You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2012/10/04 16:55:59 UTC
svn commit: r1394104 - in /tomcat/tc6.0.x/trunk: ./
java/org/apache/catalina/connector/ webapps/docs/ webapps/docs/config/
Author: markt
Date: Thu Oct 4 14:55:59 2012
New Revision: 1394104
URL: http://svn.apache.org/viewvc?rev=1394104&view=rev
Log:
Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=48692
Provide option to parse application/x-www-form-urlencoded PUT requests
Modified:
tomcat/tc6.0.x/trunk/STATUS.txt
tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Connector.java
tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/LocalStrings.properties
tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java
tomcat/tc6.0.x/trunk/webapps/docs/changelog.xml
tomcat/tc6.0.x/trunk/webapps/docs/config/ajp.xml
tomcat/tc6.0.x/trunk/webapps/docs/config/http.xml
Modified: tomcat/tc6.0.x/trunk/STATUS.txt
URL: http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/STATUS.txt?rev=1394104&r1=1394103&r2=1394104&view=diff
==============================================================================
--- tomcat/tc6.0.x/trunk/STATUS.txt (original)
+++ tomcat/tc6.0.x/trunk/STATUS.txt Thu Oct 4 14:55:59 2012
@@ -89,17 +89,6 @@ PATCHES PROPOSED TO BACKPORT:
+1: schultz, kkolinko, jfclere
-1:
-* Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=48692
- Provide option to parse application/x-www-form-urlencoded PUT requests
- Tomcat 6.0.x patch: https://issues.apache.org/bugzilla/attachment.cgi?id=29222
- (Merges the following patches for Tomcat 7.0.x:
- http://svn.apache.org/viewvc?view=revision&revision=1041892 (initial patch)
- http://svn.apache.org/viewvc?view=revision&revision=1043983 (fixes formatting; improved documentation)
- http://svn.apache.org/viewvc?view=revision&revision=1049264 (improved javadoc)
- )
- +1: schultz, kkolinko, markt
- -1:
-
* Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=53725
Fix possible corruption of GZIP'd output.
http://svn.apache.org/viewvc?rev=1378403&view=rev
Modified: tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Connector.java
URL: http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Connector.java?rev=1394104&r1=1394103&r2=1394104&view=diff
==============================================================================
--- tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Connector.java (original)
+++ tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Connector.java Thu Oct 4 14:55:59 2012
@@ -18,7 +18,10 @@
package org.apache.catalina.connector;
+import java.util.Arrays;
import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Set;
import javax.management.MBeanRegistration;
import javax.management.MBeanServer;
@@ -44,7 +47,7 @@ import org.apache.tomcat.util.modeler.Re
/**
- * Implementation of a Coyote connector for Tomcat 5.x.
+ * Implementation of a Coyote connector.
*
* @author Craig R. McClanahan
* @author Remy Maucherat
@@ -211,6 +214,17 @@ public class Connector
*/
protected int maxSavePostSize = 4 * 1024;
+ /**
+ * Comma-separated list of HTTP methods that will be parsed according
+ * to POST-style rules for application/x-www-form-urlencoded request bodies.
+ */
+ protected String parseBodyMethods = "POST";
+
+ /**
+ * A Set of methods determined by {@link #parseBodyMethods}.
+ */
+ protected Set<String> parseBodyMethodsSet;
+
/**
* Has this component been initialized yet?
@@ -617,6 +631,33 @@ public class Connector
}
+ public String getParseBodyMethods() {
+
+ return this.parseBodyMethods;
+
+ }
+
+ public void setParseBodyMethods(String methods) {
+
+ HashSet<String> methodSet = new HashSet<String>();
+
+ if( null != methods )
+ methodSet.addAll(Arrays.asList(methods.split("\\s*,\\s*")));
+
+ if( methodSet.contains("TRACE") )
+ throw new IllegalArgumentException(sm.getString("coyoteConnector.parseBodyMethodNoTrace"));
+
+ this.parseBodyMethods = methods;
+ this.parseBodyMethodsSet = methodSet;
+
+ }
+
+ protected boolean isParseBodyMethod(String method) {
+
+ return parseBodyMethodsSet.contains(method);
+
+ }
+
/**
* Return the port number on which we listen for requests.
*/
@@ -1071,6 +1112,10 @@ public class Connector
adapter = new CoyoteAdapter(this);
protocolHandler.setAdapter(adapter);
+ // Make sure parseBodyMethodsSet has a default
+ if( null == parseBodyMethodsSet )
+ setParseBodyMethods(getParseBodyMethods());
+
IntrospectionUtils.setProperty(protocolHandler, "jkHome",
System.getProperty("catalina.base"));
Modified: tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/LocalStrings.properties
URL: http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/LocalStrings.properties?rev=1394104&r1=1394103&r2=1394104&view=diff
==============================================================================
--- tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/LocalStrings.properties (original)
+++ tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/LocalStrings.properties Thu Oct 4 14:55:59 2012
@@ -30,6 +30,7 @@ coyoteConnector.protocolHandlerPauseFail
coyoteConnector.protocolHandlerResumeFailed=Protocol handler resume failed
coyoteConnector.MapperRegistration=register Mapper: {0}
coyoteConnector.protocolUnregistrationFailed=Protocol handler stop failed
+coyoteConnector.parseBodyMethodNoTrace=TRACE method MUST NOT include an entity (see RFC 2616 Section 9.6)
#
# CoyoteAdapter
Modified: tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java
URL: http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java?rev=1394104&r1=1394103&r2=1394104&view=diff
==============================================================================
--- tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java (original)
+++ tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java Thu Oct 4 14:55:59 2012
@@ -2596,7 +2596,7 @@ public class Request
if (usingInputStream || usingReader)
return;
- if (!getMethod().equalsIgnoreCase("POST"))
+ if( !getConnector().isParseBodyMethod(getMethod()) )
return;
String contentType = getContentType();
Modified: tomcat/tc6.0.x/trunk/webapps/docs/changelog.xml
URL: http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/webapps/docs/changelog.xml?rev=1394104&r1=1394103&r2=1394104&view=diff
==============================================================================
--- tomcat/tc6.0.x/trunk/webapps/docs/changelog.xml (original)
+++ tomcat/tc6.0.x/trunk/webapps/docs/changelog.xml Thu Oct 4 14:55:59 2012
@@ -46,6 +46,10 @@
<section name="Tomcat 6.0.36 (jfclere)" rtext="">
<subsection name="Catalina">
<changelog>
+ <update>
+ <bug>48692</bug>: Provide option to parse
+ <code>application/x-www-form-urlencoded</code> PUT requests. (schultz)
+ </update>
<add>
<bug>50306</bug>: New StuckThreadDetectionValve to detect requests that
take a long time to process, which might indicate that their processing
Modified: tomcat/tc6.0.x/trunk/webapps/docs/config/ajp.xml
URL: http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/webapps/docs/config/ajp.xml?rev=1394104&r1=1394103&r2=1394104&view=diff
==============================================================================
--- tomcat/tc6.0.x/trunk/webapps/docs/config/ajp.xml (original)
+++ tomcat/tc6.0.x/trunk/webapps/docs/config/ajp.xml Thu Oct 4 14:55:59 2012
@@ -130,6 +130,26 @@
to 4096 (4 kilobytes).</p>
</attribute>
+ <attribute name="parseBodyMethods" required="false">
+ <p>A comma-separated list of HTTP methods for which request
+ bodies will be parsed for request parameters identically
+ to POST. This is useful in RESTful applications that want to
+ support POST-style semantics for PUT requests.
+ Note that any setting other than <code>POST</code> causes Tomcat
+ to behave in a way that does against the intent of the servlet
+ specification.
+ The HTTP method TRACE is specifically forbidden here in accordance
+ with the HTTP specification.
+ The default is <code>POST</code></p>
+ </attribute>
+
+ <attribute name="port" required="true">
+ <p>The TCP port number on which this <strong>Connector</strong>
+ will create a server socket and await incoming connections. Your
+ operating system will allow only one server application to listen
+ to a particular port number on a particular IP address.</p>
+ </attribute>
+
<attribute name="protocol" required="false">
<p>Sets the protocol to handle incoming traffic. The default value is
<code>AJP/1.3</code> and configures
Modified: tomcat/tc6.0.x/trunk/webapps/docs/config/http.xml
URL: http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/webapps/docs/config/http.xml?rev=1394104&r1=1394103&r2=1394104&view=diff
==============================================================================
--- tomcat/tc6.0.x/trunk/webapps/docs/config/http.xml (original)
+++ tomcat/tc6.0.x/trunk/webapps/docs/config/http.xml Thu Oct 4 14:55:59 2012
@@ -137,6 +137,26 @@
to 4096 (4 kilobytes).</p>
</attribute>
+ <attribute name="parseBodyMethods" required="false">
+ <p>A comma-separated list of HTTP methods for which request
+ bodies will be parsed for request parameters identically
+ to POST. This is useful in RESTful applications that want to
+ support POST-style semantics for PUT requests.
+ Note that any setting other than <code>POST</code> causes Tomcat
+ to behave in a way that does against the intent of the servlet
+ specification.
+ The HTTP method TRACE is specifically forbidden here in accordance
+ with the HTTP specification.
+ The default is <code>POST</code></p>
+ </attribute>
+
+ <attribute name="port" required="true">
+ <p>The TCP port number on which this <strong>Connector</strong>
+ will create a server socket and await incoming connections. Your
+ operating system will allow only one server application to listen
+ to a particular port number on a particular IP address.</p>
+ </attribute>
+
<attribute name="protocol" required="false">
<p>
Sets the protocol to handle incoming traffic.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: svn commit: r1394104 - in /tomcat/tc6.0.x/trunk: ./
java/org/apache/catalina/connector/ webapps/docs/ webapps/docs/config/
Posted by Konstantin Kolinko <kn...@gmail.com>.
2012/10/6 Mark Thomas <ma...@apache.org>:
>
> Konstantin Kolinko <kn...@gmail.com> wrote:
>
>>2012/10/5 Christopher Schultz <ch...@christopherschultz.net>:
>
>>> RFCs 2616, 2068, and 1945 all agree that method name is
>>case-sensitive:
>>> http://www.w3.org/Protocols/rfc2616/rfc2616-sec5.html#sec5.1.1
>>>
>>
>>OK. Agreed.
>>
>>Looking at Servlet spec 2.5, SRV.3.1.1 says "The HTTP method is POST".
>>
>>
>>I tested 6.0.35 using telnet as a client.
>>The result is that it sometimes allow lowercase methods (or maybe it
>>does not care about a method in that case) but generally it responds
>>with an error.
>>
>>get /index.jsp HTTP/1.0
>>post /index.jsp HTTP/1.0
>>- result in the welcome page being rendered
>
> The JSP servlet responds to any and every method. Personally, I think that is wrong. On my todo list for Tomcat 8 (not yet documented because I was hoping for some guidance form the JSP EG first) is to limit JSPs to responding to GET, POST, TRACE (blocked at the connector anyway) HEAD and OPTIONS and a servlet init parameter to enable more methods. I was also planning on providing similar functionality to that in HttpServlet.
>
Thinking more about the JSPs,
JSPs are often used as views in an MVC pattern, being called from a
controller servet using forward or include. Forwards and includes do
not change the method name. In this scenario it is good that JSPs can
render the response regardless of the HTTP methods supported by the
controller servet.
Best regards,
Konstantin Kolinko
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: svn commit: r1394104 - in /tomcat/tc6.0.x/trunk: ./ java/org/apache/catalina/connector/ webapps/docs/ webapps/docs/config/
Posted by Mark Thomas <ma...@apache.org>.
Konstantin Kolinko <kn...@gmail.com> wrote:
>2012/10/5 Christopher Schultz <ch...@christopherschultz.net>:
>> RFCs 2616, 2068, and 1945 all agree that method name is
>case-sensitive:
>> http://www.w3.org/Protocols/rfc2616/rfc2616-sec5.html#sec5.1.1
>>
>
>OK. Agreed.
>
>Looking at Servlet spec 2.5, SRV.3.1.1 says "The HTTP method is POST".
>
>
>I tested 6.0.35 using telnet as a client.
>The result is that it sometimes allow lowercase methods (or maybe it
>does not care about a method in that case) but generally it responds
>with an error.
>
>get /index.jsp HTTP/1.0
>post /index.jsp HTTP/1.0
>- result in the welcome page being rendered
The JSP servlet responds to any and every method. Personally, I think that is wrong. On my todo list for Tomcat 8 (not yet documented because I was hoping for some guidance form the JSP EG first) is to limit JSPs to responding to GET, POST, TRACE (blocked at the connector anyway) HEAD and OPTIONS and a servlet init parameter to enable more methods. I was also planning on providing similar functionality to that in HttpServlet.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: svn commit: r1394104 - in /tomcat/tc6.0.x/trunk: ./
java/org/apache/catalina/connector/ webapps/docs/ webapps/docs/config/
Posted by Konstantin Kolinko <kn...@gmail.com>.
2012/10/5 Christopher Schultz <ch...@christopherschultz.net>:
> Konstantin,
>
> On 10/5/12 8:45 AM, Konstantin Kolinko wrote:
>> 2012/10/4 <ma...@apache.org>:
>>> Author: markt
>>> Date: Thu Oct 4 14:55:59 2012
>>> New Revision: 1394104
>>>
>>> URL: http://svn.apache.org/viewvc?rev=1394104&view=rev
>>> Log:
>>> Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=48692
>>> Provide option to parse application/x-www-form-urlencoded PUT requests
>>>
>>> Modified:
>>> tomcat/tc6.0.x/trunk/STATUS.txt
>>> tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Connector.java
>>> tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/LocalStrings.properties
>>> tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java
>>> tomcat/tc6.0.x/trunk/webapps/docs/changelog.xml
>>> tomcat/tc6.0.x/trunk/webapps/docs/config/ajp.xml
>>> tomcat/tc6.0.x/trunk/webapps/docs/config/http.xml
>>>
>>
>>> (...)
>>> Modified: tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java
>>> URL: http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java?rev=1394104&r1=1394103&r2=1394104&view=diff
>>> ==============================================================================
>>> --- tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java (original)
>>> +++ tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java Thu Oct 4 14:55:59 2012
>>> @@ -2596,7 +2596,7 @@ public class Request
>>> if (usingInputStream || usingReader)
>>> return;
>>>
>>> - if (!getMethod().equalsIgnoreCase("POST"))
>>> + if( !getConnector().isParseBodyMethod(getMethod()) )
>>> return;
>>
>>
>> It seems a bug crawled in.
>> The old behaviour: case-insensitive. equalsIgnoreCase("POST")
>> The new behaviour: case-sensitive (parseBodyMethodsSet.contains(method))
>>
>> That is unless the method name is converted to uppercase somewhere.
>> I have not yet checked what HTTP spec says on method names.
>
> RFCs 2616, 2068, and 1945 all agree that method name is case-sensitive:
> http://www.w3.org/Protocols/rfc2616/rfc2616-sec5.html#sec5.1.1
>
OK. Agreed.
Looking at Servlet spec 2.5, SRV.3.1.1 says "The HTTP method is POST".
I tested 6.0.35 using telnet as a client.
The result is that it sometimes allow lowercase methods (or maybe it
does not care about a method in that case) but generally it responds
with an error.
get /index.jsp HTTP/1.0
post /index.jsp HTTP/1.0
- result in the welcome page being rendered
get / HTTP/1.0
- results in
HTTP/1.1 501 Not Implemented
The getMethod() call returns the name as is, as can be seen by adding
%m to the AccessLogValve pattern.
So there is no need for case-insensivity there. If someone has odd
clients that use unusual methods, one can add their specific values to
the parseBodyMethods list.
Best regards,
Konstantin Kolinko
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: svn commit: r1394104 - in /tomcat/tc6.0.x/trunk: ./ java/org/apache/catalina/connector/
webapps/docs/ webapps/docs/config/
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Konstantin,
On 10/5/12 8:45 AM, Konstantin Kolinko wrote:
> 2012/10/4 <ma...@apache.org>:
>> Author: markt
>> Date: Thu Oct 4 14:55:59 2012
>> New Revision: 1394104
>>
>> URL: http://svn.apache.org/viewvc?rev=1394104&view=rev
>> Log:
>> Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=48692
>> Provide option to parse application/x-www-form-urlencoded PUT requests
>>
>> Modified:
>> tomcat/tc6.0.x/trunk/STATUS.txt
>> tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Connector.java
>> tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/LocalStrings.properties
>> tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java
>> tomcat/tc6.0.x/trunk/webapps/docs/changelog.xml
>> tomcat/tc6.0.x/trunk/webapps/docs/config/ajp.xml
>> tomcat/tc6.0.x/trunk/webapps/docs/config/http.xml
>>
>
>> (...)
>> Modified: tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java
>> URL: http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java?rev=1394104&r1=1394103&r2=1394104&view=diff
>> ==============================================================================
>> --- tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java (original)
>> +++ tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java Thu Oct 4 14:55:59 2012
>> @@ -2596,7 +2596,7 @@ public class Request
>> if (usingInputStream || usingReader)
>> return;
>>
>> - if (!getMethod().equalsIgnoreCase("POST"))
>> + if( !getConnector().isParseBodyMethod(getMethod()) )
>> return;
>
>
> It seems a bug crawled in.
> The old behaviour: case-insensitive. equalsIgnoreCase("POST")
> The new behaviour: case-sensitive (parseBodyMethodsSet.contains(method))
>
> That is unless the method name is converted to uppercase somewhere.
> I have not yet checked what HTTP spec says on method names.
RFCs 2616, 2068, and 1945 all agree that method name is case-sensitive:
http://www.w3.org/Protocols/rfc2616/rfc2616-sec5.html#sec5.1.1
-chris
Re: svn commit: r1394104 - in /tomcat/tc6.0.x/trunk: ./
java/org/apache/catalina/connector/ webapps/docs/ webapps/docs/config/
Posted by Konstantin Kolinko <kn...@gmail.com>.
2012/10/4 <ma...@apache.org>:
> Author: markt
> Date: Thu Oct 4 14:55:59 2012
> New Revision: 1394104
>
> URL: http://svn.apache.org/viewvc?rev=1394104&view=rev
> Log:
> Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=48692
> Provide option to parse application/x-www-form-urlencoded PUT requests
>
> Modified:
> tomcat/tc6.0.x/trunk/STATUS.txt
> tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Connector.java
> tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/LocalStrings.properties
> tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java
> tomcat/tc6.0.x/trunk/webapps/docs/changelog.xml
> tomcat/tc6.0.x/trunk/webapps/docs/config/ajp.xml
> tomcat/tc6.0.x/trunk/webapps/docs/config/http.xml
>
>(...)
> Modified: tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java
> URL: http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java?rev=1394104&r1=1394103&r2=1394104&view=diff
> ==============================================================================
> --- tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java (original)
> +++ tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/Request.java Thu Oct 4 14:55:59 2012
> @@ -2596,7 +2596,7 @@ public class Request
> if (usingInputStream || usingReader)
> return;
>
> - if (!getMethod().equalsIgnoreCase("POST"))
> + if( !getConnector().isParseBodyMethod(getMethod()) )
> return;
It seems a bug crawled in.
The old behaviour: case-insensitive. equalsIgnoreCase("POST")
The new behaviour: case-sensitive (parseBodyMethodsSet.contains(method))
That is unless the method name is converted to uppercase somewhere.
I have not yet checked what HTTP spec says on method names.
>
> String contentType = getContentType();
>
Best regards,
Konstantin Kolinko
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org