MERGE.txt

@@ -66,13 +66,13 @@ DBCP
 ----
 DBCP2
 Sub-tree
-/commons/proper/dbcp/trunk/src/main/java/org/apache/commons/dbcp2
-/commons/proper/dbcp/trunk/src/main/resources/org/apache/commons/dbcp2
+src/main/java/org/apache/commons/dbcp2
+src/main/resources/org/apache/commons/dbcp2
 The SHA1 ID for the most recent commit to be merged to Tomcat is:
-8a71764a895b234bd1fc76553835ef4c974f22e1
+d7aa662fbbb99e536ae28c47d0c4e1d51e39d5b9
 
 Pool2
 Sub-tree
 src/main/java/org/apache/commons/pool2
 The SHA1 ID for the most recent commit to be merged to Tomcat is:
-191a391166a8565718ef685531afa3fa44afd69c
+dfef97be70e8b1c3edb44b972fc7f700f3fe6255

bin/service.bat

@@ -52,19 +52,16 @@ echo Service will try to guess them from the registry.
 goto okJavaHome
 :gotJreHome
 if not exist "%JRE_HOME%\bin\java.exe" goto noJavaHome
-if not exist "%JRE_HOME%\bin\javaw.exe" goto noJavaHome
 goto okJavaHome
 :gotJdkHome
 if not exist "%JAVA_HOME%\bin\javac.exe" goto noJavaHome
 rem Java 9 has a different directory structure
 if exist "%JAVA_HOME%\jre\bin\java.exe" goto preJava9Layout
 if not exist "%JAVA_HOME%\bin\java.exe" goto noJavaHome
-if not exist "%JAVA_HOME%\bin\javaw.exe" goto noJavaHome
 if not "%JRE_HOME%" == "" goto okJavaHome
 set "JRE_HOME=%JAVA_HOME%"
 goto okJavaHome
 :preJava9Layout
-if not exist "%JAVA_HOME%\jre\bin\javaw.exe" goto noJavaHome
 if not "%JRE_HOME%" == "" goto okJavaHome
 set "JRE_HOME=%JAVA_HOME%\jre"
 goto okJavaHome

bin/setclasspath.bat

@@ -36,7 +36,6 @@ goto exit
 rem Check if we have a usable JDK
 if "%JAVA_HOME%" == "" goto noJavaHome
 if not exist "%JAVA_HOME%\bin\java.exe" goto noJavaHome
-if not exist "%JAVA_HOME%\bin\javaw.exe" goto noJavaHome
 if not exist "%JAVA_HOME%\bin\jdb.exe" goto noJavaHome
 if not exist "%JAVA_HOME%\bin\javac.exe" goto noJavaHome
 set "JRE_HOME=%JAVA_HOME%"
@@ -55,7 +54,6 @@ set "JRE_HOME=%JAVA_HOME%"
 :gotJreHome
 rem Check if we have a usable JRE
 if not exist "%JRE_HOME%\bin\java.exe" goto noJreHome
-if not exist "%JRE_HOME%\bin\javaw.exe" goto noJreHome
 goto okJava
 
 :noJreHome

build.properties.default

@@ -25,7 +25,7 @@
 # ----- Version Control Flags -----
 version.major=8
 version.minor=5
-version.build=31
+version.build=32
 version.patch=0
 version.suffix=
 
@@ -126,7 +126,7 @@ jdt.loc.1=http://archive.eclipse.org/eclipse/downloads/drops4/${jdt.release}/ecj
 jdt.loc.2=http://download.eclipse.org/eclipse/downloads/drops4/${jdt.release}/ecj-${jdt.version}.jar
 
 # ----- Tomcat native library -----
-tomcat-native.version=1.2.16
+tomcat-native.version=1.2.17
 tomcat-native.home=${base.path}/tomcat-native-${tomcat-native.version}
 tomcat-native.tar.gz=${tomcat-native.home}/tomcat-native.tar.gz
 tomcat-native.loc.1=${base-tomcat.loc.1}/tomcat-connectors/native/${tomcat-native.version}/source/tomcat-native-${tomcat-native.version}-src.tar.gz

build.xml

@@ -50,6 +50,8 @@
   <property name="websocket.revision" value="FR" />
   <!-- MR B but this was first 1.1 release so use FR -->
   <property name="jaspic.revision" value="FR" />
+  <!-- MR 2 but this was first 1.2 release so use FR -->
+  <property name="annotation.revision" value="FR" />
 
   <!-- Release artifact base names -->
   <property name="final.name"            value="${project}-${version}" />
@@ -687,8 +689,6 @@
 
   </target>
 
-
-
   <target name="build-manifests" unless="manifests.uptodate"
           depends="build-prepare">
     <!-- Filtering tokens for JAR manifests-->
@@ -699,6 +699,7 @@
     <filter token="el.revision" value="${el.revision}"/>
     <filter token="websocket.revision" value="${websocket.revision}"/>
     <filter token="jaspic.revision" value="${jaspic.revision}"/>
+    <filter token="annotation.revision" value="${annotation.revision}"/>
 
     <mkdir dir="${tomcat.manifests}" />
     <copy todir="${tomcat.manifests}" overwrite="yes" filtering="yes"
@@ -710,7 +711,7 @@
   </target>
 
   <target name="package" depends="compile,build-manifests" >
-    <!-- Common Annotations 1.0 JAR File -->
+    <!-- Common Annotations 1.2 JAR File -->
     <jarIt jarfile="${annotations-api.jar}"
       filesDir="${tomcat.classes}"
       filesId="files.annotations-api"
@@ -2454,7 +2455,7 @@ skip.installer property in build.properties" />
 
     <mkdir dir="${tomcat.src.jars}" />
 
-    <!-- Common Annotations 1.0 JAR File -->
+    <!-- Common Annotations 1.2 JAR File -->
     <jarIt jarfile="${annotations-api-src.jar}"
       filesDir="java"
       filesId="files.annotations-api"

conf/catalina.policy

@@ -172,12 +172,6 @@ grant {
     permission java.lang.RuntimePermission
      "accessClassInPackage.org.apache.jasper.runtime.*";
 
-    // Precompiled JSPs need access to these system properties.
-    permission java.util.PropertyPermission
-     "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read";
-    permission java.util.PropertyPermission
-     "org.apache.el.parser.COERCE_TO_ZERO", "read";
-
     // The cookie code needs these.
     permission java.util.PropertyPermission
      "org.apache.catalina.STRICT_SERVLET_COMPLIANCE", "read";

debian/changelog

+tomcat8 (8.5.32-1) unstable; urgency=medium
+
+  * Team upload.
+  * New upstream release
+    - Refreshed the patches
+
+ -- Emmanuel Bourg <ebourg@apache.org>  Mon, 25 Jun 2018 14:51:50 +0200
+
 tomcat8 (8.5.31-1) unstable; urgency=medium
 
   * Team upload.

debian/patches/0004-split-deploy-webapps-target-from-deploy-target.patch

@@ -3,7 +3,7 @@ Date: Mon, 28 Jun 2010 21:32:35 +0200
 Subject: [PATCH] split deploy-webapps target from deploy target
 --- a/build.xml
 +++ b/build.xml
-@@ -1008,7 +1008,7 @@
+@@ -1009,7 +1009,7 @@
      </xslt>
    </target>
  
@@ -12,7 +12,7 @@ Subject: [PATCH] split deploy-webapps target from deploy target
            description="Default. Builds a working Tomcat instance">
  
      <copy tofile="${tomcat.build}/bin/commons-daemon.jar" file="${commons-daemon.jar}" />
-@@ -1042,6 +1042,10 @@
+@@ -1043,6 +1043,10 @@
        </fileset>
      </copy>
  

debian/patches/0005-skip-test-failures.patch

@@ -3,7 +3,7 @@ Author: Emmanuel Bourg <ebourg@apache.org>
 Forwarded: not-needed
 --- a/build.xml
 +++ b/build.xml
-@@ -1382,8 +1382,10 @@
+@@ -1383,8 +1383,10 @@
        </filterchain>
      </concat>
  

debian/patches/0010-debianize-build-xml.patch

@@ -5,7 +5,7 @@ Last-Update: 2011-05-16
 
 --- a/build.xml
 +++ b/build.xml
-@@ -657,7 +657,7 @@
+@@ -659,7 +659,7 @@
      </copy>
    </target>
  
@@ -14,7 +14,7 @@ Last-Update: 2011-05-16
      <!-- Compile internal server components -->
      <javac srcdir="java" destdir="${tomcat.classes}"
             debug="${compile.debug}"
-@@ -1010,9 +1010,9 @@
+@@ -1011,9 +1011,9 @@
  
    <target name="deploy" depends="package,build-docs,build-tomcat-jdbc,compile-webapp-examples,deploy-webapps"
            description="Default. Builds a working Tomcat instance">

debian/patches/0013-dont-look-for-build-properties-in-user-home.patch

@@ -3,7 +3,7 @@ Date: Mon, 9 Jul 2012 20:53:38 +0000
 Subject: 0013-dont-look-for-build-properties-in-user-home
 --- a/build.xml
 +++ b/build.xml
-@@ -521,7 +521,6 @@
+@@ -523,7 +523,6 @@
      <!-- Property that determines if manifests need updating -->
      <uptodate property="manifests.uptodate"
          targetfile="${tomcat.manifests}/default.manifest" >

debian/patches/0018-fix-manager-webapp.patch

@@ -28,7 +28,7 @@ Last-Update: 2013-08-01
  </Context>]]></source>
 --- a/conf/catalina.policy
 +++ b/conf/catalina.policy
-@@ -203,7 +203,7 @@
+@@ -197,7 +197,7 @@
  // - default CATALINA_HOME == CATALINA_BASE
  // - CATALINA_HOME != CATALINA_BASE, per instance Manager in CATALINA_BASE
  // - CATALINA_HOME != CATALINA_BASE, shared Manager in CATALINA_HOME
@@ -37,7 +37,7 @@ Last-Update: 2013-08-01
      permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
      permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session";
      permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
-@@ -211,7 +211,7 @@
+@@ -205,7 +205,7 @@
      permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
      permission org.apache.catalina.security.DeployXmlPermission "manager";
  };
@@ -46,7 +46,7 @@ Last-Update: 2013-08-01
      permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
      permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session";
      permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
-@@ -226,10 +226,10 @@
+@@ -220,10 +220,10 @@
  // - default CATALINA_HOME == CATALINA_BASE
  // - CATALINA_HOME != CATALINA_BASE, per instance Host Manager in CATALINA_BASE
  // - CATALINA_HOME != CATALINA_BASE, shared Host Manager in CATALINA_HOME
@@ -59,7 +59,7 @@ Last-Update: 2013-08-01
      permission org.apache.catalina.security.DeployXmlPermission "host-manager";
  };
  
-@@ -275,4 +275,4 @@
+@@ -269,4 +269,4 @@
  //
  // The permissions granted to a specific JAR
  // grant codeBase "war:file:${catalina.base}/webapps/examples.war*/WEB-INF/lib/foo.jar" {

debian/patches/0019-add-distribution-to-error-page.patch

@@ -16,7 +16,7 @@ Bug-Debian: http://bugs.debian.org/729840
 \ No newline at end of file
 --- a/build.xml
 +++ b/build.xml
-@@ -237,6 +237,7 @@
+@@ -239,6 +239,7 @@
      <filter token="YEAR" value="${year}"/>
      <filter token="VERSION" value="${version}"/>
      <filter token="VERSION_NUMBER" value="${version.number}"/>

java/javax/el/ELProcessor.java

@@ -94,8 +94,7 @@ public class ELProcessor {
         Class<?> clazz = context.getImportHandler().resolveClass(className);
 
         if (clazz == null) {
-            clazz = Class.forName(className, true,
-                    Thread.currentThread().getContextClassLoader());
+            clazz = Class.forName(className, true, Util.getContextClassLoader());
         }
 
         if (!Modifier.isPublic(clazz.getModifiers())) {

java/javax/el/ExpressionFactory.java

@@ -103,7 +103,7 @@ public abstract class ExpressionFactory {
     public static ExpressionFactory newInstance(Properties properties) {
         ExpressionFactory result = null;
 
-        ClassLoader tccl = Thread.currentThread().getContextClassLoader();
+        ClassLoader tccl = Util.getContextClassLoader();
 
         CacheValue cacheValue;
         Class<?> clazz;

java/javax/el/ImportHandler.java

@@ -190,7 +190,7 @@ public class ImportHandler {
 
     private Class<?> findClass(String name, boolean throwException) {
         Class<?> clazz;
-        ClassLoader cl = Thread.currentThread().getContextClassLoader();
+        ClassLoader cl = Util.getContextClassLoader();
         String path = name.replace('.', '/') + ".class";
         try {
             /* Given that findClass() has to be called for every imported

java/javax/el/Util.java

@@ -21,6 +21,8 @@ import java.lang.reflect.Array;
 import java.lang.reflect.Constructor;
 import java.lang.reflect.Method;
 import java.lang.reflect.Modifier;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.text.MessageFormat;
 import java.util.ArrayList;
 import java.util.HashMap;
@@ -92,7 +94,8 @@ class Util {
      */
     static ExpressionFactory getExpressionFactory() {
 
-        ClassLoader tccl = Thread.currentThread().getContextClassLoader();
+        ClassLoader tccl = getContextClassLoader();
+
         CacheValue cacheValue = null;
         ExpressionFactory factory = null;
 
@@ -658,6 +661,19 @@ class Util {
     }
 
 
+    static ClassLoader getContextClassLoader() {
+        ClassLoader tccl;
+        if (System.getSecurityManager() != null) {
+            PrivilegedAction<ClassLoader> pa = new PrivilegedGetTccl();
+            tccl = AccessController.doPrivileged(pa);
+        } else {
+            tccl = Thread.currentThread().getContextClassLoader();
+        }
+
+        return tccl;
+    }
+
+
     private abstract static class Wrapper {
 
         public static List<Wrapper> wrap(Method[] methods, String name) {
@@ -794,4 +810,12 @@ class Util {
             return cmp;
         }
     }
+
+
+    private static class PrivilegedGetTccl implements PrivilegedAction<ClassLoader> {
+        @Override
+        public ClassLoader run() {
+            return Thread.currentThread().getContextClassLoader();
+        }
+    }
 }

java/org/apache/catalina/authenticator/AuthenticatorBase.java

@@ -19,9 +19,7 @@ package org.apache.catalina.authenticator;
 import java.io.IOException;
 import java.security.Principal;
 import java.security.cert.X509Certificate;
-import java.text.SimpleDateFormat;
 import java.util.Date;
-import java.util.Locale;
 import java.util.Map;
 import java.util.Set;
 
@@ -57,6 +55,7 @@ import org.apache.catalina.authenticator.jaspic.MessageInfoImpl;
 import org.apache.catalina.connector.Request;
 import org.apache.catalina.connector.Response;
 import org.apache.catalina.realm.GenericPrincipal;
+import org.apache.catalina.util.ConcurrentDateFormat;
 import org.apache.catalina.util.SessionIdGeneratorBase;
 import org.apache.catalina.util.StandardSessionIdGenerator;
 import org.apache.catalina.valves.ValveBase;
@@ -66,7 +65,6 @@ import org.apache.juli.logging.LogFactory;
 import org.apache.tomcat.util.ExceptionUtils;
 import org.apache.tomcat.util.descriptor.web.LoginConfig;
 import org.apache.tomcat.util.descriptor.web.SecurityConstraint;
-import org.apache.tomcat.util.http.FastHttpDateFormat;
 import org.apache.tomcat.util.res.StringManager;
 
 /**
@@ -90,13 +88,12 @@ import org.apache.tomcat.util.res.StringManager;
 public abstract class AuthenticatorBase extends ValveBase
         implements Authenticator, RegistrationListener {
 
-    private static final Log log = LogFactory.getLog(AuthenticatorBase.class);
+    private final Log log = LogFactory.getLog(AuthenticatorBase.class); // must not be static
 
     /**
      * "Expires" header always set to Date(1), so generate once only
      */
-    private static final String DATE_ONE =
-            (new SimpleDateFormat(FastHttpDateFormat.RFC1123_DATE, Locale.US)).format(new Date(1));
+    private static final String DATE_ONE = ConcurrentDateFormat.formatRfc1123(new Date(1));
 
     private static final AuthConfigProvider NO_PROVIDER_AVAILABLE = new NoOpAuthConfigProvider();
 

java/org/apache/catalina/authenticator/BasicAuthenticator.java

@@ -45,7 +45,7 @@ import org.apache.tomcat.util.codec.binary.Base64;
  */
 public class BasicAuthenticator extends AuthenticatorBase {
 
-    private static final Log log = LogFactory.getLog(BasicAuthenticator.class);
+    private final Log log = LogFactory.getLog(BasicAuthenticator.class); // must not be static
 
     private Charset charset = StandardCharsets.ISO_8859_1;
     private String charsetString = null;

java/org/apache/catalina/authenticator/DigestAuthenticator.java

@@ -45,7 +45,7 @@ import org.apache.tomcat.util.security.MD5Encoder;
  */
 public class DigestAuthenticator extends AuthenticatorBase {
 
-    private static final Log log = LogFactory.getLog(DigestAuthenticator.class);
+    private final Log log = LogFactory.getLog(DigestAuthenticator.class); // must not be static
 
 
     // -------------------------------------------------------------- Constants