Changelog:
Tomcat 7.0.64 (violetagg)
Catalina
add 55317: Facilitate weaving by allowing ClassFileTransformer to be added to WebappClassLoader. Patch by Nick Williams. (markt)
fix 58031: Make the (first) reason parameter parsing failed available as a request attribute and then use it to provide a better status code via the FailedRequstFilter (if configured). (markt)
fix 58086: Ensure that WAR URLs are handled properly when using Apache Ant for web application deployment. (violetagg)
fix 58094: Fix cosmetic error log when using non standard non cacheable resources, like with the empty resources used in some tests. (remm)
fix 58096: Classes loaded from /WEB-INF/classes/ should use that directory as their code base. (markt)
fix Fix possible resource leaks by closing streams properly. Issues reported by Coverity Scan. (violetagg)
fix 58116: Fix a regression in the fix for 57281 that broke Comet support when running under a security manager. Based on a patch provided by Johno Crawford. (markt)
fix 58179: Fix a thread safety issues that could mean concurrent threads setting the same attribute on a ServletContext could both see null as the old value. (markt)
fix 58192: Correct a regression in the previous fix for 58023. Ensure that classes are associated with their manifest even if the class file is first read (and cached) without the manifest. (markt)
fix Fix thread safety issue in the AsyncContext implementation that meant a sequence of start();dispatch(); calls using non-container threads could result in a previous dispatch interfering with a subsequent start. (markt)
Coyote
fix 57943: Prevent the same socket being added to the cache twice. Patch based on analysis by Ian Luo / Sun Qi. (markt)
fix Add text/javascript,application/javascript to the default list of compressable MIME types. (violetagg)
fix 58103: When pipelining requests, and the previous request was an async request, ensure that the socket is removed from the waiting requests so that the async timeout thread doesn't process it during the next request. (markt)
fix Fix a concurrency issue that meant that a change in socket timeout (e.g. when switching to asynchronous I/O) did not always take effect immediately. (markt)
fix In the AJP and HTTP NIO connectors, ensure that the socket timeout is correctly set before adding the socket back to the poller for read. (markt)
fix 58157: Ensure that the handling of async timeouts does not result in an unnecessary dispatch to a container thread that could result in the current socket being added to the Poller multiple times with multiple attempts to process the same event for the same socket. (markt)
fix Correct a coupe of edge cases in RequestUtil.normalize(). (markt)
Jasper
fix 58110: Like scriptlet sections, declaration sections of JSP pages have a one-to-one mapping of lines to the generated .java file. Use this information to provide more accurate error messages if a compilation error occurs in a declaration section. (markt)
fix 58119: When tags are compiled they must be placed in the org/apache/jsp/tag/web directory. Correct a regression in the fix for 52725. (violetagg)
fix 58178: Expressions in a tag file should use the tag file's PageContext rather than that of the containing page. (markt)
WebSocket
fix 58166: Allow applications to send close codes in the range 3000-4999 inclusive. (markt)
fix 58232: Avoid possible NPE when adding endpoints programmatically to the javax.websocket.server.ServerContainer. Based on a patch provided by bastian.(violetagg)
Web applications
fix Correct the incorrect document of QueryTimeoutInterceptor. The setting value is not in milliseconds but in seconds. (kfujino)
fix 58112: Update the documentation for using the Catalina tasks in an Apache Ant build file. (markt)
fix Improve the Javadoc for some of the APR socket read functions that have inconsistent behaviour for return values. (markt)
add 58255: Document the Semaphore valve. Patch provided by Kyohei Nakamura. (markt)
jdbc-pool
fix Fix potential NPE in QueryTimeoutInterceptor. (kfujino)
fix Add support for stopping the pool cleaner via JMX. (kfujino)
fix The fairness attribute and ignoreExceptionOnPreLoad attribute do not allow a change via JMX. (kfujino)
fix If the timeBetweenEvictionRunsMillis attribute is changed via jmx, it should restart the pool cleaner because this attribute affects the execution interval of the pool cleaner. (kfujino)
fix Eliminate the dependence on maxActive of busy queues and idle queue in order to enable the expansion of the pool size via JMX. (kfujino)
Other
fix Update sample Eclipse IDE configuration to exclude test/webapp* and similar paths from compiler sourcepath. (kkolinko)
Tomcat 7.0.63 (violetagg) released 2015-07-06
Catalina
fix 57938: Correctly handle empty form fields when a form is submitted as multipart/form-data, the maxPostSize attribute of the Connector has been set to a negative value and the Context has been configured with a value of true for allowCasualMultipartParsing. The meaning of the value zero for the maxPostSize has also been changed to mean a limit of zero rather than no limit to align it with maxSavePostSize and to be more intuitive. (markt)
add 54618: Add a new HttpHeaderSecurityFilter that adds the Strict-Transport-Security, X-Frame-Options and X-Content-Type-Options HTTP headers to the response. (markt)
fix Add a workaround for issues with SPNEGO authentication when running on Java 8 update 40 and later. The workaround should be safe for earlier Java versions but it can be disabled with the applyJava8u40Fix attribute of the SPNEGO authenticator if necessary. (markt)
add 57154: Add support for web applications (Context elements) that do not have a docBase. This is primarily for use when embedding but it also fixes a rare issue when running the unit test. Patch provided by Huxing Zhang. (markt)
fix 57959: Fixed deadlock in org.apache.juli.FileHandler when log is rotated. (violetagg)
fix 57977: Correctly bind and unbind the web application class loader during execution of the PersistentValve. (markt)
fix 58023: Fix potentially excessive memory usage due to unnecessary caching of JAR manifests in the web application class loader. (markt)
fix 57700: Ensure that Container event ADD_CHILD_EVENT will be sent in all cases. (violetagg)
fix Add configuration fields for header names in SSLValve. (remm)
Coyote
fix 57265: Further fix to address a potential threading issue for NIO when sendfile is used in conjunction with TLS. (markt)
fix 57931: Ensure that TLS connections with the NIO HTTP connector that experience issues during the handshake (e.g. missing or invalid client certificate) are closed cleanly and that the client receives the correct error code rather than simply closing the connection. (markt)
add 57943: Added a work-around to catch ConcurrentModificationExceptions during Poller timeout processing that were causing the Poller thread to stop. The root cause of these exceptions is currently unknown. (markt)
fix Fix possible very long (1000 seconds) timeout with APR/native connector. (markt)
add Support "-" separator in the SSLProtocol configuration of the APR/native connector for protocol exclusion. (rjung)
Cluster
fix Make sure that stream is closed after using it in DeltaSession.applyDiff(). (kfujino)
WebSocket
add 57676: List conflicting WebSocket endpoint classes when there is a path conflict. Based upon a patch proposed by yangkun. (schultz)
add Extend support for the permessage-deflate extension to the client implementation.
fix 57969: Provide path parameters to POJO via per session javax.websocket.server.ServerEndpointConfig as they vary between different requests. (violetagg)
fix 57974: Session.getOpenSessions should return all sessions associated with a given endpoint instance, rather than all sessions from the endpoint class. (remm)
Web applications
fix 57282: Update request processing sequence diagrams. Updated diagrams provided by Stephen Chen. (markt)
fix 57971: Correct the documentation for the cluster configuration setting recoverySleepTime. (markt)
add 57758: Add document of testOnConnect attribute in jdbc-pool doc. (kfujino)
add Add description of validatorClassName attribute to testXXXX attributes in jdbc-pool docs. (kfujino)
Tribes
fix Ensure that the state transfer flag is updated to true only when the map states have been transferred correctly from existing map members. (kfujino)
fix Do not set the nodes that failed to replication to the backup nodes. Ensure that the nodes that the data has been successfully replicated are set to the backup node. (kfujino)
fix When failed to replication, rather than all member is handled as a failed member, exclude the failure members from backup members. (kfujino)
jdbc-pool
fix Refactoring of the removeOldest method in SlowQueryReport to behave as expected. (kfujino)
fix 57783: Fix NullPointerException in SlowQueryReport. To avoid this NPE, Refactor SlowQueryReport#removeOldest and handle the abandoned connection properly. (kfujino)
Other
update Update package renamed Apache Commons BCEL to r1682271 to pick up some some code clean up. (markt)
update Update package renamed Apache Commons File upload to r1682322 to pick up the post 1.3.1 fixes. (markt)
update Update package renamed Apache Commons Codec to r1682326. No functional changes. Javadoc only. (markt)
2cf6d68a37