Turning on the Invoker Servlet

[Alain Lemay <se...@liamekaens.com>]

Java version: 1.8.0_401
Tomcat version: 9.0.87
Operating system: macOS Big Sur
System Version: macOS 11.7.10 (20G1427)
Kernel Version: Darwin 20.6.0

Hi,

I want to familiarize myself with JavaServer Pages. A long time ago, I acquired the book Core Servlets and Java Server Pages Volume 1: Core Technologies by authors Marty Hall and Larry Brown (ISBN 0-13-009229-0).

Even though this book was published in 2004, it nevertheless remains a good reference for someone who wants to get started with Jsp technology. In any case, that's what we judge when we consult the comments on the Internet.

The unfortunate thing is that this book covers the JSP 2.0 and Servlet 2.4 specifications in depth while my version of Tomcat (9.0.87) supports JSP 2.3 and Servlets 4.0.

In the Tomcat configuration part of the book, I am told to enable the Servlet invoker by uncommenting the following lines from the <install dir>/conf/web.xml file:

    <servlet-mapping>
        <servlet-name>invoker</servlet-name>
        <url-pattern>/servlet/*</url-pattern>
    </servlet-mapping>

Which makes it easy to invoke classes in the WEB-INF/classes directory using the URL http://host/servlet/ServletName

However, these lines no longer exist in version 9.0.87 of the Tomcat web.xml file and even if I wanted to recreate the old configuration, the org.apache.catalina.servlets.InvokerServlet class no longer exists either.

For now, I have created mappings manually to make it work, but I would like the exercises in the book to work as is and my environment to be configured accordingly. Can you tell me how can I do this or if this feature has been permanently removed from Tomcat. Thank you in advance for your response.

Sincerely,
A. Lemay

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: Turning on the Invoker Servlet

[Chuck Caldarale <n8...@gmail.com>]

> On Apr 6, 2024, at 13:30, Alain Lemay <se...@liamekaens.com> wrote:
> 
> Java version: 1.8.0_401
> Tomcat version: 9.0.87
> Operating system: macOS Big Sur
> System Version: macOS 11.7.10 (20G1427)


BTW, macOS 11 reached end-of-life some months ago.


> Kernel Version: Darwin 20.6.0
> 
> I want to familiarize myself with JavaServer Pages. A long time ago, I acquired the book Core Servlets and Java Server Pages Volume 1: Core Technologies by authors Marty Hall and Larry Brown (ISBN 0-13-009229-0).
> 
> Even though this book was published in 2004, it nevertheless remains a good reference for someone who wants to get started with Jsp technology. In any case, that's what we judge when we consult the comments on the Internet.


Except that the book's age renders it somewhat misleading and, in some cases, dangerous. Something newer would be highly recommended.


> The unfortunate thing is that this book covers the JSP 2.0 and Servlet 2.4 specifications in depth while my version of Tomcat (9.0.87) supports JSP 2.3 and Servlets 4.0.
> 
> In the Tomcat configuration part of the book, I am told to enable the Servlet invoker by uncommenting the following lines from the <install dir>/conf/web.xml file:
> 
>    <servlet-mapping>
>        <servlet-name>invoker</servlet-name>
>        <url-pattern>/servlet/*</url-pattern>
>    </servlet-mapping>
> 
> Which makes it easy to invoke classes in the WEB-INF/classes directory using the URL http://host/servlet/ServletName


Unfortunately, way too easy, leading to security risks, among other problems.


> However, these lines no longer exist in version 9.0.87 of the Tomcat web.xml file and even if I wanted to recreate the old configuration, the org.apache.catalina.servlets.InvokerServlet class no longer exists either.


For good reason. You might want to take a look at these pages:

https://cwiki.apache.org/confluence/display/TOMCAT/Miscellaneous#Miscellaneous-Q3

https://coderanch.com/wiki/660115/Invoker-Servlet


> For now, I have created mappings manually to make it work


That is how it should be done. It was rather disingenuous of the book’s author to use the invoker servlet, since that was never part of the spec.


> Can you tell me how can I do this or if this feature has been permanently removed from Tomcat.


Permanently removed, thankfully.

  - Chuck