You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2025/02/21 10:52:24 UTC
(tomcat) branch 10.1.x updated (8829e96c45 -> 9a229601c4)
This is an automated email from the ASF dual-hosted git repository.
markt pushed a change to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
from 8829e96c45 Add specific test for TE parsing
new 0bf881aa6a Remove the case sensitivity check
new 9a229601c4 Fix Java 21 version detection for JreCompat
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../catalina/webresources/DirResourceSet.java | 74 +++-------------------
.../org/apache/tomcat/util/compat/Jre21Compat.java | 15 +++--
webapps/docs/changelog.xml | 4 ++
3 files changed, 24 insertions(+), 69 deletions(-)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
(tomcat) 01/02: Remove the case sensitivity check
Posted by ma...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 0bf881aa6a999f6abe43bbe2efd0541fef35754e
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Thu Feb 20 12:49:53 2025 +0000
Remove the case sensitivity check
The performance impact is minimal and getting the check right in all
cases is difficult due to various edge cases
---
.../catalina/webresources/DirResourceSet.java | 74 +++-------------------
1 file changed, 9 insertions(+), 65 deletions(-)
diff --git a/java/org/apache/catalina/webresources/DirResourceSet.java b/java/org/apache/catalina/webresources/DirResourceSet.java
index dbbc126c41..3e9676bdd3 100644
--- a/java/org/apache/catalina/webresources/DirResourceSet.java
+++ b/java/org/apache/catalina/webresources/DirResourceSet.java
@@ -46,8 +46,6 @@ public class DirResourceSet extends AbstractFileResourceSet implements WebResour
private static final Log log = LogFactory.getLog(DirResourceSet.class);
- private boolean caseSensitive = true;
-
private Map<String,ResourceLock> resourceLocksByPath = new HashMap<>();
private Object resourceLocksByPathLock = new Object();
@@ -323,7 +321,6 @@ public class DirResourceSet extends AbstractFileResourceSet implements WebResour
@Override
protected void initInternal() throws LifecycleException {
super.initInternal();
- caseSensitive = isCaseSensitive();
// Is this an exploded web application?
if (getWebAppMount().equals("")) {
// Look for a manifest
@@ -337,10 +334,6 @@ public class DirResourceSet extends AbstractFileResourceSet implements WebResour
}
}
// Check for exposure to CVE-2024-56337
- if (caseSensitive) {
- // CVE-2024-56337 (nor CVE-2024-50379) is not exploitable on a case sensitive file system
- return;
- }
if (isReadOnly()) {
// CVE-2024-56337 (nor CVE-2024-50379) is not exploitable on a read-only ResourceSet
return;
@@ -367,65 +360,16 @@ public class DirResourceSet extends AbstractFileResourceSet implements WebResour
}
- /*
- * Determines if this ResourceSet is based on a case sensitive file system or not.
- *
- * File systems are usually case sensitive or not. Windows, via the command 'fsutil.exe file setCaseSensitiveInfo
- * <path> enable', may be case sensitive in some directories and case insensitive in others.
- *
- * If this method incorrectly determines that the DirResourceSet is case sensitive, the file locking mechanism that
- * ensures write operations are performed atomically will not operate correctly. If this method incorrectly
- * determines that the DirResourceSet is case insensitive, there is a small performance penalty for writes.
- *
- * Given the above, this method only reports the file system as case sensitive if no indication of case
- * insensitivity is detected. This does mean that Windows based DirResourceSet instances will be reported as case
- * insensitive even all of the directories in the DirResourceSet have been configured as case sensitive.
- */
- private boolean isCaseSensitive() {
- try {
- String canonicalPath = getFileBase().getCanonicalPath();
- /*
- * If any lower case characters are found in the canonical file name formed by converting the test file name
- * to upper case, the underlying file system must be, at least in part, case insensitive.
- */
- File upper = new File(canonicalPath.toUpperCase(Locale.ENGLISH));
- String upperCanonicalPath = upper.getCanonicalPath();
- char[] upperCharacters = upperCanonicalPath.toCharArray();
- for (char c : upperCharacters) {
- if (Character.isLowerCase(c)) {
- return false;
- }
- }
-
- /*
- * If any upper case characters are found in the canonical file name formed by converting the test file name
- * to lower case, the underlying file system must be, at least in part, case insensitive.
- */
- File lower = new File(canonicalPath.toLowerCase(Locale.ENGLISH));
- String lowerCanonicalPath = lower.getCanonicalPath();
- char[] lowerCharacters = lowerCanonicalPath.toCharArray();
- for (char c : lowerCharacters) {
- if (Character.isUpperCase(c)) {
- return false;
- }
- }
-
- return true;
- } catch (IOException ioe) {
- log.warn(sm.getString("dirResourceSet.isCaseSensitive.fail", getFileBase().getAbsolutePath()), ioe);
- }
-
- return false;
- }
-
-
private String getLockKey(String path) {
- // Normalize path to ensure that the same key is used for the same path.
- String normalisedPath = RequestUtil.normalize(path);
- if (caseSensitive) {
- return normalisedPath;
- }
- return normalisedPath.toLowerCase(Locale.ENGLISH);
+ /*
+ * Normalize path to ensure that the same key is used for the same path. Always convert path to lower case as
+ * the file system may be case insensitive. A minor performance improvement is possible by removing the
+ * conversion to lower case for case sensitive file systems but confirming that all the directories within a
+ * DirResourceSet are case sensitive is much harder than it might first appear due to various edge cases. In
+ * particular, Windows can make individual directories case sensitive and File.getCanonicalPath() doesn't return
+ * the canonical file name on Linux for some case insensitive file systems (such as mounted Windows shares).
+ */
+ return RequestUtil.normalize(path).toLowerCase(Locale.ENGLISH);
}
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
(tomcat) 02/02: Fix Java 21 version detection for JreCompat
Posted by ma...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 9a229601c4c85ca3ce2cecd0ef98803ac3d9848b
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Fri Feb 21 10:35:41 2025 +0000
Fix Java 21 version detection for JreCompat
---
java/org/apache/tomcat/util/compat/Jre21Compat.java | 15 +++++++++++----
webapps/docs/changelog.xml | 4 ++++
2 files changed, 15 insertions(+), 4 deletions(-)
diff --git a/java/org/apache/tomcat/util/compat/Jre21Compat.java b/java/org/apache/tomcat/util/compat/Jre21Compat.java
index ee01f3e28e..23ebd27feb 100644
--- a/java/org/apache/tomcat/util/compat/Jre21Compat.java
+++ b/java/org/apache/tomcat/util/compat/Jre21Compat.java
@@ -32,6 +32,7 @@ public class Jre21Compat extends Jre19Compat {
private static final Log log = LogFactory.getLog(Jre21Compat.class);
private static final StringManager sm = StringManager.getManager(Jre21Compat.class);
+ private static final boolean supported;
private static final Method nameMethod;
private static final Method startMethod;
private static final Method ofVirtualMethod;
@@ -46,9 +47,14 @@ public class Jre21Compat extends Jre19Compat {
Method m4 = null;
try {
- c1 = Class.forName("java.lang.Thread$Builder");
- m1 = c1.getMethod("name", String.class, long.class);
- m2 = c1.getMethod("start", Runnable.class);
+ // Note: Virtual threads is the main new feature in Java 21, but it was previously
+ // present as a preview. As a result, it is more accurate to test for another
+ // new class
+ c1 = Class.forName("java.util.SequencedCollection");
+
+ Class<?> c2 = Class.forName("java.lang.Thread$Builder");
+ m1 = c2.getMethod("name", String.class, long.class);
+ m2 = c2.getMethod("start", Runnable.class);
m3 = Thread.class.getMethod("ofVirtual", (Class<?>[]) null);
m4 = Subject.class.getMethod("callAs", Subject.class, Callable.class);
} catch (ClassNotFoundException e) {
@@ -58,6 +64,7 @@ public class Jre21Compat extends Jre19Compat {
// Should never happen
log.error(sm.getString("jre21Compat.unexpected"), e);
}
+ supported = (c1 != null);
nameMethod = m1;
startMethod = m2;
ofVirtualMethod = m3;
@@ -65,7 +72,7 @@ public class Jre21Compat extends Jre19Compat {
}
static boolean isSupported() {
- return ofVirtualMethod != null;
+ return supported;
}
@Override
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index c1bf0a592d..cfd1fe14cc 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -125,6 +125,10 @@
<code>HttpServletRequest.login(String username, String password)</code>
when the realm is configured to use GSSAPI authentication. (markt)
</fix>
+ <fix>
+ Fix a bug in the JRE compatibility detection that incorrectly identified
+ Java 19 and Java 20 as supporting Java 21 features. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org