Strange side effect of "antiClickJackingOption" clause in "httpHeaderSecurity"

2020-03-23 Thread James H. H. Lampert
We recently enabled the httpHeaderSecurity filter globally (i.e., in conf/web.xml) on several customer Tomcat servers, thusly: httpHeaderSecurity org.apache.catalina.filters.

invoke jmxproxy servlet using argument with a , is not a possible

2020-03-23 Thread Arnaud Yahoo
Hello I am trying to invoke a mbean through jmxproxy servlet. Arguments are separated with , so when one argument itself is containing a coma, it breaks the invocation. It seems there is no way to escape ,. For example trying to save a context configuration fails : curl -u user:pass -G "htt

Re: Problem compiling jsps after switching to 8.5.51

2020-03-23 Thread Marek Neumann
I reproduced this with a very basic project and created https://bz.apache.org/bugzilla/show_bug.cgi?id=64259 for it. Marek > Am 17.03.2020 um 14:43 schrieb Marek Neumann : > > > >> Am 17.03.2020 um 12:21 schrieb Mark Thomas : >> >> On 17/03/2020 09:29, Marek Neumann wrote: >>> Hi Mark, >>>

Re: valve execution order

2020-03-23 Thread Jonathan Yom-Tov
What about valves which are added programmatically within the same engine? Is it possible to control the order? On Mon, Mar 23, 2020 at 4:14 PM Christopher Schultz < ch...@christopherschultz.net> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > Mark, > > On 3/23/20 09:59, Mark Th

RE: /manager/text/list fails in 9.0.31, works in 9.0.27

2020-03-23 Thread Vishal Agrawal
Hello, I confirm that my issue has been resolved in 9.0.33. I can call "curl -u 'tomcat:secret' http://127.0.0.1:8080/manager/text/list"; and see the list of applications running on it. Thanks, Vishal -Original Message- From: Vishal Agrawal Sent: Thursday, February 27, 2020 8:10 AM T

Re: valve execution order

2020-03-23 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 3/23/20 09:59, Mark Thomas wrote: > On 23/03/2020 13:13, Jonathan Yom-Tov wrote: >> I'm trying to create a valve which will prevent another valve >> from working in case a particular request is made. Is there a way >> to control the valve e

Re: AW: gostCat patch

2020-03-23 Thread Olaf Kock
On 23.03.20 15:07, Mark Thomas wrote: > On 23/03/2020 14:02, Fritze, Florian wrote: >> Maybe I am making it too easy but if you or another tomcat developer could >> prevent the newest Tomcat from throwing this exception: >> >> org.apache.catalina.core.StandardService.startInternal Failed to sta

Re: AW: gostCat patch

2020-03-23 Thread Mark Thomas
On 23/03/2020 14:02, Fritze, Florian wrote: > Maybe I am making it too easy but if you or another tomcat developer could > prevent the newest Tomcat from throwing this exception: > > org.apache.catalina.core.StandardService.startInternal Failed to start > connector [Connector[AJP/1.3-8011]] >

AW: gostCat patch

2020-03-23 Thread Fritze, Florian
Maybe I am making it too easy but if you or another tomcat developer could prevent the newest Tomcat from throwing this exception: org.apache.catalina.core.StandardService.startInternal Failed to start connector [Connector[AJP/1.3-8011]] org.apache.catalina.LifecycleException: Der Start

Re: valve execution order

2020-03-23 Thread Mark Thomas
On 23/03/2020 13:13, Jonathan Yom-Tov wrote: > I'm trying to create a valve which will prevent another valve from working > in case a particular request is made. Is there a way to control the valve > execution order so that I can inject my valve right before the valve I want > to stop? Valves shou

Re: Tomcat ant test failure

2020-03-23 Thread Mark Thomas
On 23/03/2020 12:43, Udupa, Ankitha K wrote: > Hi Mark, > > We have resolved similar errors like > "sun.security.validator.ValidatorException: PKIX path validation failed: > java.security.cert.CertPath > ValidatorException: timestamp check failed" > by downloading the certificates from latest tom

Re: gostCat patch

2020-03-23 Thread Mark Thomas
On 23/03/2020 11:34, André Warnier (tomcat/perl) wrote: > The *default* of this attribute is "false", when the "address" attribute > is explicitly set to "127.0.0.1" or "::1", or when it defaults to the > loopback address. > The *default* of this attribute is "true", when the "address" attribute

valve execution order

2020-03-23 Thread Jonathan Yom-Tov
I'm trying to create a valve which will prevent another valve from working in case a particular request is made. Is there a way to control the valve execution order so that I can inject my valve right before the valve I want to stop?

RE: Tomcat ant test failure

2020-03-23 Thread Udupa, Ankitha K
Hi Mark, We have resolved similar errors like "sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPath ValidatorException: timestamp check failed" by downloading the certificates from latest tomcat source code (https://github.com/apache/tomcat/tree/7.0

gostCat patch

2020-03-23 Thread tomcat/perl
Hello tomcat developers. Re : current : https://tomcat.apache.org/tomcat-8.5-doc/config/ajp.html#Standard_Implementations quote secretRequired If this attribute is true, the AJP Connector will only start if the secret attribute is configured with a non-null, non-zero length value. This att

Re: Tomcat ant test failure

2020-03-23 Thread Mark Thomas
On 23/03/2020 07:18, Udupa, Ankitha K wrote: > Hi, > > We are facing issue while triggering Ant Test with Tomcat 7.0.84 That version is over two years old and has a number of known security vulnerabilities that are likely to apply to a typical installation. The Tomcat community typically provide

Tomcat ant test failure

2020-03-23 Thread Udupa, Ankitha K
Hi, We are facing issue while triggering Ant Test with Tomcat 7.0.84 on HP UX IA/PA architecture with Java ( Java 7.0 in IA and Java 6.0 in PA). Please kindly help me to resolve these failures. TEST-org.apache.catalina.comet.TestCometProcessor.NIO.txt:ERROR:null TEST-org.apache.catalina.comet.T