On Mon, 8 Apr 2002, Larry Isaacs wrote: > It's not so much having one "util" jar, but understanding the differences > between jakarta-tomcat-connectors' tomcat-util.jar and connectors_util.jar. > If they are the same, then I would prefer to use a single name.
They are certainly not the same ( or they weren't in 3.3.0/3.3.1 ). "Tomcat utils" are a collection of (more or less independent) tools. In tomcat3.3 we put some of them in the common loader ( the minimal set required to get things running ), and the rest in the container loader. The 'minimal' set consist of core_util.jar and connectors_util.jar. tomcat_util.jar ( in container ) has all of the tools. I think it would be a mistake to name the jar in common with the same name, since they have different content. If we put all the utils in common ( which wouldn't be bad - the reasons for keeping the 'minimal set' only are not very strong ) - then we can name it tomcat_util.jar, and remove the one in container. If we do that, we need to fix few bugs - XmlMapper will not work because crimson is in container/, and we don't set the thread class loader to container/ when starting up. The main reason for doing the minimal set was a bit of security paranoia, the utils are used by the core and we must be sure they don't expose anything ( static fields/methods, priviledged actions, etc ). For example the compat util used to have a bug allowing untrusted code to run trusted apps ( it had a doPriviledged without checking the source ). I'm 99% sure we're ok. Other reasons - like allowing apps to load different versions of utils - are not that important. Somehow important is to make sure all utils are webapp-friendly ( ie. use thread class loader - like commons-logging for example ) Costin > Cheers, > Larry > > > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] > Sent: Mon 4/8/2002 6:37 PM > To: Tomcat Developers List > Cc: > Subject: RE: cvs commit: jakarta-tomcat build.xml > > > > On Mon, 8 Apr 2002, Larry Isaacs wrote: > > > Hi Costin, > > > > I'm curious as to the reason to have connectors_util.jar instead > > of just using the tomcat-utils.jar built by j-t-c/util? > > We have 2 'sets' of utils - one in j-t-c/util, one in j-t. > We also have 2 lib dirs - lib/common and lib/container. > > The way we used to split the utils - we put minimal stuff in common, > and that was core_utils and connector_utils. That's how 3.3.0/3.3.1 > are doing it. > > I'm +1 to change to a single tomcat-util.jar in common, but > that requires few fixes in xml-mapper ( actually in startup, to > make xml-mapper find the thread loader pointing to container ). > It also requires another review of the utils/ from security > point of view - whatever is in common must be safe, since > it'll be exposed to untrusted apps. > > Costin > > > >
msg24683/bin00000.bin
Description: application/ms-tnef
-- To unsubscribe, e-mail: <mailto:[EMAIL PROTECTED]> For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>
-- To unsubscribe, e-mail: <mailto:[EMAIL PROTECTED]> For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>
