Jenkinsfile

@@ -50,11 +50,21 @@ pipeline {
           }
         }
 
+        stage("Build / Test - JDK12") {
+          agent { node { label 'linux' } }
+          options { timeout(time: 120, unit: 'MINUTES') }
+          steps {
+            mavenBuild("jdk12", "-Pmongodb install", "maven3", false)
+            warnings consoleParsers: [[parserName: 'Maven'], [parserName: 'Java']]
+            maven_invoker reportsFilenamePattern: "**/target/invoker-reports/BUILD*.xml", invokerBuildDir: "**/target/it"
+          }
+        }
+
         stage("Build Javadoc") {
           agent { node { label 'linux' } }
           options { timeout(time: 30, unit: 'MINUTES') }
           steps {
-            mavenBuild("jdk8", "install javadoc:javadoc -DskipTests", "maven3", true)
+            mavenBuild("jdk11", "install javadoc:javadoc -DskipTests", "maven3", true)
             warnings consoleParsers: [[parserName: 'Maven'], [parserName: 'JavaDoc'], [parserName: 'Java']]
           }
         }
@@ -95,7 +105,7 @@ def mavenBuild(jdk, cmdline, mvnName, junitPublishDisabled) {
       mavenOpts: mavenOpts,
       mavenLocalRepo: localRepo) {
     // Some common Maven command line + provided command line
-    sh "mvn -V -B -T3 -e -Dmaven.test.failure.ignore=true -Djetty.testtracker.log=true $cmdline -Dunix.socket.tmp=" + env.JENKINS_HOME
+    sh "mvn -Pci -V -B -T3 -e -Dmaven.test.failure.ignore=true -Djetty.testtracker.log=true $cmdline -Dunix.socket.tmp=" + env.JENKINS_HOME
   }
 }
 

Jmh_Jenkinsfile

@@ -2,11 +2,13 @@
 
 def branch = params.get("JETTY_BRANCH" ,"jetty-9.4.x")
 def owner = params.get("REPO_OWNER", "eclipse")
+def jdk = params.get("JDK", "jdk8")
+def jmhJarPath = params.get("jmhJarPath","jetty-jmh/target/benchmarks.jar")
 
 node("linux") {
   // System Dependent Locations
   def mvntool = tool name: 'maven3.5', type: 'hudson.tasks.Maven$MavenInstallation'
-  def jdktool = tool name: "jdk8", type: 'hudson.model.JDK'
+  def jdktool = tool name: "$jdk", type: 'hudson.model.JDK'
   def mvnName = 'maven3.5'
   def localRepo = "${env.JENKINS_HOME}/${env.EXECUTOR_NUMBER}"
   def settingsName = 'oss-settings.xml'
@@ -19,24 +21,22 @@ node("linux") {
 
   stage("Checkout") {
     git url: "https://github.com/$owner/jetty.project.git", branch: "$branch"
+
   }
 
   stage("Compile") {
-    withEnv(mvnEnv) {
-      timeout(time: 15, unit: 'MINUTES') {
-        withMaven(
-                maven: mvnName,
-                jdk: "jdk8",
-                publisherStrategy: 'EXPLICIT',
-                globalMavenSettingsConfig: settingsName,
-                mavenOpts: mavenOpts,
-                mavenLocalRepo: localRepo) {
-          sh "mvn -V -B clean install -DskipTests -T6 -e"
-        }
-
+    timeout(time: 15, unit: 'MINUTES') {
+      withMaven(
+              maven: mvnName,
+              jdk: jdk,
+              publisherStrategy: 'EXPLICIT',
+              globalMavenSettingsConfig: settingsName,
+              mavenOpts: mavenOpts,
+              mavenLocalRepo: localRepo) {
+        sh "mvn -V -B clean install -DskipTests -T6 -e -pl :jetty-jmh -am"
       }
-      stash name: 'perf-tests', includes: 'jetty-jmh/target/benchmarks.jar'
     }
+    stash name: 'perf-tests', includes: jmhJarPath
   }
 }
 
@@ -44,11 +44,13 @@ node("linux") {
 
 stage("jmh-run") {
   node( 'jmh-build-node' ) {
-    timeout( time: 120, unit: 'MINUTES' ) {
-      withEnv( ["JAVA_HOME=${tool "jdk8"}"] ) {
+    timeout( time: 180, unit: 'MINUTES' ) {
+      withEnv( ["JAVA_HOME=${tool "$jdk"}"] ) {
         unstash name: 'perf-tests'
-        sh "${env.JAVA_HOME}/bin/java -jar jetty-jmh/target/benchmarks.jar -rff jetty-jmh/target/jmh_result.json -rf json"
-        jmhReport 'jetty-jmh/target/jmh_result.json'
+        sh "rm -rf jmh_results"
+        sh "mkdir jmh_results"
+        sh "${env.JAVA_HOME}/bin/java -jar $jmhJarPath -rff jmh_results/jmh_result.json -rf json"
+        jmhReport 'jmh_results/jmh_result.json'
       }
     }
   }

LICENSE

 This program and the accompanying materials are made available under the
-terms of the Eclipse Public License 2.0 which is available at
-http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
-2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
+terms of the Eclipse Public License 1.0 which is available at
+https://www.eclipse.org/org/documents/epl-1.0/EPL-1.0.txt
+or the Apache Software License 2.0 which is available at
+https://www.apache.org/licenses/LICENSE-2.0
 
 
 

VERSION.txt

+jetty-9.4.18.v20190429 - 29 April 2019
+ + 3476 IllegalStateException in WebSocket ConnectionState
+ + 3550 Server becomes unresponsive after sitting idle from a load spike
+ + 3563 Update to apache jasper 8.5.40
+ + 3573 Update jetty-bom for new infinispan artifacts.
+ + 3582 HeapByteBuffer cleared unexpected
+ + 3597 Session persistence broken from 9.4.13+
+ + 3609 Fix infinispan start module dependencies
+
+jetty-9.4.17.v20190418 - 18 April 2019
+ + 3464 Split SslContextFactory into Client and Server
+ + 3549 Directory Listing on Windows reveals Resource Base path
+ + 3555 DefaultHandler Reveals Base Resource Path of each Context
+
+jetty-9.4.16.v20190411 - 11 April 2019
+ + 1861 Limit total bytes pooled by ByteBufferPools
+ + 3133 Logging of `key.readyOps()` can throw unchecked `CancelledKeyException`
+ + 3159 WebSocket permessage-deflate RSV1 validity check
+ + 3274 OSGi versions of java.base classes in
+   org.apache.felix:org.osgi.foundation:jar conflicts with new rules on Java 9+
+ + 3319 Modernize Directory Listing: HTML5 and Sorting
+ + 3361 HandlerCollection.addHandler is lacking synchronization
+ + 3373 OutOfMemoryError: Java heap space in GZIPContentDecoder
+ + 3389 Websockets jsr356 willDecode not invoked during decoding
+ + 3394 java.security.acl.Group is deprecated and marked for removal
+ + 3404 Cleanup QuotedQualityCSV internal use of Double
+ + 3411 HttpClient does not timeout during multiple redirection
+ + 3421 Duplicate JSESSIONID sent when invalidating new session
+ + 3422 CLOSE_WAIT socket status forever after terminating websocket client
+   side
+ + 3425 Upgrade conscrypt version to 2.0.0 and remove usage of reflection
+ + 3429 JMX Operation to trigger manual deployment scan in WebAppProvider
+ + 3440 Stop server if Unavailable thrown
+ + 3444 org.eclipse.jetty.http.Http1FieldPreEncoder generates an invalid header
+   byte-array if header is null
+ + 3456 Allow multiple programmatic login/logout in same request
+ + 3464 Split SslContextFactory into Client and Server
+ + 3481 TLS close_notify() is not guaranteed
+ + 3489 Using setExtraClasspath("lib/extra/*") does not work on Microsoft
+   Windows
+ + 3526 HTTP Request Locale not retained in WebsocketUpgrade Request
+ + 3540 Use configured Provider in SslContextFactory consistently
+ + 3545 NullPointerException on ServletOutputStream.print("");
+
 jetty-9.4.15.v20190215 - 15 February 2019
  + 113 Add support for NCSA Extended Log File Format
  + 150 extraClasspath() method on WebAppContext dont support dir path
@@ -41,6 +85,25 @@ jetty-9.4.15.v20190215 - 15 February 2019
  + 3350 Do not expect to be able to connect to https URLs with the HttpClient
    created from a parameterless constructor
 
+jetty-9.3.27.v20190418 - 18 April 2019
+ + 3549 Directory Listing on Windows reveals Resource Base path
+ + 3555 DefaultHandler Reveals Base Resource Path of each Context
+
+jetty-9.3.26.v20190403 - 03 April 2019
+ + 2954 Improve cause reporting for HttpClient failures
+ + 3274 OSGi versions of java.base classes in
+   org.apache.felix:org.osgi.foundation:jar conflicts with new rules on Java 9+
+ + 3302 Support host:port in X-Forwarded-For header in
+   ForwardedRequestCustomizer
+ + 3319 Allow reverse sort for directory listed files
+
+jetty-9.2.28.v20190418 - 18 April 2019
+ + 3549 Directory Listing on Windows reveals Resource Base path
+ + 3555 DefaultHandler Reveals Base Resource Path of each Context
+
+jetty-9.2.27.v20190403 - 03 April 2019
+ + 3319 Refactored Directory Listing to modernize and avoid XSS
+
 jetty-9.4.14.v20181114 - 14 November 2018
  + 3097 Duplicated programmatic Servlet Listeners causing duplicate calls
  + 3103 HttpClientLoadTest reports a leak in byte buffer
@@ -88,6 +151,13 @@ jetty-9.4.13.v20181111 - 11 November 2018
  + 3090 MBeanContainer throws NPE for arrays
  + 3092 Wrong classloader used to load *MBean classes
 
+jetty-9.3.25.v20180904 - 04 September 2018
+ + 2135 Android 8.1 needs direct buffers for SSL/TLS to work
+ + 2777 Workaround for Conscrypt's ssl == null
+ + 2787 BadMessageException wrapped as ServletException not handled
+ + 2860 Leakage of HttpDestinations in HttpClient
+ + 2871 Server reads -1 after client resets HTTP/2 stream
+
 jetty-9.4.12.v20180830 - 30 August 2018
  + 300 Implement Deflater / Inflater Object Pool
  + 307 Monitor contention in AbstractNCSARequestLog
@@ -180,13 +250,6 @@ jetty-9.4.12.v20180830 - 30 August 2018
  + 2860 Leakage of HttpDestinations in HttpClient
  + 2871 Server reads -1 after client resets HTTP/2 stream
 
-jetty-9.3.25.v20180904 - 04 September 2018
- + 2135 Android 8.1 needs direct buffers for SSL/TLS to work
- + 2777 Workaround for Conscrypt's ssl == null
- + 2787 BadMessageException wrapped as ServletException not handled
- + 2860 Leakage of HttpDestinations in HttpClient
- + 2871 Server reads -1 after client resets HTTP/2 stream
-
 jetty-9.2.26.v20180806 - 06 August 2018
  + 2777 Workaround for Conscrypt's ssl == null
 

aggregates/jetty-all-compact3/pom.xml

@@ -2,7 +2,7 @@
   <parent>
     <groupId>org.eclipse.jetty</groupId>
     <artifactId>jetty-project</artifactId>
-    <version>9.4.15.v20190215</version>
+    <version>9.4.18.v20190429</version>
     <relativePath>../../pom.xml</relativePath>
   </parent>
   <modelVersion>4.0.0</modelVersion>

aggregates/jetty-all/pom.xml

@@ -2,7 +2,7 @@
   <parent>
     <groupId>org.eclipse.jetty</groupId>
     <artifactId>jetty-project</artifactId>
-    <version>9.4.15.v20190215</version>
+    <version>9.4.18.v20190429</version>
     <relativePath>../../pom.xml</relativePath>
   </parent>
   <modelVersion>4.0.0</modelVersion>

apache-jsp/pom.xml

@@ -2,7 +2,7 @@
   <parent>
     <groupId>org.eclipse.jetty</groupId>
     <artifactId>jetty-project</artifactId>
-    <version>9.4.15.v20190215</version>
+    <version>9.4.18.v20190429</version>
   </parent>
   <modelVersion>4.0.0</modelVersion>
   <artifactId>apache-jsp</artifactId>

apache-jstl/pom.xml

@@ -2,7 +2,7 @@
   <parent>
     <groupId>org.eclipse.jetty</groupId>
     <artifactId>jetty-project</artifactId>
-    <version>9.4.15.v20190215</version>
+    <version>9.4.18.v20190429</version>
   </parent>
   <modelVersion>4.0.0</modelVersion>
   <artifactId>apache-jstl</artifactId>

debian/changelog

+jetty9 (9.4.18-1) experimental; urgency=medium
+
+  * Team upload.
+  * New upstream release
+    - Addresses CVE-2019-10241, CVE-2019-10247 (Closes: #928444)
+  * Freshen years in debian/copyright
+  * Refresh patches for new upstream version
+  * Add org.eclipse.jetty:infinispan-embedded et.al. to maven.ignoreRules
+  * Update 09-tweak-distribution patch (jetty-home pom)
+
+ -- tony mancill <tmancill@debian.org>  Sun, 05 May 2019 19:57:45 -0700
+
 jetty9 (9.4.15-1) unstable; urgency=medium
 
   * New upstream release
@@ -329,7 +341,7 @@ jetty8 (8.1.3-6) unstable; urgency=low
   [ Emmanuel Bourg ]
   * Team upload.
   * Fixed the watch file
- 
+
   [ tony mancill ]
   * Upload to unstable for the jessie release cycle.
 
@@ -347,8 +359,8 @@ jetty8 (8.1.3-4) unstable; urgency=low
   * Team upload
   * Switch to use of javax.* and standard jar names for Servlet, JSP and
     EL API's (Closes: #678766):
-    - d/maven.rules: Fix mapping to javax.* artifacts as published by the 
-      latest version of the tomcat7 package. 
+    - d/maven.rules: Fix mapping to javax.* artifacts as published by the
+      latest version of the tomcat7 package.
     - d/{libjetty8-java,libjetty8-extra-java}.links: Switch use from
       deprecated tomcat-* jar files for Servlet, JSP and EL API's.
     - d/control: Bump minimum version of libtomcat7-java to ensure that
@@ -464,7 +476,7 @@ jetty (6.1.22-1) unstable; urgency=medium
   * Corrected path to jetty web-apps (by Niels Thykier). (Closes: #554877)
 
  -- Pablo Duboue <pablo.duboue@gmail.com>  Sun, 13 Dec 2009 1:55:00 -0400
-  
+
 jetty (6.1.21-1) unstable; urgency=medium
 
   * New upstream release.

debian/copyright

@@ -4,7 +4,7 @@ Source: http://git.eclipse.org/c/jetty/org.eclipse.jetty.project.git
 Files-Excluded: jetty-documentation/*
 
 Files: *
-Copyright: 2006-2018, Mort Bay Consulting Pty. Ltd.
+Copyright: 2006-2019, Mort Bay Consulting Pty. Ltd.
 License: Apache-2.0 or EPL-1.0
 
 Files: jetty-ant/src/main/java/org/eclipse/jetty/ant/utils/TaskLog.java
@@ -39,7 +39,7 @@ Files: debian/*
 Copyright: 2003, Philipp Meier <meier@meisterbohne.de>
            2009, Ludovic Claude <ludovic.claude@laposte.net>
            2009, David Yu <david.yu.ftw@gmail.com>
-           2012-2018, Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
+           2012-2019, Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
 License: Apache-2.0
 
 License: Apache-2.0

debian/maven.ignoreRules

@@ -27,12 +27,14 @@ org.eclipse.jetty test-* war * * *
 org.eclipse.jetty.example-async-rest example-async-rest-webapp war * * *
 
 # Ignored modules
-org.eclipse.jetty jetty-documentation * * * *
+org.eclipse.jetty infinispan-embedded
+org.eclipse.jetty infinispan-embedded-query
+org.eclipse.jetty infinispan-remote
+org.eclipse.jetty infinispan-remote-query
 org.eclipse.jetty jetty-alpn-conscrypt-server
-org.eclipse.jetty jetty-infinispan
+org.eclipse.jetty jetty-documentation * * * *
 org.eclipse.jetty jetty-hazelcast
 org.eclipse.jetty jetty-nosql
 org.eclipse.jetty.cdi cdi-servlet
 org.eclipse.jetty.gcloud jetty-gcloud-session-manager
 org.eclipse.jetty.memcached jetty-memcached-sessions
-

debian/patches/01-maven-bundle-plugin-version.patch

@@ -3,7 +3,7 @@ Date: Thu, 1 Mar 2012 21:32:54 +0100
 Subject: maven-bundle-plugin-version
 --- a/pom.xml
 +++ b/pom.xml
-@@ -388,6 +388,7 @@
+@@ -389,6 +389,7 @@
        <plugin>
          <groupId>org.apache.felix</groupId>
          <artifactId>maven-bundle-plugin</artifactId>

debian/patches/06-ignore-jetty-documentation.patch

@@ -3,7 +3,7 @@ Author: Emmanuel Bourg <ebourg@apache.org>
 Forwarded: not-needed
 --- a/pom.xml
 +++ b/pom.xml
-@@ -128,7 +128,6 @@
+@@ -129,7 +129,6 @@
      <module>jetty-alpn</module>
      <module>jetty-home</module>
      <module>jetty-bom</module>

debian/patches/09-tweak-distribution.patch

@@ -51,7 +51,16 @@ Forwarded: not-needed
                </artifactItems>
              </configuration>
            </execution>
-@@ -488,7 +480,7 @@
+@@ -449,7 +441,7 @@
+           </execution>
+           <execution>
+             <id>unpack-infinispan-config</id>
+-            <phase>generate-resources</phase>
++            <phase>none</phase>
+             <goals>
+               <goal>unpack</goal>
+             </goals>
+@@ -517,7 +509,7 @@
            </execution>
            <execution>
              <id>sources</id>

examples/async-rest/async-rest-jar/pom.xml

@@ -3,7 +3,7 @@
   <parent>
     <groupId>org.eclipse.jetty</groupId>
     <artifactId>example-async-rest</artifactId>
-    <version>9.4.15.v20190215</version>
+    <version>9.4.18.v20190429</version>
   </parent>
 
   <modelVersion>4.0.0</modelVersion>

examples/async-rest/async-rest-webapp/pom.xml

@@ -3,7 +3,7 @@
   <parent>
     <groupId>org.eclipse.jetty</groupId>
     <artifactId>example-async-rest</artifactId>
-    <version>9.4.15.v20190215</version>
+    <version>9.4.18.v20190429</version>
   </parent>
 
   <modelVersion>4.0.0</modelVersion>

examples/async-rest/pom.xml

@@ -3,7 +3,7 @@
   <parent>
     <groupId>org.eclipse.jetty.examples</groupId>
     <artifactId>examples-parent</artifactId>
-    <version>9.4.15.v20190215</version>
+    <version>9.4.18.v20190429</version>
   </parent>
 
   <modelVersion>4.0.0</modelVersion>

examples/embedded/pom.xml

@@ -2,7 +2,7 @@
   <parent>
     <groupId>org.eclipse.jetty.examples</groupId>
     <artifactId>examples-parent</artifactId>
-    <version>9.4.15.v20190215</version>
+    <version>9.4.18.v20190429</version>
     <relativePath>../pom.xml</relativePath>
   </parent>
   <modelVersion>4.0.0</modelVersion>

examples/embedded/src/main/java/org/eclipse/jetty/embedded/FastFileServer.java

@@ -25,7 +25,6 @@ import java.nio.ByteBuffer;
 import java.nio.channels.FileChannel;
 import java.nio.channels.FileChannel.MapMode;
 import java.nio.file.StandardOpenOption;
-
 import javax.servlet.AsyncContext;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
@@ -116,7 +115,8 @@ public class FastFileServer
                 }
                 String listing = Resource.newResource(file).getListHTML(
                         request.getRequestURI(),
-                        request.getPathInfo().lastIndexOf("/") > 0);
+                        request.getPathInfo().lastIndexOf("/") > 0,
+                        request.getQueryString());
                 response.setContentType("text/html; charset=utf-8");
                 response.getWriter().println(listing);
                 return;

examples/embedded/src/main/java/org/eclipse/jetty/embedded/Http2Server.java

@@ -22,7 +22,6 @@ package org.eclipse.jetty.embedded;
 import java.io.File;
 import java.io.IOException;
 import java.lang.management.ManagementFactory;
-import java.nio.file.Files;
 import java.util.Date;
 import java.util.EnumSet;
 
@@ -101,7 +100,7 @@ public class Http2Server
         String jetty_distro = System.getProperty("jetty.distro","../../jetty-distribution/target/distribution");
         if (!new File(jetty_distro).exists())
             jetty_distro = "jetty-distribution/target/distribution";
-        SslContextFactory sslContextFactory = new SslContextFactory();
+        SslContextFactory sslContextFactory = new SslContextFactory.Server();
         sslContextFactory.setKeyStorePath(jetty_distro + "/demo-base/etc/keystore");
         sslContextFactory.setKeyStorePassword("OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4");
         sslContextFactory.setKeyManagerPassword("OBF:1u2u1wml1z7s1z7a1wnl1u2g");