BUILDING.txt

@@ -20,7 +20,7 @@
             ====================================================
 
 This subproject contains the source code for Tomcat @VERSION_MAJOR_MINOR@, a container that
-implements the Servlet 3.1, JSP 2.3, EL 3.0, WebSocket 1.1 and JASPIC 1.1
+implements the Servlet 4.0, JSP 2.3, EL 3.0, WebSocket 1.1 and JASPIC 1.1
 specifications from the Java Community Process <https://www.jcp.org/>.
 
 Note: If you just need to run Apache Tomcat, it is not necessary to build
@@ -35,7 +35,7 @@ source distribution, do the following:
 
  1. If the JDK is already installed, skip to (2).
 
- 2. Download a version 7 of Java Development Kit (JDK) release (use the
+ 2. Download a version 8 of Java Development Kit (JDK) release (use the
     latest update available for your chosen version) from one of:
 
         http://www.oracle.com/technetwork/java/javase/downloads/index.html
@@ -297,12 +297,6 @@ You can build them by using the following commands:
         codesigning.service=Microsoft Windows Signing
 
     Release managers will be provided with the necessary credentials by the PMC.
-    It will also be necessary to enable TLS 1.1 and TLS 1.2 by default (they are
-    disabled by default on Java 7) for the build process to communicate with the
-    code signing service. The simplest way is by setting the ANT_OPTS
-    environment variable. E.g. (for Windows):
-
-    set ANT_OPTS=-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2
 
  4. Build the release:
 

CONTRIBUTING.md

@@ -53,7 +53,7 @@ Tomcat Connectors products in Bugzilla.
 Excited yet? This section will guide you through providing a patch to the
 committers of the project for review and acceptance.
 
-##### Chose Your Method of Submission
+##### Choose Your Method of Submission
 
 You can provide a patch in one of the following ways (in order of preference):
 
@@ -90,13 +90,13 @@ committers to learn how to do this are found
 [here](https://www.apache.org/dev/contributors.html#svnbasics). However, in the
 interest of a fast ramp up, the short version is below. Note that the root of
 the SVN repository is
-[tomcat/trunk](http://svn.apache.org/repos/asf/tomcat/trunk),
+[tomcat/trunk](https://svn.apache.org/repos/asf/tomcat/trunk),
 but you can clone specific versions too, such as
-[tc8.5.x](http://svn.apache.org/repos/asf/tomcat/tc8.5.x/trunk/) or even tags (
-[TOMCAT_8_5_15](http://svn.apache.org/repos/asf/tomcat/tc8.5.x/tags/TOMCAT_8_5_15/)).
+[tc8.5.x](https://svn.apache.org/repos/asf/tomcat/tc8.5.x/trunk/) or even tags (
+[TOMCAT_8_5_15](https://svn.apache.org/repos/asf/tomcat/tc8.5.x/tags/TOMCAT_8_5_15/)).
 
 ```
-$ svn co http://svn.apache.org/repos/asf/tomcat/trunk/
+$ svn co https://svn.apache.org/repos/asf/tomcat/trunk/
 ```
 
 ##### Github

KEYS

@@ -614,3 +614,63 @@ QCuUl/v3Zly66jThcNS/U6S9VXBtQRxDZtkL8pSzmJxaFvvnZgkQ/hlvJ8f9ccS7
 2/KQU94=
 =yvcP
 -----END PGP PUBLIC KEY BLOCK-----
+
+pub   rsa4096 2018-10-20 [SC]
+      7659 0809 9ACF 9270 2C7D  949B FA0C 35EA 8AA2 99F1
+uid           Konstantin Kolinko (CODE SIGNING KEY) <kkolinko@apache.org>
+sig 3        FA0C35EA8AA299F1 2018-10-20  Konstantin Kolinko (CODE SIGNING KEY) <kkolinko@apache.org>
+sub   rsa4096 2018-10-20 [E]
+sig          FA0C35EA8AA299F1 2018-10-20  Konstantin Kolinko (CODE SIGNING KEY) <kkolinko@apache.org>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFvK5u8BEADAYQQ4aUftuWr+CuHgL1iY7i8LqMomEdfyoDAmPPcMQ0Th6r4a
+p/Oq/9OuCAXOfX2ev9FVj9oHynkOUDqRlHfplkquacuQtlhZzFSlkO8Jyk6AcbK0
+dbGMOyiPnOS/+odt2Nxht9ksQvXn61IsQ9YtRZ7GEngaYmVfnZCYeDGy6sghYFrO
+laG8n7MfQaqaVZUVSagMgiHxmtn4Ai8EN7z2MGv/pi4xX6QkfPiTtxoj56DN5Ax/
+rTwyFVgr4mUa2FSn8ytclWXKMjcAIX42UIQ5vtELHMZl6DI2SLxaHQm8JgQ39SFc
+aE4ukji145Srjl2qSiUxr6SJaDi1V5wONCcBkOkoS1M0tdbncpaa89mwrberIrU+
+NoFZvc7YPLCUFBW+cyG3gcAegiRRwwwGd+ETnKEd+i7bNnMbBXtMxox11w2imBz/
+TV13PvaEH5Sp+4PTJ6/7pMORPGjhKjmojXtz5joJSx26CRPfeXxPdB3N0p6jL5tU
+IVNNUhpBvuADQur3FTYxv1mN5h4C6y1nw/HplWyLmo7tjPDgfShv3Cst4G+UHYLf
+15NUO77YhyYKv9RkFBARLTMt3gcxukyNFqaNYoLtTpo2daOvbdKeAVr+TXMfiVOd
+wccKAAieISjHIXI2zaLh7fpkHv6SZR5HxtloQkdcshDXd+H4aTCQS99b1QARAQAB
+tDtLb25zdGFudGluIEtvbGlua28gKENPREUgU0lHTklORyBLRVkpIDxra29saW5r
+b0BhcGFjaGUub3JnPokCTgQTAQgAOBYhBHZZCAmaz5JwLH2Um/oMNeqKopnxBQJb
+yubvAhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEPoMNeqKopnxYDsP/1yP
+ViWfh2fUoadTFAIy1TMdJfOqwABPW+1AWACLEsF8dcfA/mRRjrTWhR4+RTyP9Thn
+/qBGsO0oZZrxIXPdqnZq3Dt15StBLHJtexKll8BLRXp56uTV3BPFFiBYHGLvNivW
+QwYBBhMhvcpG+xQdqwhyhfycdyfr75HQ24z+L2i7rrGsKvSWT1F9FSsfgk82fz7T
+HXsMcmDiL7RzZX0vau7l1823ug+q0WLYLIMdbRu4XySTsgmz8cLImDrvOSTiccp3
+hdJbulcoTtfCQOrQkFliUAZ1zBtBcNqyMANp2iwSj24MrI+ofs53PDfKLiqQLxrZ
+7+X7pTapX5IZ4U4Bra9IcoaMYmNLsUUstZUviho57aWWf+H7n9x6+Ny5I6T6KB9b
+W343z6E9LX601AJZnm+nVNoOW6oyfOBcMfEUF5WT2lqy5hRW+wXB3kzUvMMC0O1u
+FAf/9dBbRrRbBCPeECw/OTlquvwe8t7v2FOyD/nVk/Ku50Pr6quf+zoJULXOM1IH
+HzwvTxRblgMobtvU9seVJ455VCCXUkH91Tymt5bY1oXeHD5QR/DGv4ldL8J+IrC+
+9oBbuifZvmO8VeoV4uckdFPkb7ZdjWMOAr87q0dkQsruWZve6aBEaofNyKkP2R7A
+IvtkcBRvEQxgcn1XjV2R6vsLXnhj4h8VLrgL9hbjuQINBFvK5u8BEAC4T9N/Bueq
+oJPLUulnzzSYFwV+09HHLNQIgcLdbbHT/YWoOt52UnotyiTRIEgKHdgHOt/JleDJ
+WyIdJKXBjve+B4qH7QCJYys7TkG2Rp9cCp5DBiv646srTro07YxdjeQxEgeh5ISk
+XzwaHtsAt3mlcpOhc1FFMKTK6OmPzyJDuwmh24VUKXwaF8lygJCTxohIxSrOJgFl
+A4RmMKhlIDNN27PD4gXR35vx9KuT9xMRHYzaK0gG5sls/ECIdhVsYVKs9nk22KLb
+W+ax1btHDBR4qCBqd6BLobtyZOGTDhOjo63PF6lBUiveud+wsQI6Il/7KxfFOyAM
+K6DOSbnkesOwh5ZtrWDp+Fmm9IdkDizZ2wKnZ+MSW7yGVIuJe5F8OhOV1EJobJzi
+w2ZVhE7JjwEJkJ1NVbkz3t3uRdQDbo4uA/rbGyaJvDvZuDudoqosAgmSX3AIlgDo
+UgnUquvGvUA47f88oWnlUMWGf5BtfUwqmrsm5IAhOygwsReWvArdgeLg86CvtUIz
+0lY0AA/Tms+Qq7z9M/yqMbS4KvdjUFIiJMc3qsa2QYTvsIRpaSa29M7p40OHFILy
+CE830AlFodt4126Y5KzPv7W/kx5S2JEaL9/F6eunQXhCq7+qfgaiysK/BcF6iNkW
+8MsYyUb/ssg5ZgRRQGjhYdUA03WJxObLWwARAQABiQI2BBgBCAAgFiEEdlkICZrP
+knAsfZSb+gw16oqimfEFAlvK5u8CGwwACgkQ+gw16oqimfEyzhAAmGslS4w+oIe5
+mV2rxTqhpr0/KUwtdapPSYWgx5yYjNN6kpu0Cm498GfVZvYaHHLKrX5JhC5EZlab
+Bhuo0V1iA5tkjeh824Ty9XSOYG45B836mOVcXpCCPAu5i0JmsQCwvQWYyXuZbGLa
+lQ9LBb2K3c6yBLcXgEHI3MCK/JmGjZo1QJiZYTuLTl8tEZchiwp9iB7fhcSatjGu
+jJSbIb0JqU5c9GhVihq9tucLECJPSo8gC2GXOwqFs2Df4rcsK3Ua099aqj5q6Ugu
+JODlWh4FIYV9YLKkoNCXCIe0geSWBvWD80ccMkSvAAcyy07dQzGw3bAj4DfGa21A
+R/HpTEKqYMkovjOLuDptF8GL8+clXXnMzOswqsWdwQmw8dwk8mR4ZoYLSSVNwEzo
+7LHTyXyJgc4K4UUPTj+nXFdUTDZLoELDc6ok1fcRIM8MalcSw7Jh3ZEJv5kY+Vxn
+rmfUi0P3iaseYZCtykRaRssyFNknOYWIrTtKH9h2rF4oaLsWxLEosVgGZUsbPcTZ
+uYw7knX6NkWTS9IRR3BpJ3tw0kk9DPHK3sNlumdMk0ylzkFbZc7JCQi325WrABsK
+C6Wc1owhZdi9ysx7mshgK4gu7JIAk8ryyN9XbyNjIM6M9aMYxTwECnLQPI8sTALg
+mSKqKZpUdvO77XQVYsjBAu3aMluPBNo=
+=uK1p
+-----END PGP PUBLIC KEY BLOCK-----

MERGE.txt

@@ -49,7 +49,7 @@ GIT
 Updates from Git are applied manually via patch files. Patch files are generated
 using:
 git diff <last SHA1>:<sub-tree> HEAD:<sub-tree> > temp.patch
-The more recently merged SHA1 for the component below should be updated after
+The most recently merged SHA1 for the component below should be updated after
 the patch file has been applied and committed
 
 FileUpload

NOTICE

@@ -10,6 +10,9 @@ developed by the Netty project
 and from finagle-native developed at Twitter
 (https://github.com/twitter/finagle).
 
+This software contains code derived from jgroups-kubernetes
+developed by the JGroups project (http://www.jgroups.org/).
+
 The Windows Installer is built with the Nullsoft
 Scriptable Install System (NSIS), which is
 open source software.  The original software and
@@ -21,6 +24,10 @@ JDT Core Batch Compiler component, which is open source software.
 The original software and related information is available at
 https://www.eclipse.org/jdt/core/.
 
+org.apache.tomcat.util.json.JSONParser.jj is a public domain javacc grammar
+for JSON written by Robert Fischer.
+https://github.com/RobertFischer/json-parser
+
 For portions of the Tomcat JNI OpenSSL API and the OpenSSL JSSE integration
 The org.apache.tomcat.jni and the org.apache.tomcat.net.openssl packages
 are derivative work originating from the Netty project and the finagle-native
@@ -28,6 +35,12 @@ project developed at Twitter
 * Copyright 2014 The Netty Project
 * Copyright 2014 Twitter
 
+For portions of the Tomcat cloud support
+The org.apache.catalina.tribes.membership.cloud package contains derivative
+work originating from the jgroups project.
+https://github.com/jgroups-extras/jgroups-kubernetes
+Copyright 2002-2018 Red Hat Inc.
+
 The original XML Schemas for Java EE Deployment Descriptors:
  - javaee_5.xsd
  - javaee_web_services_1_2.xsd
@@ -46,6 +59,10 @@ The original XML Schemas for Java EE Deployment Descriptors:
  - web-app_3_1.xsd
  - web-common_3_1.xsd
  - web-fragment_3_1.xsd
+ - javaee_8.xsd
+ - web-app_4_0.xsd
+ - web-common_4_0.xsd
+ - web-fragment_4_0.xsd
 
 may be obtained from:
 http://www.oracle.com/webfolder/technetwork/jsc/xml/ns/javaee/index.html

RELEASE-NOTES

@@ -38,7 +38,7 @@ CONTENTS:
 ===================
 Dependency Changes:
 ===================
-Tomcat @VERSION_MAJOR_MINOR@ is designed to run on Java SE 7 and later.
+Tomcat @VERSION_MAJOR_MINOR@ is designed to run on Java SE 8 and later.
 
 
 ==============
@@ -57,11 +57,6 @@ removed or changed although it may be deprecated.
 Note: As Tomcat @VERSION_MAJOR@ matures, the above list will be added to. The list is not
       considered complete at this time.
 
-Note: A large number of deprecated methods, fields and configuration options
-      were removed in the transition from 8.0.x to 8.5.x. If any of those
-      removals triggers significant problems for the user community that the
-      deletion may be reverted in a later point release.
-
 The remaining classes are considered part of the Tomcat internals and may change
 without notice between point releases.
 
@@ -82,7 +77,7 @@ for use by web applications (by placing them in "lib"):
 * jasper.jar (Jasper 2 Compiler and Runtime)
 * jasper-el.jar (Jasper 2 EL implementation)
 * jsp-api.jar (JSP 2.3 API)
-* servlet-api.jar (Servlet 3.1 API)
+* servlet-api.jar (Servlet 4.0 API)
 * tomcat-api.jar (Interfaces shared by Catalina and Jasper)
 * tomcat-coyote.jar (Tomcat connectors and utility classes)
 * tomcat-dbcp.jar (package renamed database connection pool based on Commons DBCP 2)

RUNNING.txt

@@ -20,16 +20,16 @@
             ===================================================
 
 Apache Tomcat @VERSION_MAJOR_MINOR@ requires a Java Standard Edition Runtime
-Environment (JRE) version 7 or later.
+Environment (JRE) version 8 or later.
 
 =============================
-Running With JRE 7 Or Later
+Running With JRE 8 Or Later
 =============================
 
 (1) Download and Install a Java SE Runtime Environment (JRE)
 
 (1.1) Download a Java SE Runtime Environment (JRE),
-      release version 7 or later, from
+      release version 8 or later, from
       http://www.oracle.com/technetwork/java/javase/downloads/index.html
 
 (1.2) Install the JRE according to the instructions included with the
@@ -157,7 +157,7 @@ create the following script file:
 
 On Windows, %CATALINA_BASE%\bin\setenv.bat:
 
-  set "JRE_HOME=%ProgramFiles%\Java\jre7"
+  set "JRE_HOME=%ProgramFiles%\Java\jre8"
   exit /b 0
 
 On *nix, $CATALINA_BASE/bin/setenv.sh:

TOMCAT-NEXT.txt

+================================================================================
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+================================================================================
+
+Notes of things to consider for the next major Tomcat release (10.0.x)
+
+Items carried over from the 9.0.x list:
+
+1.  Remove the use of system properties to control configuration wherever
+    possible.
+
+2.  Reduce instances of setters and getters for the same property existing on an
+    object and its parent. This may require new objects to be exposed via JMX.
+
+3.  Consider wrapping the SocketWrapper with a facade to detect / prevent
+    components retaining references longer than they should.
+
+New items for 10.0.x onwards:
+
+1.  Remove APR connector.
+
+2.  Remove org.apache.tomcat.jni and replace with the minimum necessary to
+    interface with OpenSSL and clones.
+
+3.  Remove the ExtensionValidator and associated classes (assuming that the
+    minimum Java version is Java 9 or later).
+
+4.  New embedded APIs (likely also for 9.x).

bin/catalina.sh

@@ -296,7 +296,7 @@ if [ -z "$USE_NOHUP" ]; then
 fi
 unset _NOHUP
 if [ "$USE_NOHUP" = "true" ]; then
-    _NOHUP=nohup
+    _NOHUP="nohup"
 fi
 
 # Add the JAVA 9 specific start-up parameters required by Tomcat

bin/ciphers.bat

+@echo off
+rem Licensed to the Apache Software Foundation (ASF) under one or more
+rem contributor license agreements.  See the NOTICE file distributed with
+rem this work for additional information regarding copyright ownership.
+rem The ASF licenses this file to You under the Apache License, Version 2.0
+rem (the "License"); you may not use this file except in compliance with
+rem the License.  You may obtain a copy of the License at
+rem
+rem     http://www.apache.org/licenses/LICENSE-2.0
+rem
+rem Unless required by applicable law or agreed to in writing, software
+rem distributed under the License is distributed on an "AS IS" BASIS,
+rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+rem See the License for the specific language governing permissions and
+rem limitations under the License.
+
+rem ---------------------------------------------------------------------------
+rem Script to digest password using the algorithm specified
+rem ---------------------------------------------------------------------------
+
+setlocal
+
+rem Guess CATALINA_HOME if not defined
+set "CURRENT_DIR=%cd%"
+if not "%CATALINA_HOME%" == "" goto gotHome
+set "CATALINA_HOME=%CURRENT_DIR%"
+if exist "%CATALINA_HOME%\bin\tool-wrapper.bat" goto okHome
+cd ..
+set "CATALINA_HOME=%cd%"
+cd "%CURRENT_DIR%"
+:gotHome
+if exist "%CATALINA_HOME%\bin\tool-wrapper.bat" goto okHome
+echo The CATALINA_HOME environment variable is not defined correctly
+echo This environment variable is needed to run this program
+goto end
+:okHome
+
+set "EXECUTABLE=%CATALINA_HOME%\bin\tool-wrapper.bat"
+
+rem Check that target executable exists
+if exist "%EXECUTABLE%" goto okExec
+echo Cannot find "%EXECUTABLE%"
+echo This file is needed to run this program
+goto end
+:okExec
+
+rem Get remaining unshifted command line arguments and save them in the
+set CMD_LINE_ARGS=
+:setArgs
+if ""%1""=="""" goto doneSetArgs
+set CMD_LINE_ARGS=%CMD_LINE_ARGS% %1
+shift
+goto setArgs
+:doneSetArgs
+
+call "%EXECUTABLE%" org.apache.tomcat.util.net.openssl.ciphers.OpenSSLCipherConfigurationParser %CMD_LINE_ARGS%
+
+:end

java/org/apache/tomcat/util/http/res/LocalStrings_es.properties → bin/ciphers.sh

+#!/bin/sh
+
 # Licensed to the Apache Software Foundation (ASF) under one or more
 # contributor license agreements.  See the NOTICE file distributed with
 # this work for additional information regarding copyright ownership.
@@ -12,51 +14,47 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-#
-# HttpMessages. The values in this file will be used in HTTP headers and as such
-# may only contain TEXT as defined by RFC 2616
-sc.100 = Continuar
-sc.101 = Cambiando Protocolos
-sc.200 = OK
-sc.201 = Creado
-sc.202 = Aceptado
-sc.203 = Informaci\u00F3n No-Autorizativa
-sc.204 = Sin Contenido
-sc.205 = Reponer Contenido
-sc.206 = Contenido Parcial
-sc.207 = Multi-Estado
-sc.300 = M\u00FAltiples Elecciones
-sc.301 = Movido permanentemente
-sc.302 = Movido temporalmente
-sc.303 = Mirar Otro
-sc.304 = No Modificado
-sc.305 = Usar Proxy
-sc.307 = Redirecci\u00F3n Temporal
-sc.400 = Petici\u00F3n incorrecta
-sc.401 = No Autorizado
-sc.402 = Pago requerido
-sc.403 = Prohibido
-sc.404 = No Encontrado
-sc.405 = M\u00E9todo No Permitido
-sc.406 = No Aceptable
-sc.407 = Autentificaci\u00F3n Proxy Requerida
-sc.408 = Request Caducada
-sc.409 = Conflicto
-sc.410 = Ido
-sc.411 = Longitud Requerida
-sc.412 = Precondici\u00F3n Fallada
-sc.413 = Entidad de Request Demasiado Grande
-sc.414 = Request-URI Demasiado Larga
-sc.415 = Tipo de Medio No Soportado
-sc.416 = El Rango Pedido No Ser Satisfecho
-sc.417 = Expectativa Fallada
-sc.422 = Entidad Improcesable
-sc.423 = Bloqueado
-sc.424 = Dependencia Fallida
-sc.500 = Error Interno del Servidor
-sc.501 = No Implementado
-sc.502 = Pasarela Incorrecta
-sc.503 = Servicio no Disponible
-sc.504 = Pasarela Caducada
-sc.505 = Versi\u00F3n de HTTP No Soportada
-sc.507 = Almacenaje Insuficiente
\ No newline at end of file
+
+# -----------------------------------------------------------------------------
+# Script to digest password using the algorithm specified
+# -----------------------------------------------------------------------------
+
+# Better OS/400 detection: see Bugzilla 31132
+os400=false
+case "`uname`" in
+OS400*) os400=true;;
+esac
+
+# resolve links - $0 may be a softlink
+PRG="$0"
+
+while [ -h "$PRG" ] ; do
+  ls=`ls -ld "$PRG"`
+  link=`expr "$ls" : '.*-> \(.*\)$'`
+  if expr "$link" : '/.*' > /dev/null; then
+    PRG="$link"
+  else
+    PRG=`dirname "$PRG"`/"$link"
+  fi
+done
+
+PRGDIR=`dirname "$PRG"`
+EXECUTABLE=tool-wrapper.sh
+
+# Check that target executable exists
+if $os400; then
+  # -x will Only work on the os400 if the files are:
+  # 1. owned by the user
+  # 2. owned by the PRIMARY group of the user
+  # this will not work if the user belongs in secondary groups
+  eval
+else
+  if [ ! -x "$PRGDIR"/"$EXECUTABLE" ]; then
+    echo "Cannot find $PRGDIR/$EXECUTABLE"
+    echo "The file is absent or does not have execute permission"
+    echo "This file is needed to run this program"
+    exit 1
+  fi
+fi
+
+exec "$PRGDIR"/"$EXECUTABLE" org.apache.tomcat.util.net.openssl.ciphers.OpenSSLCipherConfigurationParser "$@"

bin/daemon.sh

@@ -18,20 +18,22 @@
 # -----------------------------------------------------------------------------
 # Commons Daemon wrapper script.
 # -----------------------------------------------------------------------------
-#
+
 # resolve links - $0 may be a softlink
-ARG0="$0"
-while [ -h "$ARG0" ]; do
-  ls=`ls -ld "$ARG0"`
+PRG="$0"
+
+while [ -h "$PRG" ]; do
+  ls=`ls -ld "$PRG"`
   link=`expr "$ls" : '.*-> \(.*\)$'`
   if expr "$link" : '/.*' > /dev/null; then
-    ARG0="$link"
+    PRG="$link"
   else
-    ARG0="`dirname $ARG0`/$link"
+    PRG=`dirname "$PRG"`/"$link"
   fi
 done
-DIRNAME="`dirname $ARG0`"
-PROGRAM="`basename $ARG0`"
+
+DIRNAME="`dirname "$PRG"`"
+PROGRAM="`basename "$PRG"`"
 while [ ".$1" != . ]
 do
   case "$1" in
@@ -100,10 +102,10 @@ if [ -z "$JAVA_HOME" ]; then
         if expr "$link" : '/.*' > /dev/null; then
             JAVA_BIN="$link"
         else
-            JAVA_BIN="`dirname $JAVA_BIN`/$link"
+            JAVA_BIN="`dirname "$JAVA_BIN"`/$link"
         fi
     done
-    test -x "$JAVA_BIN" && JAVA_HOME="`dirname $JAVA_BIN`"
+    test -x "$JAVA_BIN" && JAVA_HOME="`dirname "$JAVA_BIN"`"
     test ".$JAVA_HOME" != . && JAVA_HOME=`cd "$JAVA_HOME/.." >/dev/null; pwd`
 else
     JAVA_BIN="$JAVA_HOME/bin/java"
@@ -134,7 +136,7 @@ elif [ -r "$CATALINA_HOME/bin/setenv.sh" ]; then
 fi
 
 # Add on extra jar files to CLASSPATH
-test ".$CLASSPATH" != . && CLASSPATH="${CLASSPATH}:"
+test ".$CLASSPATH" != . && CLASSPATH="$CLASSPATH:"
 CLASSPATH="$CLASSPATH$CATALINA_HOME/bin/bootstrap.jar:$CATALINA_HOME/bin/commons-daemon.jar"
 
 test ".$CATALINA_OUT" = . && CATALINA_OUT="$CATALINA_BASE/logs/catalina-daemon.out"
@@ -168,7 +170,7 @@ if [ "$cygwin" = "false" ]; then
     MAX_FD_LIMIT=`ulimit -H -n`
     if [ "$?" -eq 0 ]; then
         # Darwin does not allow RLIMIT_INFINITY on file soft limit
-        if [ "$darwin" = "true" -a "$MAX_FD_LIMIT" = "unlimited" ]; then
+        if [ "$darwin" = "true" ] && [ "$MAX_FD_LIMIT" = "unlimited" ]; then
             MAX_FD_LIMIT=`/usr/sbin/sysctl -n kern.maxfilesperproc`
         fi
         test ".$MAX_FD" = ".maximum" && MAX_FD="$MAX_FD_LIMIT"

bin/makebase.bat

+@echo off
+rem Licensed to the Apache Software Foundation (ASF) under one or more
+rem contributor license agreements.  See the NOTICE file distributed with
+rem this work for additional information regarding copyright ownership.
+rem The ASF licenses this file to You under the Apache License, Version 2.0
+rem (the "License"); you may not use this file except in compliance with
+rem the License.  You may obtain a copy of the License at
+rem
+rem     http://www.apache.org/licenses/LICENSE-2.0
+rem
+rem Unless required by applicable law or agreed to in writing, software
+rem distributed under the License is distributed on an "AS IS" BASIS,
+rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+rem See the License for the specific language governing permissions and
+rem limitations under the License.
+
+rem This script creates the directory structure required for running Tomcat
+rem in a separate directory by pointing %CATALINA_BASE% to it. It copies the
+rem conf directory from %CATALINA_HOME%, and creates empty directories for
+rem bin, lib, logs, temp, webapps, and work.
+rem
+rem If the file %CATALINA_HOME%/bin/setenv.sh exists then it is copied to
+rem the target directory as well.
+rem
+rem Usage: makebase <path-to-target-directory> [-w | --webapps]
+
+setlocal
+
+rem Guess CATALINA_HOME if not defined
+set "CURRENT_DIR=%cd%"
+if not "%CATALINA_HOME%" == "" goto gotHome
+set "CATALINA_HOME=%CURRENT_DIR%"
+if exist "%CATALINA_HOME%\bin\catalina.bat" goto okHome
+cd ..
+set "CATALINA_HOME=%cd%"
+cd "%CURRENT_DIR%"
+:gotHome
+
+if exist "%CATALINA_HOME%\bin\catalina.bat" goto okHome
+echo The CATALINA_HOME environment variable is not defined correctly
+echo This environment variable is needed to run this program
+goto EOF
+:okHome
+
+rem first arg is the target directory
+set BASE_TGT=%1
+
+if %BASE_TGT%.==. (
+    rem target directory not provided; exit
+    echo Usage: makebase ^<path-to-target-directory^>
+    goto :EOF
+)
+
+set COPY_WEBAPPS=false
+
+rem parse args
+for %%a in (%*) do (
+   if "%%~a"=="--webapps" (
+       set COPY_WEBAPPS=true
+   )
+   if "%%~a"=="-w" (
+       set COPY_WEBAPPS=true
+   )
+)
+
+if exist %BASE_TGT% (
+  rem target directory exists
+  echo Target directory exists
+
+    rem exit if target directory is not empty
+    for /F %%i in ('dir /b %BASE_TGT%\*.*') do (
+        echo Target directory is not empty
+        goto :EOF
+    )
+) else (
+    rem create the target directory
+    mkdir %BASE_TGT%
+)
+
+rem create empty directories
+for %%d in (bin, conf, lib, logs, temp, webapps, work) do (
+    mkdir %BASE_TGT%\%%d
+)
+
+if "%COPY_WEBAPPS%" == "true" (
+    echo Copying webapps
+    robocopy %CATALINA_HOME%\webapps %BASE_TGT%\webapps /E > nul
+    rem copy conf directory recursively
+    robocopy %CATALINA_HOME%\conf %BASE_TGT%\conf /E > nul
+) else (
+    rem copy conf directory without subdirectories and suppress warning
+    robocopy %CATALINA_HOME%\conf %BASE_TGT%\conf > nul
+    rem create empty ROOT directory
+    mkdir %BASE_TGT%\webapps\ROOT
+)
+
+rem copy setenv.bat if exists
+robocopy %CATALINA_HOME%\bin %BASE_TGT%\bin setenv.bat > nul
+
+echo Created CATALINA_BASE directory at %BASE_TGT%
+
+echo.
+echo You can launch the new instance by running:
+echo     set CATALINA_HOME=%CATALINA_HOME%
+echo     set CATALINA_BASE=%BASE_TGT%
+echo     %%CATALINA_HOME%%/bin/catalina.bat run
+
+echo.
+echo Attention: The ports in conf\server.xml might be bound by a
+echo     different instance. Please review your config files
+echo     and update them where necessary.
+echo.
+
+:EOF

bin/makebase.sh

+#!/bin/sh
+
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This script creates the directory structure required for running Tomcat
+# in a separate directory by pointing $CATALINA_BASE to it. It copies the
+# conf directory from $CATALINA_HOME, and creates empty directories for
+# bin, lib, logs, temp, webapps, and work.
+#
+# If the file $CATALINA_HOME/bin/setenv.sh exists then it is copied to
+# the target directory as well.
+#
+# Usage: makebase <path-to-target-directory> [-w | --webapps]
+
+# resolve links - $0 may be a softlink
+PRG="$0"
+
+while [ -h "$PRG" ]; do
+  ls=`ls -ld "$PRG"`
+  link=`expr "$ls" : '.*-> \(.*\)$'`
+  if expr "$link" : '/.*' > /dev/null; then
+    PRG="$link"
+  else
+    PRG=`dirname "$PRG"`/"$link"
+  fi
+done
+
+# Get standard environment variables
+PRGDIR=`dirname "$PRG"`
+
+# Only set CATALINA_HOME if not already set
+[ -z "$CATALINA_HOME" ] && CATALINA_HOME=`cd "$PRGDIR/.." >/dev/null; pwd`
+
+# first arg is the target directory
+BASE_TGT=$1
+
+if [ -z "$BASE_TGT" ]; then
+    # target directory not provided; exit
+    echo "Usage: makebase <path-to-target-directory>"
+    exit 1
+fi
+
+COPY_WEBAPPS=false
+
+# parse args
+while [ "$1" != "" ]; do
+    case $1 in
+        -w | --webapps)
+            COPY_WEBAPPS=true
+            ;;
+    esac
+    shift
+done
+
+if [ -d "$BASE_TGT" ]; then
+  # target directory exists
+  echo "Target directory exists"
+
+    # exit if target directory is not empty
+    [ "`ls -A "$BASE_TGT"`" ] && \
+        echo "Target directory is not empty" && \
+        exit 1
+else
+    # create the target directory
+    mkdir -p "$BASE_TGT"
+fi
+
+for dir in bin conf lib logs temp webapps work;
+do
+    # create empty directories
+    mkdir "$BASE_TGT/$dir"
+done
+
+if [ "$COPY_WEBAPPS" = true ]; then
+    echo "Copying webapps"
+    cp -r "$CATALINA_HOME/webapps" "$BASE_TGT/"
+    # copy conf directory recursively
+    cp -r "$CATALINA_HOME/conf" "$BASE_TGT/"
+else
+    # copy conf directory without subdirectories and suppress warning
+    cp "${CATALINA_HOME}/conf"/* "$BASE_TGT/conf" 2> /dev/null
+    # create empty ROOT directory
+    mkdir "$BASE_TGT/webapps/ROOT"
+fi
+
+# copy setenv.sh if exists
+[ -f "$CATALINA_HOME/bin/setenv.sh" ] && \
+    cp "$CATALINA_HOME/bin/setenv.sh" "$BASE_TGT/bin/"
+
+echo "Created CATALINA_BASE directory at $BASE_TGT"
+
+echo
+echo "You can launch the new instance by running:"
+echo "    export CATALINA_HOME=$CATALINA_HOME"
+echo "    export CATALINA_BASE=$BASE_TGT"
+echo "    \$CATALINA_HOME/bin/catalina.sh run"
+
+echo
+echo "Attention: The ports in conf/server.xml might be bound by a "
+echo "    different instance. Please review your config files "
+echo "    and update them as necessary."
+echo

bin/setclasspath.sh

@@ -22,7 +22,7 @@
 # -----------------------------------------------------------------------------
 
 # Make sure prerequisite environment variables are set
-if [ -z "$JAVA_HOME" -a -z "$JRE_HOME" ]; then
+if [ -z "$JAVA_HOME" ] && [ -z "$JRE_HOME" ]; then
   if $darwin; then
     # Bugzilla 54390
     if [ -x '/usr/libexec/java_home' ] ; then
@@ -34,8 +34,8 @@ if [ -z "$JAVA_HOME" -a -z "$JRE_HOME" ]; then
   else
     JAVA_PATH=`which java 2>/dev/null`
     if [ "x$JAVA_PATH" != "x" ]; then
-      JAVA_PATH=`dirname $JAVA_PATH 2>/dev/null`
-      JRE_HOME=`dirname $JAVA_PATH 2>/dev/null`
+      JAVA_PATH=`dirname "$JAVA_PATH" 2>/dev/null`
+      JRE_HOME=`dirname "$JAVA_PATH" 2>/dev/null`
     fi
     if [ "x$JRE_HOME" = "x" ]; then
       # XXX: Should we try other locations?
@@ -44,13 +44,13 @@ if [ -z "$JAVA_HOME" -a -z "$JRE_HOME" ]; then
       fi
     fi
   fi
-  if [ -z "$JAVA_HOME" -a -z "$JRE_HOME" ]; then
+  if [ -z "$JAVA_HOME" ] && [ -z "$JRE_HOME" ]; then
     echo "Neither the JAVA_HOME nor the JRE_HOME environment variable is defined"
     echo "At least one of these environment variable is needed to run this program"
     exit 1
   fi
 fi
-if [ -z "$JAVA_HOME" -a "$1" = "debug" ]; then
+if [ -z "$JAVA_HOME" ] && [ "$1" = "debug" ]; then
   echo "JAVA_HOME should point to a JDK in order to run in debug mode."
   exit 1
 fi
@@ -61,14 +61,14 @@ fi
 # If we're running under jdb, we need a full jdk.
 if [ "$1" = "debug" ] ; then
   if [ "$os400" = "true" ]; then
-    if [ ! -x "$JAVA_HOME"/bin/java -o ! -x "$JAVA_HOME"/bin/javac ]; then
+    if [ ! -x "$JAVA_HOME"/bin/java ] || [ ! -x "$JAVA_HOME"/bin/javac ]; then
       echo "The JAVA_HOME environment variable is not defined correctly"
       echo "This environment variable is needed to run this program"
       echo "NB: JAVA_HOME should point to a JDK not a JRE"
       exit 1
     fi
   else
-    if [ ! -x "$JAVA_HOME"/bin/java -o ! -x "$JAVA_HOME"/bin/jdb -o ! -x "$JAVA_HOME"/bin/javac ]; then
+    if [ ! -x "$JAVA_HOME"/bin/java ] || [ ! -x "$JAVA_HOME"/bin/jdb ] || [ ! -x "$JAVA_HOME"/bin/javac ]; then
       echo "The JAVA_HOME environment variable is not defined correctly"
       echo "This environment variable is needed to run this program"
       echo "NB: JAVA_HOME should point to a JDK not a JRE"

build.properties.default

@@ -23,14 +23,15 @@
 # -----------------------------------------------------------------------------
 
 # ----- Version Control Flags -----
-version.major=8
-version.minor=5
-version.build=35
+version.major=9
+version.minor=0
+version.build=13
 version.patch=0
 version.suffix=
 
 # ----- Build control flags -----
 # Note enabling validation uses Checkstyle which is LGPL licensed
+ant.version.required=1.9.8
 execute.validate=false
 execute.test.nio=true
 execute.test.nio2=true
@@ -109,8 +110,8 @@ jaxrpc-lib.checksum.enabled=true
 jaxrpc-lib.checksum.algorithm=MD5|SHA-1
 jaxrpc-lib.checksum.value=4bebba22a4cdb9f68e16c45129770333|fe9371d33dc3e1646d4d13bde19614283eb998b1
 jaxrpc-lib.home=${base.path}/jaxrpc-${jaxrpc-lib.version}
-jaxrpc-lib.loc=${base-maven.loc}/geronimo-spec/geronimo-spec-jaxrpc/${jaxrpc-lib.version}/geronimo-spec-jaxrpc-${jaxrpc-lib.version}.jar
 jaxrpc-lib.jar=${jaxrpc-lib.home}/geronimo-spec-jaxrpc-${jaxrpc-lib.version}.jar
+jaxrpc-lib.loc=${base-maven.loc}/geronimo-spec/geronimo-spec-jaxrpc/${jaxrpc-lib.version}/geronimo-spec-jaxrpc-${jaxrpc-lib.version}.jar
 
 # ----- Webservices - WSDL4J -----
 wsdl4j-lib.version=1.6.3
@@ -118,21 +119,21 @@ wsdl4j-lib.checksum.enabled=true
 wsdl4j-lib.checksum.algorithm=MD5|SHA-1
 wsdl4j-lib.checksum.value=cfc28d89625c5e88589aec7a9aee0208|6d106a6845a3d3477a1560008479312888e94f2f
 wsdl4j-lib.home=${base.path}/wsdl4j-${wsdl4j-lib.version}
-wsdl4j-lib.loc=${base-maven.loc}/wsdl4j/wsdl4j/${wsdl4j-lib.version}/wsdl4j-${wsdl4j-lib.version}.jar
 wsdl4j-lib.jar=${wsdl4j-lib.home}/wsdl4j-${wsdl4j-lib.version}.jar
+wsdl4j-lib.loc=${base-maven.loc}/wsdl4j/wsdl4j/${wsdl4j-lib.version}/wsdl4j-${wsdl4j-lib.version}.jar
 
-# ----- Eclipse JDT, version 4.5.1 or later -----#
+# ----- Eclipse JDT, version 4.7 or later -----#
 # See https://wiki.apache.org/tomcat/JDTCoreBatchCompiler before updating
 #
-# Checksum is from "SHA512 Checksums for 4.6.3" link at
-# http://archive.eclipse.org/eclipse/downloads/drops4/R-4.6.3-201703010400/
-# http://archive.eclipse.org/eclipse/downloads/drops4/R-4.6.3-201703010400/checksum/eclipse-4.6.3-SUMSSHA512
+# Checksum is from "SHA512 Checksums for 4.7.3a" link at
+# http://download.eclipse.org/eclipse/downloads/drops4/R-4.7.3a-201803300640/
+# http://download.eclipse.org/eclipse/downloads/drops4/R-4.7.3a-201803300640/checksum/eclipse-4.7.3a-SUMSSHA512
 #
-jdt.version=4.6.3
-jdt.release=R-4.6.3-201703010400
+jdt.version=4.7.3a
+jdt.release=R-4.7.3a-201803300640
 jdt.checksum.enabled=true
 jdt.checksum.algorithm=SHA-512
-jdt.checksum.value=372da97d5f37095a3616c730170dc541b93acb8f50370cd9b0d81fba4583e865f0c933dc012155f26638306b82a402eaab209123cd0a979fa7c86313c0fca477
+jdt.checksum.value=7287b1ea3e18423d027a99ce40ae72e46e1700a65b474d2ec09af6a17b10653b7c2e69e9bb87efe14f4c593dc66b6370ea566fce90edb4b4190a903046817e6f
 jdt.home=${base.path}/ecj-${jdt.version}
 jdt.jar=${jdt.home}/ecj-${jdt.version}.jar
 # The download will be moved to the archive area eventually. We are taking care of that in advance.
@@ -250,8 +251,8 @@ checkstyle.checksum.enabled=true
 checkstyle.checksum.algorithm=MD5|SHA-1
 checkstyle.checksum.value=9180ab8b8219b262bfe88f26fd95d26d|11a02d7b0374f8a82fbd76361a69756faa6aefa0
 checkstyle.home=${base.path}/checkstyle-${checkstyle.version}
-checkstyle.loc=${base-sf.loc}/checkstyle/checkstyle/${checkstyle.version}/checkstyle-${checkstyle.version}-all.jar
 checkstyle.jar=${checkstyle.home}/checkstyle-${checkstyle.version}-all.jar
+checkstyle.loc=${base-sf.loc}/checkstyle/checkstyle/${checkstyle.version}/checkstyle-${checkstyle.version}-all.jar
 
 # ----- Cobertura code coverage tool -----
 cobertura.version=2.1.1
@@ -260,7 +261,6 @@ cobertura.checksum.algorithm=MD5|SHA-1
 cobertura.checksum.value=4f46638aa8e4d89565c038092398ea06|99cb44d36555feedcedc46263c23c2f5394ef342
 cobertura.home=${base.path}/cobertura-${cobertura.version}
 cobertura.jar=${cobertura.home}/cobertura-${cobertura.version}.jar
-cobertura.lib=${cobertura.home}/lib
 cobertura.loc=${base-sf.loc}/cobertura/cobertura-2.1.1-bin.tar.gz
 
 # ----- Findbugs -----
@@ -269,6 +269,37 @@ findbugs.checksum.enabled=true
 findbugs.checksum.algorithm=MD5|SHA-1
 findbugs.checksum.value=dec8828de8657910fcb258ce5383c168|59a24064ca6869e483ce9a04d3c50d14a227d5e6
 findbugs.home=${base.path}/findbugs-${findbugs.version}
-findbugs.lib=${findbugs.home}/lib
-findbugs.jar=${findbugs.lib}/findbugs-ant.jar
+findbugs.jar=${findbugs.home}/lib/findbugs-ant.jar
 findbugs.loc=${base-sf.loc}/project/findbugs/findbugs/${findbugs.version}/findbugs-${findbugs.version}.tar.gz
+
+# ----- SAAJ API, used by Code Signing for releases -----
+# ----- No longer part of JRE from Java 11 onwards  -----
+# ----- CDDL Licensed                               -----
+saaj-api.version=1.3.5
+saaj-api.checksum.enabled=true
+saaj-api.checksum.algorithm=MD5|SHA-1
+saaj-api.checksum.value=caae8b4bf2c551155815331e9e96256f|1c399a7fea4d0262a6a39750e419c24f0c769586
+saaj-api.home=${base.path}/saaj-api-${saaj-api.version}
+saaj-api.jar=${saaj-api.home}/saaj-api-${saaj-api.version}.jar
+saaj-api.loc=${base-maven.loc}/javax/xml/soap/saaj-api/${saaj-api.version}/saaj-api-${saaj-api.version}.jar
+
+# ----- bnd & bndlib, version 4.0.0 or later  -----
+# ----- provides OSGI metadata for JARs       -----
+bnd.version=4.0.0
+
+# checksums for biz.aQute.bnd-4.0.0.jar, biz.aQute.bndlib-4.0.0.jar
+bnd.checksum.enabled=true
+bnd.checksum.algorithm=MD5|SHA-1
+bnd.checksum.value=ddf578a4413ffa0eb6dc5b9476318fe2|fa7746eb710852498ce1afe5227be3fbfddaf09e
+
+bndlib.checksum.enabled=true
+bndlib.checksum.algorithm=MD5|SHA-1
+bndlib.checksum.value=7aa264bf3b6b32a11eea4a6cf43a9aaa|21e1d6fd1874d9bc201f2de1d0a48e84bff4149d
+
+bnd.home=${base.path}/bnd-${bnd.version}
+bnd.jar=${bnd.home}/biz.aQute.bnd-${bnd.version}.jar
+bnd.loc=${base-maven.loc}/biz/aQute/bnd/biz.aQute.bnd/${bnd.version}/biz.aQute.bnd-${bnd.version}.jar
+
+bndlib.home=${base.path}/bndlib-${bnd.version}
+bndlib.jar=${bndlib.home}/biz.aQute.bndlib-${bnd.version}.jar
+bndlib.loc=${base-maven.loc}/biz/aQute/bnd/biz.aQute.bndlib/${bnd.version}/biz.aQute.bndlib-${bnd.version}.jar

conf/catalina.policy

@@ -172,21 +172,9 @@ grant {
     permission java.lang.RuntimePermission
      "accessClassInPackage.org.apache.jasper.runtime.*";
 
-    // The cookie code needs these.
-    permission java.util.PropertyPermission
-     "org.apache.catalina.STRICT_SERVLET_COMPLIANCE", "read";
-    permission java.util.PropertyPermission
-     "org.apache.tomcat.util.http.ServerCookie.STRICT_NAMING", "read";
-    permission java.util.PropertyPermission
-     "org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR", "read";
-
     // Applications using WebSocket need to be able to access these packages
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.websocket";
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.websocket.server";
-
-    // Applications need to access these packages to use the Servlet 4.0 Preview
-    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.servlet4preview";
-    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.servlet4preview.http";
 };
 
 

conf/catalina.properties

@@ -209,10 +209,3 @@ tomcat.util.buf.StringCache.byte.enabled=true
 #tomcat.util.buf.StringCache.char.enabled=true
 #tomcat.util.buf.StringCache.trainThreshold=500000
 #tomcat.util.buf.StringCache.cacheSize=5000
-
-# This system property is deprecated. Use the relaxedPathChars relaxedQueryChars
-# attributes of the Connector instead. These attributes permit a wider range of
-# characters to be configured as valid.
-# Allow for changes to HTTP request validation
-# WARNING: Using this option may expose the server to CVE-2016-6816
-#tomcat.util.http.parser.HttpParser.requestTargetAllow=|

conf/context.xml

@@ -21,6 +21,7 @@
     <!-- Default set of monitored resources. If one of these changes, the    -->
     <!-- web application will be reloaded.                                   -->
     <WatchedResource>WEB-INF/web.xml</WatchedResource>
+    <WatchedResource>WEB-INF/tomcat-web.xml</WatchedResource>
     <WatchedResource>${catalina.base}/conf/web.xml</WatchedResource>
 
     <!-- Uncomment this to disable session persistence across Tomcat restarts -->