest;
+
+ while (!same) {
+ if (originalRequest.equals(dispatchedRequest)) {
+ same = true;
+ }
+ if (!same && dispatchedRequest instanceof ServletRequestWrapper) {
+ dispatchedRequest =
+ ((ServletRequestWrapper) dispatchedRequest).getRequest();
+ } else {
+ break;
+ }
+ }
+ if (!same) {
+ throw new ServletException(sm.getString(
+ "applicationDispatcher.specViolation.request"));
+ }
+
+ same = false;
+ ServletResponse dispatchedResponse = appResponse;
+
+ while (!same) {
+ if (originalResponse.equals(dispatchedResponse)) {
+ same = true;
+ }
+
+ if (!same && dispatchedResponse instanceof ServletResponseWrapper) {
+ dispatchedResponse =
+ ((ServletResponseWrapper) dispatchedResponse).getResponse();
+ } else {
+ break;
+ }
+ }
+
+ if (!same) {
+ throw new ServletException(sm.getString(
+ "applicationDispatcher.specViolation.response"));
+ }
+ }
}
Modified: tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core/ApplicationFilterChain.java
URL: http://svn.apache.org/viewvc/tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core/ApplicationFilterChain.java?view=diff&rev=451831&r1=451830&r2=451831
==============================================================================
--- tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core/ApplicationFilterChain.java (original)
+++ tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core/ApplicationFilterChain.java Sun Oct 1 15:43:11 2006
@@ -49,7 +49,10 @@
final class ApplicationFilterChain implements FilterChain {
-
+ // Used to enforce requirements of SRV.8.2 / SRV.14.2.5.1
+ private static ThreadLocal lastServicedRequest = new ThreadLocal();
+ private static ThreadLocal lastServicedResponse = new ThreadLocal();
+
// -------------------------------------------------------------- Constants
@@ -231,6 +234,8 @@
// We fell off the end of the chain -- call the servlet instance
try {
+ lastServicedRequest.set(request);
+ lastServicedResponse.set(response);
support.fireInstanceEvent(InstanceEvent.BEFORE_SERVICE_EVENT,
servlet, request, response);
if ((request instanceof HttpServletRequest) &&
@@ -274,6 +279,9 @@
servlet, request, response, e);
throw new ServletException
(sm.getString("filterChain.servlet"), e);
+ } finally {
+ lastServicedRequest.set(null);
+ lastServicedResponse.set(null);
}
}
@@ -338,5 +346,26 @@
}
+
+ /**
+ * The last request passed to a servlet for servicing from the current
+ * thread.
+ *
+ * @return The last request to be serviced.
+ */
+ public static ServletRequest getLastServicedRequest() {
+ return (ServletRequest) lastServicedRequest.get();
+ }
+
+
+ /**
+ * The last response passed to a servlet for servicing from the current
+ * thread.
+ *
+ * @return The last response to be serviced.
+ */
+ public static ServletResponse getLastServicedResponse() {
+ return (ServletResponse) lastServicedResponse.get();
+ }
}
Modified: tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core/LocalStrings.properties
URL: http://svn.apache.org/viewvc/tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core/LocalStrings.properties?view=diff&rev=451831&r1=451830&r2=451831
==============================================================================
--- tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core/LocalStrings.properties (original)
+++ tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core/LocalStrings.properties Sun Oct 1 15:43:11 2006
@@ -10,6 +10,8 @@
applicationDispatcher.include.throw=Included resource threw an exception
applicationDispatcher.isUnavailable=Servlet {0} is currently unavailable
applicationDispatcher.serviceException=Servlet.service() for servlet {0} threw exception
+applicationDispatcher.specViolation.request=Original SevletRequest or wrapped original ServletRequest not passed to RequestDispatcher in violation of SRV.8.2 and SRV.14.2.5.1
+applicationDispatcher.specViolation.response=Original SevletResponse or wrapped original ServletResponse not passed to RequestDispatcher in violation of SRV.8.2 and SRV.14.2.5.1
applicationRequest.badParent=Cannot locate parent Request implementation
applicationRequest.badRequest=Request is not a javax.servlet.ServletRequestWrapper
applicationResponse.badParent=Cannot locate parent Response implementation
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: svn commit: r451831 - in /tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core:
ApplicationDispatcher.java ApplicationFilterChain.java LocalStrings.properties
Posted by Mark Thomas <ma...@apache.org>.
Bill Barker wrote:
> I'd have probably been less strict, and just thrown an ISE from
> ApplicationDispatcher.wrapRequest/wrapResponse. Mine allows somebody that
> really wants to program against Tomcat sidestep the check, but doesn't add
> as much overhead.
I see how this would be lower overhead since wrapRequest/wrapResponse
gets to the 'original' request but they don't get called for non-HTTP
cases (an unusual case admittedly but we are in the area of strict
compliance with this patch) and I don't get the sidestep bit - can you
elaborate?
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: svn commit: r451831 - in /tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core: ApplicationDispatcher.java ApplicationFilterChain.java LocalStrings.properties
Posted by Bill Barker <wb...@wilshire.com>.
"Mark Thomas" <ma...@apache.org> wrote in message
news:452046AD.5070207@apache.org...
> Remy Maucherat wrote:
>> markt@apache.org wrote:
>>> Author: markt
>>> Date: Sun Oct 1 15:43:11 2006
>>> New Revision: 451831
>>>
>>> URL: http://svn.apache.org/viewvc?view=rev&rev=451831
>>> Log:
>>> Fix bug 34956. Ensure requestDispatchers are called with original or
>>> wrapped original request/response objects as per SRV.8.2 and
>>> SRV.14.2.5.1
>>
>> I think this "fix" is very evil enabled by default.
>
> I tend to agree on the grounds it is pretty pointless (BTW if you can
> see a better way of implementing it I'd be happy to come up with an
> alternative patch).
>
I'd have probably been less strict, and just thrown an ISE from
ApplicationDispatcher.wrapRequest/wrapResponse. Mine allows somebody that
really wants to program against Tomcat sidestep the check, but doesn't add
as much overhead.
> I don't see why the spec requires this but it does. How about porting
> the Globals.STRICT_SERVLET_COMPLIANCE feature from the 6.x branch?
>
> Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: svn commit: r451831 - in /tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core:
ApplicationDispatcher.java ApplicationFilterChain.java LocalStrings.properties
Posted by Remy Maucherat <re...@apache.org>.
Mark Thomas wrote:
> Remy Maucherat wrote:
>> markt@apache.org wrote:
>>> Author: markt
>>> Date: Sun Oct 1 15:43:11 2006
>>> New Revision: 451831
>>>
>>> URL: http://svn.apache.org/viewvc?view=rev&rev=451831
>>> Log:
>>> Fix bug 34956. Ensure requestDispatchers are called with original or
>>> wrapped original request/response objects as per SRV.8.2 and SRV.14.2.5.1
>> I think this "fix" is very evil enabled by default.
>
> I tend to agree on the grounds it is pretty pointless (BTW if you can
> see a better way of implementing it I'd be happy to come up with an
> alternative patch).
>
> I don't see why the spec requires this but it does. How about porting
> the Globals.STRICT_SERVLET_COMPLIANCE feature from the 6.x branch?
Sure, it probably gives all the needed flexibility.
Rémy
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: svn commit: r451831 - in /tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core:
ApplicationDispatcher.java ApplicationFilterChain.java LocalStrings.properties
Posted by Mark Thomas <ma...@apache.org>.
Remy Maucherat wrote:
> markt@apache.org wrote:
>> Author: markt
>> Date: Sun Oct 1 15:43:11 2006
>> New Revision: 451831
>>
>> URL: http://svn.apache.org/viewvc?view=rev&rev=451831
>> Log:
>> Fix bug 34956. Ensure requestDispatchers are called with original or
>> wrapped original request/response objects as per SRV.8.2 and SRV.14.2.5.1
>
> I think this "fix" is very evil enabled by default.
I tend to agree on the grounds it is pretty pointless (BTW if you can
see a better way of implementing it I'd be happy to come up with an
alternative patch).
I don't see why the spec requires this but it does. How about porting
the Globals.STRICT_SERVLET_COMPLIANCE feature from the 6.x branch?
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: svn commit: r451831 - in /tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core:
ApplicationDispatcher.java ApplicationFilterChain.java LocalStrings.properties
Posted by Remy Maucherat <re...@apache.org>.
markt@apache.org wrote:
> Author: markt
> Date: Sun Oct 1 15:43:11 2006
> New Revision: 451831
>
> URL: http://svn.apache.org/viewvc?view=rev&rev=451831
> Log:
> Fix bug 34956. Ensure requestDispatchers are called with original or wrapped original request/response objects as per SRV.8.2 and SRV.14.2.5.1
I think this "fix" is very evil enabled by default.
Rémy
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org