Tomcat 6: Incorrect ELContext may be used when PageContext pooling is 'on'

[Scott Johnson <sc...@us.ibm.com>]

(I tried many times to open a bugzilla bug against Tomcat 6/Jasper, but it 
never succeeded.  I think this bug is important enough to let you know 
about it, while bugzilla-admin helps figure out my bugzilla problem.)


In org.apache.jasper.runtime.PageContextImpl, the release() method does 
not set the class variable elContext to null.  This can result in the 
ELContext from any JspApplicationContext to be used, resulting in 
incorrect EL evaluation.
For example, if the current JSP page requires a custom EL resolver that 
was registered in its application, and if the PageContext is gotten from 
the pool in JspFactoryImpl, then the elContext will not be null (so won't 
be created) and could therefore be from any other JspApplicationContext.

Fix:  in PageContextImpl.release()
        elContext = null;  // very important
        applicationContext = null;  // less important

I built the latest code from tc6.0.x/trunk and this problem exists as of 
this writing - and I didn't see it reported in bugzilla.

-Scott

Re: Tomcat 6: Incorrect ELContext may be used when PageContext pooling is 'on'

[Remy Maucherat <re...@apache.org>]

Scott Johnson wrote:
> (I tried many times to open a bugzilla bug against Tomcat 6/Jasper, but it 
> never succeeded.  I think this bug is important enough to let you know 
> about it, while bugzilla-admin helps figure out my bugzilla problem.)
> 
> 
> In org.apache.jasper.runtime.PageContextImpl, the release() method does 
> not set the class variable elContext to null.  This can result in the 
> ELContext from any JspApplicationContext to be used, resulting in 
> incorrect EL evaluation.
> For example, if the current JSP page requires a custom EL resolver that 
> was registered in its application, and if the PageContext is gotten from 
> the pool in JspFactoryImpl, then the elContext will not be null (so won't 
> be created) and could therefore be from any other JspApplicationContext.
> 
> Fix:  in PageContextImpl.release()
>         elContext = null;  // very important
>         applicationContext = null;  // less important
> 
> I built the latest code from tc6.0.x/trunk and this problem exists as of 
> this writing - and I didn't see it reported in bugzilla.

applicationContext = null is useless for sure, it gets reset in initialize.

Rémy

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org