It seems Tomcat shares libraries between web applications

[Artur Swat <ar...@edps.com.pl>]

Hello,

	I installed Tomcat using apache-tomcat-9.0.54.exe, configured
server.xml to set up a database connection as Resource in
GlobalNamingResources section. Tomcat\webapps directory has two web
applications, let's say X and Y. Both should connect to Oracle database
using ojdbc driver. Tomcat\lib has only libraries installed by default,
there is no ojdbc*.jar here. By a mistake I added ojdbc8-21.7.0.0.jar only
for webapp X, so Y did not have JDBC driver at all. But both web apps
connected to the database, while Y should not connect. I verified tomcat
directory content using "dir ojdbc*.jar /s" inside installation folder, it
found only 2 ojdbc*.jar locations:
1) tomcat\webapps\X\WEB-INF\lib,
2) tomcat\temp\1-X\WEB-INF\lib.

According to
https://tomcat.apache.org/tomcat-9.0-doc/class-loader-howto.html app Y
should not get a JDBC driver, that only exists in X lib directory. I added a
Java parameter "-verbose:class", it logged loading class OracleDriver from
file tomcat/temp/1-X/WEB-INF/lib/ojdbc8-21.7.0.0.jar - only from this file,
so there was no other jdbc driver.

I made following actions:
a) stop Tomcat service,
b) delete "tomcat\webapps\X" and "tomcat\webapps\X.war",
c) start Tomcat.
The result was "java.lang.ClassNotFoundException: oracle.jdbc.OracleDriver"
for app Y. So app Y really got ojdbc library from app X: if I copy X.war to
tomcat\webapps, then app Y immediately can connect to a database.

Apache Tomcat versions: I spotted it on 9.0.54, after upgrade to 9.0.68
observed same behaviour. Java version is 1.8.0_202 (Oracle build). OS:
Windows 10 21H2. 


How app Y can get a library from app X? Is tomcat\temp shared between web
applications?


---

Best regards

Artur Swat



---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: It seems Tomcat shares libraries between web applications

[Mark Thomas <ma...@apache.org>]

On 13/10/2022 14:17, Artur Swat wrote:
> How app Y can get a library from app X? Is tomcat\temp shared between web
> applications?

If you define a DataSource as a global resource then the associated JDBC 
driver has to be loaded by the Common class loader. That makes it 
visible to all web applications.

Mark

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org