Apache Tomcat 10 (10.0.0-M4)

Changelog

Tomcat 10.0.0-M4 (markt)

Catalina

Ensure all URL patterns provided via web.xml are %nn decoded consistently using the encoding of the web.xml file where specified and UTF-8 where no explicit encoding is specified. (markt)
Allow a comma separated list of class names for the org.apache.tomcat.util.digester.PROPERTY_SOURCE system property. (remm)
64149: Avoid NPE when using the access log valve without a pattern. (remm)
64226: Reset timezone after parsing a date since the date format is reused. Test case submitted by Gary Thomas. (remm)
64247: Using a wildcard for jarsToSkip should not override a possibly present jarsToScan. Based on code submitted by Iridias. (remm)
Refactor DefaultServlet to avoid using an internal Range structure that is duplicated from the parsing result. (remm)
Remove org.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH system property, replaced by the allowBackslash attribute on the Connector. (remm)
Remove org.apache.catalina.connector.Response.ENFORCE_ENCODING_IN_GET_WRITER system property, replaced by the enforceEncodingInGetWriter attribute on the Connector. (remm)
Remove org.apache.catalina.session.StandardSession.ACTIVITY_CHECK system property, replaced by the sessionActivityCheck attribute on the Manager. (remm)
Remove org.apache.catalina.session.StandardSession.LAST_ACCESS_AT_START system property, replaced by the sessionLastAccessAtStart attribute on the Manager. (remm)
Remove org.apache.catalina.core.StandardHostValve.ACCESS_SESSION system property, replaced by the alwaysAccessSession attribute on the Context. (remm)
Remove org.apache.catalina.core.ApplicationContext.GET_RESOURCE_REQUIRE_SLASH system property, replaced by the contextGetResourceRequiresSlash attribute on the Context. (remm)
Remove org.apache.catalina.core.ApplicationDispatcher.WRAP_SAME_OBJECT system property, replaced by the dispatcherWrapsSameObject attribute on the Context. (remm)
64265: Fix ETag comparison performed by the default servlet. The default servley always uses weak comparison. (markt)
Remove org.apache.catalina.authenticator.Constants.SSO_SESSION_COOKIE_NAME system property, replaced by the cookieName attribute on the SSO valve. (remm)
Add support for default values when using ${...} property replacement in configuration files. Based on a pull request provided by Bernd Bohmann. (markt)

Coyote

When closing a NIO channel, avoid canceling keys as a workaround for deadlocks when running on Java 11. Excessive internal NIO synchronization on channel close is resolved starting with this Java version. (remm)
When configuring an HTTP Connector, ensure that the encoding specified for URIEncoding is a superset of US-ASCII as required by RFC7230. (markt)
Avoid always retrieving the NIO poller selection key when processing to reduce sync. (remm)
64240: Ensure that HTTP/0.9 requests that contain additional data on the request line after the URI are treated consistently. Such requests will now always be treated as HTTP/1.1. (markt)
Expose the HTTP/2 connection ID and stream ID to applications via the request attributes org.apache.coyote.connectionID and org.apache.coyote.streamID respectively. (markt)
Replace the system property org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH with the Connector attribute encodedSolidusHandling that adds an additional option to pass the %2f sequence through to the application without decoding it in addition to rejecting such sequences and decoding such sequences. (markt)
Expose the associated HttpServletRequest to the CookieProcessor when generating a cookie header so the header can be tailored based on the properties of the request, such as the user agent, if required. Based on a patch by Lazar Kirchev. (markt)

Jasper

Update to the Eclipse JDT compiler 4.15. (markt)
Add support for specifying Java 14 (with the value 14) and Java 15 (with the value 15) as the compiler source and/or compiler target for JSP compilation. If used with an ECJ version that does not support these values, a warning will be logged and the latest supported version will used. (markt)
Remove Jasper configuration using system properties and replace them by a new set of JSP Servlet init parameters. (remm)

Web applications

Correct the documentation web application to remove references to the org.apache.catalina.STRICT_SERVLET_COMPLIANCE system property changing the default for the URIEncoding attribute of the Connector. (markt)
Correct the documentation web application to remove references to the org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH system property changing how the sequence %5c is interpretted in a URI. (markt)

Tribes

Remove support for the deprecated system property org.apache.catalina.tribes.dns_lookups. The default value of false will now always be used. (markt)

Other

Improve the quality and expand the coverage of the French translations provided with Apache Tomcat. Contribution provided by Tom Bens. (remm)
Expand the coverage of the Chinese translations provided with Apache Tomcat. Contribution provided by Lee Yazhou. (markt)
64270: Set the documented default umask of 0027 when using jsvc via daemon.sh and allow the umask used to be configured via the UMASK environment variable as it is when using catalina.sh. (markt)
Update the OWB module to Apache OpenWebBeans 2.0.16. (remm)
Update the CXF module to Apache CXF 3.3.6. (remm)
Remove the LOGGING_CONFIG environment variable and replace it with the CATALINA_LOGGING_CONFIG environment variable to avoid clashes with other components that use LOGGING_CONFIG. (markt)

2020-03-16 Tomcat 10.0.0-M3 (markt)

Coyote

64202: Use a loop on NIO blocking reads, as it is possible zero bytes are produced by a network read. (markt/remm)
64210: Correct a regression in the improvements to HTTP header validation that caused requests to be incorrectly treated as invalid if a CRLF sequence was split between TCP packets. Improve validation of request lines, including for HTTP/0.9 requests. (markt)

Other

64206: Correct a regression introduced in 10.0.0-M1 that meant that the HTTP port specified when using the Windows Installer was ignored and 8080 was always used. (markt)

not released Tomcat 10.0.0-M2 (markt)

Catalina

Refactor HttpServlet.doOptions() to improve performance. (markt)
Disable StandardManager session persistence by default. It can be enabled back in context.xml. (remm)
Add extension point to DeltaSession to improve subclassing. Patch provided by ThStock. (schultz)
64153: Ensure that the parent for the web application class loader is set consistently. (markt)
64166: Ensure that the names returned by HttpServletResponse.getHeaderNames() are unique. (markt)
Rename org.apache.tomcat.util.digester.Digester$EnvironmentPropertySource to org.apache.tomcat.util.digester.EnvironmentPropertySource. Patch provided by Bernd Bohmann. (markt)
63286: Resolve inconsistencies with access log valve. This changes the element API to use a nanosecond resolution elapsed time argument. (remm)
Add new attribute persistAuthentication to both StandardManager and PersistentManager to support authentication persistence. Patch provided by Carsten Klein. (markt)
64184: Avoid repeated log messages if a MemoryUserDatabase is configured but the specified configuration file is missing. (markt)
64189: Expose the web application version String as a ServletContext attribute named org.apache.catalina.webappVersion. (markt)

Coyote

Fix support of native jakarta servlet attributes in AJP connector. (remm)
56966: Add use of System.nanoTime to track request execution time. (remm)
64141: If using a CA certificate, remove a default value for the truststore file when not using a JSSE configuration. (remm)
Improve robustness of OpenSSLEngine shutdown. Based on code submitted by Manuel Dominguez Sarmiento. (remm)
Add the TLS request attributes used by IIS to the attributes that an AJP Connector will always accept. (markt)
A zero length AJP secret will now behave as if it has not been specified. (remm)
64188: If an error occurs while committing or flushing the response when using a multiplexing protocol like HTTP/2 that requires the channel to be closed but not the connection, just close the channel and allow the other channels using the connection to continue. Based on a suggestion from Alejandro Anadon. (markt)
Correct the semantics of getEnableSessionCreation and setEnableSessionCreation for OpenSSLEngine. Pull request provided by Alexander Scheel. (markt)
64192: Correctly handle case where unread data is returned to the read buffer when the read buffer is non empty. Ensure a gathering TLS read stops once the provided ByteBuffers are full or no more data is available. (markt)
Allow async requests to complete cleanly when the Connector is paused before complete() is called on a container thread. (markt)

Cluster

Allow configuring the DNSMembershipProvider using the dns alias. Submitted by Bernd Bohmann. (remm)

Web applications

Expand the documentation for the address attribute of the AJP Connector and document that the AJP Connector also supports the ipv6v6only attribute with the APR/Native implementation. (markt)

Other

Update the OWB module to Apache OpenWebBeans 2.0.15. (remm)
Update the CXF module to Apache CXF 3.3.5. (remm)
Expand the coverage of the Korean translations provided with Apache Tomcat. Contributions provided by B. Cansmile Cha. (markt)
Expand the coverage of the French translations provided with Apache Tomcat. (remm)
64190: Add support for specifying milliseconds (using S, SS or SSS) in the timestamp used by JULI's OneLineFormatter. (markt)

2020-02-20 Tomcat 10.0.0-M1 (markt)

General

This release contains all of the changes upto and including those in Apache Tomcat 9.0.31 plus the additional changes listed below. (markt)

Catalina

Refactor recycle facade system property into a new connector attribute named discardFacades and enable it by default. (remm)
Update to Jakarta Servlet 5.0, Jakarta Server Pages 3.0. Jakarta Expression Language 4.0, Jakarta WebSocket 2.0, Jakarta Authentication 2.0 and Jakarta Annotations 2.0. (markt)
Remove GenericPrincipal.getPassword. The credentials should remain managed by the realm. (remm)
Add connection pooling to JNDI realm. (remm)
Use <request-character-encoding> and <response-character-encoding> in conf/web.xml to set the default request and response character encodings to UTF-8. (markt)
Store config compatibility with HostWebXmlCacheCleaner listener. (remm)
Modify the RewriteValve to use ServletRequest.getServerName() to populate the HTTP_HOST variable rather than extracting it from the Host header as this allows HTTP/2 to be supported. (markt)
Switch Tomcat embedded to loading MIME type mappings from a property file generated from the default web.xml so the MIME type mappings are consistent regardless of how Tomcat is started. (markt)
Missing store config attributes for Resources elements. (remm)

Coyote

Update endpoint cache sizes defaults. (remm)
Remove unused NIO blocking selector. (remm)
When using an AJP Connector, convert Java Servlet specific request attributes to the Jakarta Servlet equivalent. (markt)
When reporting / logging invalid HTTP headers encode any non-printing characters using the 0xNN form. (markt)
Remove duplication of HTTP/1.1 configuration on the HTTP/2 UpgradeProtocol element. Configuration from the main Connector element will now be used. (remm)
When the NIO or APR/native connectors were configured with useAsyncIO="true" and a zero length read or write was performed, the read/write would time out rather than return immediately. (markt)

Jasper

Parameterize JSP version and API class names in localization messages to allow simpler re-use between major versions. (markt)
Ensure that TLD files listed in the jsp-config section of web.xml that are registered in the uriTldResourcePathMap with the URI specified in web.xml are also registered with the URI in the TLD file if it is different. Patch provided by Markus Lottmann. (markt)

Cluster

Fix cloud environment lookup order and add a dedicated DNS_MEMBERSHIP_SERVICE_NAME environment for use with the DNS membership provider. Submitted by Bernd Bohmann. (remm)

Other

53620: JULI now only creates logging files when there is a log entry to write. Based on a patch by Karol Bucek. (markt)
Update implemented specification version information in a few places where it has not been updated for Jakarta EE 9. (markt)
Expand the coverage of the French translations provided with Apache Tomcat. (remm)
Expand the coverage of the Chinese translations provided with Apache Tomcat. Contribution provided by BoltzmannWxd. (markt)