Log message:
Update to 8.0.44

Changelog:
Tomcat 8.0.44 (violetagg)
General

    Add: Allow to exclude JUnit test classes using the build property \ 
test.exclude and document the property in BUILDING.txt. (rjung)

Catalina

    Fix: 60940: Improve the handling of the META-INF/ and META-INF/MANIFEST.MF \ 
entries for Jar files located in /WEB-INF/lib when running a web application \ 
from a packed WAR file. (markt)
    Fix: Pre-load the ExceptionUtils class. Since the class is used extensively \ 
in error handling, it is prudent to pre-load it to avoid any failure to load \ 
this class masking the true problem during error handling. (markt)
    Fix: Review those places where Tomcat re-encodes a URI or URI component and \ 
ensure that that correct encoding (path differs from query string) is applied \ 
and that the encoding is applied consistently. (markt)
    Fix: Use a more reliable mechanism for the DefaultServlet when determining \ 
if the current request is for custom error page or not. (markt)
    Fix: Ensure that when the Default or WebDAV servlets process an error \ 
dispatch that the error resource is processed via the doGet() method \ 
irrespective of the method used for the original request that triggered the \ 
error. (markt)
    Fix: If a static custom error page is specified that does not exist or \ 
cannot be read, ensure that the intended error status is returned rather than a \ 
404 or 403. (markt)
    Fix: When the WebDAV servlet is configured and an error dispatch is made to \ 
a custom error page located below WEB-INF, ensure that the target error page is \ 
displayed rather than a 404 response. (markt)
    Add: 61047: Add MIME mapping for woff2 fonts in the default web.xml. Patch \ 
provided by Justin Williamson. (violetagg)
    Fix: Correct the logic that selects the encoding to use to decode the query \ 
string in the SSIServletExternalResolver so that the useBodyEncodingForURI \ 
attribute of the Connector is correctly taken into account. (markt)
    Fix: 61072: Respect the documentation statements that allow using the \ 
platform default secure random for session id generation. (remm)
    Fix: Correct the javadoc for \ 
o.a.c.connector.CoyoteAdapter#parseSessionCookiesId. Patch provided by John \ 
Andrew (XUZHOUWANG) via Github. (violetagg)

Jasper

    Fix: 60925: Improve the handling of access to properties defined by \ 
interfaces when a BeanELResolver is used under a SecurityManager. (markt)
    Update: 61057: Update to Eclipse JDT Compiler 4.6.3. (violetagg)
    Fix: 61065: Ensure that once the class is resolved by \ 
javax.el.ImportHandler#resolveClass it will be cached with the proper name. \ 
(violetagg)

WebSocket

    Fix: 61003: Ensure the flags for reading/writing in \ 
o.a.t.websocket.AsyncChannelWrapperSecure are correctly reset even if some \ 
exceptions occurred during processing. (markt/violetagg)

Web applications

    Add: Document test.threads option in BUILDING.txt. (kkolinko, rjung)
    Add: Add documents for maxIdleTime attribute to Channel Receiver docs. (kfujino)

jdbc-pool

    Code: Refactor the creating a constructor for a proxy class to reduce \ 
duplicate code. (kfujino)
    Fix: In StatementFacade, the method call on the statements that have been \ 
closed throw SQLException rather than NullPointerException. (kfujino)

Other

    Fix: Correct comments about Java 8 in Jre8Compat. Patch provided by fibbers \ 
via Github. (violetagg)
    Fix: 60932: Correctly escape single quotes when used in i18n messages. Based \ 
on a patch by Michael Osipov. (markt)
    Fix: Update the custom Ant task that integrates with the Symantec code \ 
signing service to use the now mandatory 2-factor authentication. (markt)

Log message:
apache-tomcat8 is for 8.0.x

Log message:
Update to 8.0.43

Changelog:
Tomcat 8.0.43 (violetagg)
Catalina

    Add: 54618: Add support to the HttpHeaderSecurityFilter for the HSTS preload \ 
parameter. (markt)
    Fix: 60876: Ensure that Set-Cookie headers generated by the \ 
Rfc6265CookieProcessor are aligned with the specification. Patch provided by Jim \ 
Griswold. (markt)
    Fix: 60911: Ensure NPE will not be thrown when looking for SSL session ID. \ 
Based on a patch by Didier Gutacker. (violetagg)

Coyote

    Fix: When using the NIO2 connector, ensure a WebSocket close frame is \ 
processed before the end of stream is processed to ensure that the end of stream \ 
is processed correctly. (markt)
    Fix: 60852: Correctly spell compressible when used in configuration \ 
attributes and internal code. Based on a patch by Michael Osipov. (markt)
    Fix: Improve sendfile handling when requests are pipelined. (markt)

Jasper

    Fix: Improve the error handling for simple tags to ensure that the tag is \ 
released and destroyed once used. (remm, violetagg)
    Fix: 60844: Correctly handle the error when fewer parameter values than \ 
required by the method are used to invoke an EL method expression. Patch \ 
provided by Daniel Gray. (markt)

jdbc-pool

    Fix: 60764: Implement equals() and hashCode() in the StatementFacade in \ 
order to enable these methods to be called on the closed statements if any \ 
statement proxy is set. This behavior can be changed with useStatementFacade \ 
attribute. (kfujino)

Other

    Fix: Refactor the build script and the NSIS installer script so that either \ 
NSIS 2.x or NSIS 3.x can be used to build the installer. This is primarily to \ 
re-enable building the installer on the Linux based CI system where the \ 
combination of NSIS 3.x and wine leads to failed installer builds. (markt)

2017-03-14 Tomcat 8.0.42 (markt)
Catalina

    Update: 60596: Improve performance of DefaultServlet when sendfile feature \ 
is disabled on connector. (kkolinko)
    Fix: Reduce the contention in the default InstanceManager implementation \ 
when multiple threads are managing objects and need to reference the annotation \ 
cache. (markt)
    Add: Extend the JreMemoryLeakPreventionListener to provide protection \ 
against ForkJoinPool.commonPool() related memory leaks. (markt)
    Code: 60674: Remove final marker from CorsFilter to enable sub-classing. (markt)
    Fix: 60683: Security manager failure causing NPEs when doing IO on some \ 
JVMs. (csutherl)
    Fix: 60688: Update the internal fork of Apache Commons BCEL to r1782855 to \ 
add early access Java 9 support to the annotation scanning code. (markt)
    Fix: When HTTP TRACE requests are disabled on the Connector, ensure that the \ 
HTTP OPTIONS response from the WebDAV servlet does not include TRACE in the \ 
returned Allow header. (markt)
    Fix: 60718: Improve error handling for asynchronous processing and correct a \ 
number of cases where the requestDestroyed() event was not being fired and an \ 
entry wasn't being made in the access logs. (markt)
    Fix: 60722: Take account of the dispatchersUseEncodedPaths setting on the \ 
current Context when generating paths for dispatches triggered by \ 
AsyncContext.dispatch(). (markt)
    Fix: 60728: Make the separator Tomcat uses in the Tomcat specific \ 
war:file:... URL protocol customizable via a system property. The separator is \ 
equivalent to the use of the ! character in jar:file:... URLs. The default \ 
separator of * remains unchanged. (markt)
    Fix: 60798: Correct a bug in the handling of JARs in unpacked WARs that \ 
meant multiple attempts to read the same entry from a JAR in succession would \ 
fail for the second and subsequent attempts. (markt)
    Fix: 60808: Ensure that the Map returned by ServletRequest.getParameterMap() \ 
is fully immutable. Based on a patch provided by woosan. (markt)
    Fix: 60824: Correctly cache the Subject in the session - if there is a \ 
session - when running under a SecurityManager. Patch provided by Jan \ 
Engehausen. (markt)
    Fix: Ensure request and response facades are used when firing application \ 
listeners. (markt/remm)

Coyote

    Fix: Ensure that executor thread pools used with connectors pre-start the \ 
configured minimum number of idle threads. (markt)
    Add: 60594: Allow some invalid characters that were recently restricted to \ 
be processed in requests by using the system property \ 
tomcat.util.http.parser.HttpParser.requestTargetAllow. (csutherl)
    Fix: Modify the cookie header generated by the Rfc6265CookieProcessor so it \ 
always sends an Expires attribute as well as a Max-Age attribute to avoid \ 
problems with Microsoft browsers that do not support the Max-Age attribute. \ 
(markt)

Jasper

    Fix: Follow up to the fix for 58178. When creating the ELContext for a tag \ 
file, ensure that any registered ELContextListeners are fired. (markt)
    Fix: Refactor code generated for JSPs to reduce the size of the code \ 
required for tags. (markt)
    Update: Update to the Eclipse JDT Compiler 4.6.1. (markt)

Cluster

    Add: Make the accessTimeout configurable in ClusterSingleSignOn. The \ 
accessTimeout is used as a timeout period for PING in replication map. (kfujino)
    Fix: 60806: To avoid ClassNotFoundException, make sure that the web \ 
application class loader is passed to ReplicatedContext. (kfujino)

WebSocket

    Fix: 60617: Correctly create a CONNECT request when establishing a WebSocket \ 
connection via a proxy. Patch provided by Svetlin Zarev. (markt)

Tribes

    Fix: Ensure that NoRpcChannelReply messages are not received on RpcCallback. \ 
(kfujino)

Other

    Update: Update the packaged version of the Tomcat Native Library to 1.2.12 \ 
to pick up the latest Windows binaries built with OpenSSL 1.0.2k. (violetagg)
    Add: 60784: Update all unit tests that test the HTTP status line to check \ 
for the required space after the status code. Patch provided by Michael Osipov. \ 
(markt)
    Update: Update the NSIS Installer used to build the Windows installer to \ 
version 3.01. (markt)

Log message:
Fix PLIST:

$ tar tzvf /usr/pkgsrc/distfiles/apache-tomcat-8.0.41.tar.gz | egrep 'ROOT.*asf-logo'
-rw-r--r--  1 root     wheel      26447 Jan 18 22:25 \ 
apache-tomcat-8.0.41/webapps/ROOT/asf-logo-wide.svg

Log message:
Update to Tomcat 8.0.41. Upstream changelog:

Tomcat 8.0.41 (violetagg)
Cluster

    Add: Make the accessTimeout configurable in BackupManager. The accessTimeout \ 
is used as a timeout period for PING in replication map. (kfujino)

Web applications

    Fix: Ensure the ASF logo image is displayed in host-manager. (violetagg)

not released Tomcat 8.0.40 (violetagg)
Catalina

    Add: 53602: Add HTTP status code 451 (RFC 7725) to the list of HTTP status \ 
codes recognised by Tomcat. (markt)
    Fix: 60446: Handle the case where the stored user credential uses a \ 
different key length than the length currently configured for the \ 
CredentialHandler. Based on a patch by Niklas Holm. (markt)
    Fix: 60351: Delay creating META-INF/war-tracker file until after the WAR has \ 
been expanded to address the case where the Tomcat process terminates during the \ 
expansion. (markt)
    Fix: Correctly handle the configClass attribute of a Host when embedding \ 
Tomcat. (markt)
    Fix: 60379: Dispose of the GSS credential once it is no longer required. \ 
Patch provided by Michael Osipov. (markt)
    Fix: 60380: Ensure that a call to HttpServletRequest#logout() triggers a \ 
call to TomcatPrincipal#logout(). Based on a patch by Michael Osipov. (markt)
    Fix: 60387: Correct the javadoc for \ 
o.a.catalina.AccessLog.setRequestAttributesEnabled. The default value is \ 
different for the different implementations. (violetagg)
    Code: 60393: Use consistent parameter naming in implementations of \ 
Realm#authenticate(GSSContext, boolean). (markt)
    Fix: 60395: Log when an Authenticator passes an incomplete GSSContext to a \ 
Realm since it indicates a bug in the Authenticator. Patch provided by Michael \ 
Osipov. (markt)
    Fix: Correctly generate URLs for resources located inside JARs that are \ 
themselves located inside a packed WAR file. (markt)
    Fix: 60410: Ensure that multiple calls to JarInputStreamWrapper#close() do \ 
not incorrectly trigger the closure of the underlying JAR or WAR file. (markt)
    Fix: 60411: Implement support in the RewriteValve for symbolic names to \ 
specify the redirect code to use when returning a redirect response to the user \ 
agent. Patch provided by Michael Osipov. (markt)
    Fix: 60413: In the RewriteValve write empty capture groups as the empty \ 
string rather than as "null" when generating the re-written URL. Based \ 
on a patch by Michael Osipov. (markt)
    Update: Update the warnings that reference required options for running on \ 
Java 9 to use the latest syntax for those options. (markt)
    Fix: 60513: Fix thread safety issue with RMI cleanup code. (remm)

Coyote

    Fix: Ensure that the endpoint is able to unlock the acceptor thread during \ 
shutdown if the endpoint is configured to listen to any local address of a \ 
specific type such as 0.0.0.0 or ::. (markt)
    Fix: Prevent read time out when the file is deleted while serving the \ 
response. The issue was observed only with APR Connector and sendfile enabled. \ 
(violetagg)
    Fix: Improve the logic that selects an address to use to unlock the Acceptor \ 
to take account of platforms what do not listen on all local addresses when \ 
configured with an address of 0.0.0.0 or ::. (markt)
    Fix: 60409: When unable to complete sendfile request, ensure the Processor \ 
will be added to the cache only once. (markt/violetagg)

Jasper

    Fix: 60431: Improve handling of varargs in UEL expressions. Based on a patch \ 
by Ben Wolfe. (markt)
    Fix: 60497: Restore previous tag reuse behavior following the use of \ 
try/finally. (remm)
    Fix: Improve the error handling for simple tags to ensure that the tag is \ 
released and destroyed once used. (remm)
    Fix: 60497: Follow up fix using a better variable name for the tag reuse \ 
flag. (remm)
    Fix: Revert use of try/finally for simple tags. (remm)

Web applications

    Fix: Correct a typo in Host Configuration Reference. Issue reported via \ 
comments.apache.org. (violetagg)
    Fix: 60344: Add a note to BUILDING.txt regarding using the source bundle \ 
with the correct line endings. (markt)
    Fix: 60412: Add information on the comment syntax for the RewriteValve \ 
configuration. (markt)
    Fix: 60467: remove problematic characters from XML documentation. Based upon \ 
a patch by Michael Osipov. (schultz)
    Add: In the documentation web application, be explicit that clustering \ 
requires a secure network for all of the cluster network traffic. (markt)
    Update: Update the ASF logos to the new versions.
    Fix: 60468: Correct the format of the sample ISO-8601 date used to report \ 
the build date for the documentation. Patch provided by Michael Osipov. (markt)

Tribes

    Fix: Reduce the warning logs for a message received from a different domain \ 
in order to avoid excessive log outputs. (kfujino)
    Add: Add log message that PING message has received beyond the timeout \ 
period. (kfujino)
    Fix: When a PING message that beyond the time-out period has been received, \ 
make sure that valid member is added to the map membership. (kfujino)

WebSocket

    Fix: 60437: Avoid possible handshake overflows in the websocket client. (remm)

jdbc-pool

    Add: 58816: Implement the statistics of jdbc-pool. The stats infos are \ 
borrowedCount, returnedCount, createdCount, releasedCount, reconnectedCount, \ 
releasedIdleCount and removeAbandonedCount. (kfujino)
    Fix: 60194: If validationQuery is not specified, connection validation is \ 
done by calling the isValid() method. (kfujino)
    Fix: 60398: Fix testcase of TestSlowQueryReport. (kfujino)
    Add: Enable reset the statistics without restarting the pool. (kfujino)

Other

    Fix: 60366: Change catalina.bat to use directly LOGGING_MANAGER and \ 
LOGGING_CONFIG variables in order to configure logging, instead of modifying \ 
JAVA_OPTS. Patch provided by Petter Isberg. (violetagg)
    Add: New property is added test.verbose in order to control whether the \ 
output of the tests is displayed on the console or not. Patch provided by \ 
Emmanuel Bourg. (violetagg)
    Update: Update the ASF logos used in the Apache Tomcat installer for Windows \ 
to use the new versions.
    Fix: Spelling corrections provided by Josh Soref. (violetagg)

Log message:
update to current tomcat 8.0 train version, fixing CVE-2016-5388.

Changelog:

Tomcat 8.0.39 (violetagg)
Catalina

    Fix: When creating a new Connector via JMX, ensure that both HTTP/1.1 and \ 
AJP/1.3 connectors can be created. (markt)
    Fix: Include the Context name in the log message when an item cannot be \ 
added to the cache. (markt)
    Fix: Exclude JAR files in /WEB-INF/lib from the static resource cache. (markt)
    Fix: When calling getResourceAsStream() on a directory, ensure that null is \ 
returned. (markt)
    Fix: 60161: Allow creating subcategories of the container logger, and use it \ 
for the rewrite valve. (remm)
    Fix: Correctly test for control characters when reading the provided \ 
shutdown password. (markt)
    Fix: When configuring the JMX remote listener, specify the allowed types for \ 
the credentials. (markt)

Coyote

    Fix: Correct the HTTP header parser so that DEL is not treated as a valid \ 
token character. (markt)
    Fix: 60319: When using an Executor, disconnect it from the Connector \ 
attributes maxThreads, minSpareThreads and threadPriority to enable the \ 
configuration settings to be consistently reported. These Connector attributes \ 
will be reported as -1 when an Executor is in use. The values used by the \ 
executor may be set and obtained via the Executor. (markt)
    Fix: If an I/O error occurs during async processing on a non-container \ 
thread, ensure that the onError() event is triggered. (markt)
    Fix: Improve detection of I/O errors during async processing on \ 
non-container threads and trigger async error handling when they are detected. \ 
(markt)
    Add: Add additional checks for valid characters to the HTTP request line \ 
parsing so invalid request lines are rejected sooner. (markt)

Web applications

    Fix: Correct a typo in HTTP Connector How-To. Issue reported via \ 
comments.apache.org. (violetagg)
    Fix: Fix default value of validationInterval attribute in jdbc-pool. (kfujino)
    Fix: Correct a typo in CGI How-To. Issue reported via comments.apache.org. \ 
(violetagg)

Tribes

    Fix: When the proxy node sends a backup retrieve message, ensure that using \ 
the channelSendOptions that has been set rather than the default \ 
channelSendOptions. (kfujino)

Other

    Update: Update the ECJ compiler to version 4.5.1. (markt)
    Fix: Remove classes from tomcat-util-scan.jar that are duplicates of those \ 
in tomcat-util.jar. (markt)

2016-10-10 Tomcat 8.0.38 (markt)
Catalina

    Add: 59961: Add an option to the StandardJarScanner to control whether or \ 
not JAR Manifests are scanned for additional class path entries. (markt)
    Fix: 60013: Refactor the previous fix to align the behaviour of the Rewrite \ 
Valve with mod_rewrite. As part of this, provide an implementation for the B and \ 
NE flags and improve the handling for the QSA flag. Includes multiple test cases \ 
by Santhana Preethiand a patch by Tiago Oliveira. (markt)
    Fix: 60087: Refactor the web resources handling to use the Tomcat specific \ 
war:file:... URL protocol to refer to WAR files and their contents rather than \ 
the standard jar:file:... form since some components of the JRE, such as JAR \ 
verification, give unexpected results when the standard form is used. A \ 
side-effect of the refactoring is that when using packed WARs, it is now \ 
possible to reference a WAR and/or specific JARs within a WAR in the security \ 
policy file used when running under a SecurityManager. (markt)
    Fix: 60116: Fix a problem with the rewrite valve that caused back references \ 
evaluated in conditions to be forced to lower case when using the NC flag. \ 
(markt)
    Fix: Ensure Digester.useContextClassLoader is considered in case the class \ 
loader is used. (violetagg)
    Fix: 60117: Ensure that the name of LogLevel is localized when using \ 
OneLineFormatter. Patch provided by Tatsuya Bessho. (kfujino)
    Fix: 60146: Improve performance for resource retrieval by making calls to \ 
WebResource.getInputStream() trigger caching if the resource is small enough. \ 
Patch provided by mohitchugh. (markt)
    Add: 60151: Improve the exception error messages when a ResourceLink fails \ 
to specify the type, specifies an unknown type or specifies the wrong type. \ 
(markt)
    Fix: 60167: Ignore empty lines in /etc/passwd files when using the \ 
PasswdUserDatabase. (markt)
    Fix: 60170: Exclude the compressed test file index.html.br from RAT \ 
analysis. Patch provided by Gavin McDonald. (markt)
    Fix: When starting web resources, ensure that class resources are only \ 
started once. (markt)
    Fix: Improve the access checks for linked global resources to handle the \ 
case where the current class loader is a child of the web application class \ 
loader. (markt)
    Fix: 60199: Log a warning if deserialization issues prevent a session \ 
attribute from being loaded. (markt)

Coyote

    Fix: Correctly handle a call to AsyncContext.complete() from a non-container \ 
thread when non-blocking I/O is being used. (markt)
    Add: Refactor the code that implements the requirement that a call to \ 
complete() or dispatch() made from a non-container thread before the container \ 
initiated thread that called startAsync() completes must be delayed until the \ 
container initiated thread has completed. Rather than implementing this by \ 
blocking the non-container thread, extend the internal state machine to track \ 
this. This removes the possibility that blocking the non-container thread could \ 
trigger a deadlock. (markt)
    Fix: 60123: Avoid potential threading issues that could cause excessively \ 
large vales to be returned for the processing time of a current request. (markt)
    Fix: 60174: Log instances of HeadersTooLargeException during request \ 
processing. (markt)

Jasper

    Fix: 60101: Remove preloading of the class that was deleted. (violetagg)

Web applications

    Add: Expand the documentation for the nested elements within a Resources \ 
element to clarify the behaviour of different configuration options with respect \ 
to the order in which resources are searched. (markt)
    Add: Add an example of using the classesToInitialize attribute of the \ 
JreMemoryLeakPreventionListener to the documentation web application. Based on a \ 
patch by Cris Berneburg. (markt)
    Fix: 60192: Correct a typo in the status output of the Manager application. \ 
Patch provided by Radhakrishna Pemmasani. (markt)

jdbc-pool

    Fix: Notify jmx when returning the connection that has been marked suspect. \ 
(kfujino)
    Fix: Ensure that the POOL_EMPTY notification has been added to the jmx \ 
notification types. (kfujino)
    Fix: 60099: Ensure that use all method arguments as a cache key when using \ 
StatementCache. (kfujino)
    Fix: 60139: Correct Javadocs for PoolConfiguration.getValidationInterval and \ 
setValidationInterval. Reported by Phillip Webb. (kfujino)

Other

    Fix: Update the download location for Objenesis. (violetagg)
    Fix: 60164: Replace log4j-core*.jar with log4j-web*.jar since it is \ 
log4j-web*.jar that contains the ServletContainerInitializer. (markt)
    Add: Add documentation to the bin/catalina.bat script to remind users that \ 
environment variables don't affect the configuration of Tomcat when run as a \ 
Windows Service. Based upon a documentation patch by James H.H. Lampert. \ 
(schultz)
    Update: Update the packaged version of the Tomcat Native Library to 1.2.10 \ 
to pick up the latest Windows binaries built with OpenSSL 1.0.2j. (markt)

2016-09-05 Tomcat 8.0.37 (markt)
Catalina

    Fix: 57705: Add debug logging for requests denied by the remote host and \ 
remote address valves and filters. Based on a patch by Graham Leggett. (markt)
    Add: 59399: Add a new option to the Realm implementations that ship with \ 
Tomcat that allows the HTTP status code used for HTTP -> HTTPS redirects to \ 
be controlled per Realm. (markt)
    Update: Change the default of the sessionCookiePathUsesTrailingSlash \ 
attribute of the Context element to false since the problems caused when a \ 
Servlet is mapped to /* are more significant than the security risk of not \ 
enabling this option by default. (markt)
    Fix: Do not attempt to start web resources during a web application's \ 
initialisation phase since the web application is not fully configured at that \ 
point and the web resources may not be correctly configured. (markt)
    Fix: 59708: Modify the LockOutRealm logic. Valid authentication attempts \ 
during the lock out period will no longer reset the lock out timer to zero. \ 
(markt)
    Fix: Improve error handling around user code prior to calling \ 
InstanceManager.destroy() to ensure that the method is executed. (markt)
    Fix: 59813: Ensure that circular relations of the Class-Path attribute from \ 
JAR manifests will be processed correctly. (violetagg)
    Fix: Ensure that reading the singleThreadModel attribute of a \ 
StandardWrapper via JMX does not trigger initialisation of the associated \ 
servlet. With some frameworks this can trigger an unexpected initialisation \ 
thread and if initilisation is not thread-safe the initialisation can then fail. \ 
(markt)
    Fix: Compatibility with rewrite from httpd for non existing headers. (jfclere)
    Fix: By default, treat paths used to obtain a request dispatcher as encoded. \ 
This behaviour can be changed per web application via the \ 
dispatchersUseEncodedPaths attribute of the Context. (markt)
    Fix: 59839: Apply roleSearchAsUser to all nested searches in JNDIRealm. \ 
(fschumacher)
    Fix: 59859: Fix resource leak in WebDAV servlet. Based on patch by Coty \ 
Sutherland. (fschumacher)
    Add: Provide a mechanism that enables the container to check if a component \ 
(typically a web application) has been granted a given permission when running \ 
under a SecurityManager without the current execution stack having to have \ 
passed through the component. Use this new mechanism to extend SecurityManager \ 
protection to the system property replacement feature of the digester. (markt)
    Add: When retrieving an object via a ResourceLink, ensure that the object \ 
obtained is of the expected type. (markt)
    Fix: 59824: Mark the RewriteValve as supporting async processing by default. \ 
(markt)
    Fix: 59862: Allow nested jar files scanning to be filtered with the system \ 
property tomcat.util.scan.StandardJarScanFilter.jarsToSkip. Patch is provided by \ 
Terence Bandoian. (violetagg)
    Fix: 59866: When scanning WEB-INF/classes for annotations, don't scan the \ 
contents of WEB-INF/classes/META-INF (if present) since classes will never be \ 
loaded from that location. (markt)
    Fix: 59888: Correctly handle tabs and spaces in quoted version one cookies \ 
when using the Rfc6265CookieProcessor. (markt)
    Fix: 59912: Fix an edge case in input stream handling where an IOException \ 
could be thrown when reading a POST body. (markt)
    Fix: 59960: Fix Javadoc so it builds with Java 8. Patch by Coty Sutherland. \ 
(markt)
    Fix: 59966: Do not start the web application if the error page configuration \ 
in web.xml is invalid. (markt)
    Fix: Switch the CGI servlet to the standard logging mechanism and remove \ 
support for the debug attribute. (markt)
    Fix: Changes to the allowLinking attribute of a StandardRoot instance now \ 
invalidate the cache if caching is enabled. (markt)
    Add: Add a new initialisation parameter, envHttpHeaders, to the CGI Servlet \ 
to mitigate httpoxy (CVE-2016-5388) by default and to provide a mechanism that \ 
can be used to mitigate any future, similar issues. (markt)
    Add: When adding and removing ResourceLinks dynamically, ensure that the \ 
global resource is only visible via the ResourceLinkFactory when it is meant to \ 
be. (markt)
    Fix: 60008: When processing CORs requests, treat any origin with a URI \ 
scheme of file as a valid origin. (markt)
    Fix: Improve handling of exceptions during a Lifecycle events triggered by a \ 
state transition. The exception is now caught and the component is now placed \ 
into the FAILED state. (markt)
    Fix: 60013: Fix encoding issues when using the RewriteValve with UTF-8 query \ 
strings or UTF-8 redirect URLs. (markt)
    Fix: 60022: Improve handling when a WAR file and/or the associated exploded \ 
directory are symlinked into the appBase. (markt)
    Fix: Fix a file descriptor leak when reading the global web.xml. (markt)
    Fix: Consistently decode URL patterns provided via web.xml using the \ 
encoding of the web.xml file where specified or UTF-8 where no explicit encoding \ 
is specified. (markt)
    Fix: Make timing attacks against the Realm implementations harder. (schultz)

Coyote

    Fix: Improve error handling around user code prior to calling \ 
InstanceManager.destroy() to ensure that the method is executed. (markt)
    Fix: Extend synchronization for NIO2 writes to avoid \ 
ConcurrentModificationException observed during testing. (markt)
    Fix: 59904: Add a limit (default 200) for the number of cookies allowed per \ 
request. Based on a patch by gehui. (markt)
    Fix: 59925: Correct regression in r1628368 and ensure that HTTP separators \ 
are handled as configured in the LegacyCookieProcessor. Patch provided by Kyohei \ 
Nakamura. (markt)
    Fix: OpenSSL now disables 3DES by default so reflect this when using OpenSSL \ 
syntax to select ciphers. (markt)

Jasper

    Fix: Improve error handling around user code prior to calling \ 
InstanceManager.destroy() to ensure that the method is executed. (markt)
    Fix: Improve the error handling for custom tags to ensure that the tag is \ 
returned to the pool or released and destroyed once used. (markt)
    Fix: 60032: Fix handling of method calls that use varargs within EL value \ 
expressions. (markt)
    Fix: Ignore engineOptionsClass and scratchdir when running under a security \ 
manager. (markt)
    Fix: Fixed StringIndexOutOfBoundsException. Based on a patch provided by \ 
wuwen via Github. (violetagg)

WebSocket

    Fix: Improve error handling around user code prior to calling \ 
InstanceManager.destroy() to ensure that the method is executed. (markt)
    Fix: 59908: Ensure that a reason phrase is included in the close message if \ 
a session is closed due to a timeout. (markt)

Web Applications

    Fix: Do not log an additional case of IOExceptions in the error handler for \ 
the Drawboard WebSocket example when the root cause is the client disconnecting \ 
since the logs add no value. (markt)
    Fix: 59642: Mention the localDataSource in the DataSourceRealm section of \ 
the Realm How-To. (markt)
    Fix: Follow-up to the fix for 59399. Ensure that the new attribute \ 
transportGuaranteeRedirectStatus is documented for all Realms. Also document the \ 
NullRealm and when it is automatically created for an Engine. (markt)
    Fix: Fix the description of maxAge attribute in jdbc-pool doc. This \ 
attribute works both when a connection is returned and when a connection is \ 
borrowed. (kfujino)
    Fix: 59774: Correct the prefix values in the documented examples for \ 
configuring the AccessLogValve. Patch provided by Mike Noordermeer. (markt)
    Fix: 59868: Clarify the documentation for the Manager web application to \ 
make clearer that the host name and IP address in the server section are the \ 
primary host name and IP address. (markt)
    Fix: MBeans Descriptors How-To is moved to mbeans-descriptors-howto.html. \ 
Patch provided by Radoslav Husar. (violetagg)
    Fix: Update NIO Connector configuration documentation with an information \ 
about socket.directSslBuffer. (violetagg)
    Fix: 60034: Correct a typo in the Manager How-To page of the documentation \ 
web application. (markt)

Tribes

    Add: Add log message when the ping has timed-out. (kfujino)
    Fix: If the ping message has been received at the \ 
AbstractReplicatedMap#leftOver method, ensure that notify the member is alive \ 
than ignore it. (kfujino)

jdbc-pool

    Fix: Fix the duplicated connection release when connection verification \ 
failed. (kfujino)
    Fix: Ensure that do not remove the abandoned connection that has been \ 
already released. (kfujino)
    Fix: In order to avoid the unintended skip of PoolCleaner, remove the check \ 
code of the execution interval in the task that has been scheduled. (kfujino)
    Fix: 59850: Ensure that the ResultSet is closed when enabling the \ 
StatementCache interceptor. (kfujino)
    Fix: 59923: Reduce the default value of validationInterval in order to avoid \ 
the potential issue that continues to return an invalid connection after \ 
database restart. (kfujino)
    Fix: Ensure that the ResultSet is returned as Proxy object when enabling the \ 
StatementDecoratorInterceptor. (kfujino)
    Fix: 60043: Ensure that the suspectTimeout works without removing connection \ 
when the removeAbandoned is disabled. (kfujino)
    Fix: Add log message of when returning the connection that has been marked \ 
suspect. (kfujino)
    Fix: Correct Javadoc for ConnectionPool.suspect(). Based on a patch by Yahya \ 
Cahyadi. (markt)

Other

    Update: 59276: Update optional Checkstyle library to 6.17. (kkolinko)
    Add: Use the mirror network rather than the ASF master site to download the \ 
current ASF dependencies. (markt)
    Update: Update the packaged version of the Tomcat Native Library to 1.2.8 to \ 
pick up the latest fixes and make 1.2.8 the minimum recommended version. (markt)
    Fix: 59899: Update Tomcat's copy of the Java Persistence annotations to \ 
include the changes made in 2.1 / JavaEE 7. (markt)
    Fix: Fixed typos in mbeans-descriptors.xml files. (violetagg)
    Update: Update the internal fork of Commons BCEL to r1757132 to align with \ 
the BCEL 6 release. (markt)
    Update: Update the internal fork of Commons DBCP2 to r1757164 to pick up a \ 
couple of bug fixes. (markt)
    Update: Update the internal fork of Commons Codec to r1757174. Code \ 
formatting changes only. (markt)
    Update: Update the internal fork of Commons FileUpload to afdedc9. This \ 
pulls in a fix to improve the performance with large multipart boundaries. \ 
(markt)

Log message:
Update apache-tomcat8 to 8.0.36

Huge number of fixes listed at

  http://tomcat.apache.org/tomcat-8.0-doc/changelog.html

Highlights of fixes:

     * Fix: RMI Target related memory leaks are avoidable which makes them
       an application bug that needs to be fixed rather than a JRE bug to
       work around. Therefore, start logging RMI Target related memory
       leaks on web application stop. Add an option that controls if the
       check for these leaks is made. Log a warning if running on Java 9
       with this check enabled but without the command line option it
       requires. (markt)
     * Fix: Ensure NPE will not be thrown during deployment when scanning
       jar files without MANIFEST.MF file. (violetagg)
     * Fix: 59604: Correct the assumption made in the URL decoding that
       the default platform encoding is always compatible with ISO-8859-1.
       This assumption is not always valid, e.g. on z/OS. (markt)
     * Fix: 59608: Skip over any invalid Class-Path attribute from JAR
       manifests. Log errors at debug level due to many bad libraries.
       (remm)
     * Fix: Ensure that requests with HTTP method names that are not
       tokens (as required by RFC 7231) are rejected with a 400 response.
       (markt)
     * Fix: When an asynchronous request is processed by the AJP
       connector, ensure that request processing has fully completed
       before starting the next request. (markt)
     * Fix: If an async dispatch results in the completion of request
       processing, ensure that any remaining request body is swallowed
       before starting the processing of the next request else the
       remaining body may be read as the start of the next request leading
       to a 400 response. (markt)
     * Fix: Fix a memory leak in the expression language implementation
       that caused the class loader of the first web application to use
       expressions to be pinned in memory. (markt)
     * Fix: Correctly configure the base path for a resources directory
       provided by an expanded JAR file. Patch provided by hengyunabc.
       (markt)
     * Fix: 59317: Ensure that HttpServletRequest.getRequestURI() returns
       an encoded URI rather than a decoded URI after a dispatch. (markt)

Highlights of non-fixes:

     * Update: Update the internal fork of Commons DBCP 2 to r1743696
       (2.1.1 plus additional fixes). (markt)
     * Update: Update the internal fork of Commons Pool 2 to r1743697
       (2.4.2 plus additional fixes). (markt)
     * Update: Update the internal fork of Commons File Upload to r1743698
       (1.3.1 plus additional fixes). (markt)
     * Update: Update the option code coverage tool Cobertura to 2.1.1 so
       it is easier to compare the change in lines of code between 8.0.x
       and 9.0.x. (markt)
     * Add: Add a new environment variable JSSE_OPTS that is intended to
       be used to pass JVM wide configuration to the JSSE implementation.
       The default value is -Djdk.tls.ephemeralDHKeySize=2048 which
       protects against weak Diffie-Hellman keys with Java 8. (markt)
     * Update: Exclude ciphers that use RSA keys from the default cipher
       list since they do not support forward secrecy. (markt)
     * Update: Update the packaged version of the Tomcat Native Library to
       1.2.7 to pick up the Windows binaries that are based on OpenSSL
       1.0.2h and APR 1.5.2. (markt)

Log message:
Remove the stability entity, it has no meaning outside of an official context.

Log message:
Change the service_bundle name to "export" to reduce diffs between the
original manifest.xml file and the output from "svccfg export".

Log message:
Update to 8.0.33

Changelog:
Tomcat 8.0.33 (markt)
Catalina

    Fix: Correct a regression in the fix for 58867. When configuring a Context \ 
to use an external directory for the docBase, and that directory happens to be \ 
located along side the original WAR, use the directory as the docBase rather \ 
than expanding the WAR into the appBase and using the newly created expanded \ 
directory as the docBase. (markt)
    Add: 58351: Make the server build date and server version number accessible \ 
via JMX. Patch provided by Huxing Zhang. (markt)
    Add: 58988: Special characters in the substitutions for the RewriteValve can \ 
now be quoted with a backslash. (fschumacher)
    Fix: 58999: Fix class and resource name filtering in WebappClassLoader. It \ 
throws a StringIndexOutOfBoundsException if the name is exactly "org" \ 
or "javax". (rjung)
    Code: Remove unnecessary code. There is no support for context level \ 
cluster. (kfujino)
    Add: Make checking for var and map replacement in RewriteValve a bit \ 
stricter and correct detection of colon in var replacement. (fschumacher)
    Fix: Fix the type of InstanceManager attribute of mbean definition of \ 
StandardContext. (kfujino)
    Fix: Refactor the web application class loader to reduce the impact of JAR \ 
scanning on the memory footprint of the web application. (markt)
    Fix: Fix some resource leaks in the error handling for accessing files from \ 
JARs and WARs. (markt)
    Fix: Refactor the JAR and JAR-in-WAR resource handling to reduce the memory \ 
footprint of the web application. (markt)
    Fix: 57809: Deprecate the custom context attribute \ 
org.apache.tomcat.util.scan.MergedWebXml which will be removed in Tomcat 9. \ 
(markt)
    Fix: 59001: Correctly handle the case when Tomcat is installed on a path \ 
where one of the segments ends in an exclamation mark. (markt)
    Fix: Expand the fix for 59001 to cover the special sequences used in \ 
Tomcat's custom jar:war: URLs. (markt)
    Fix: 59043: Avoid warning while expiring sessions associated with a single \ 
sign on if HttpServletRequest.logout() is used. (markt)
    Fix: 59054: Ensure that using the CrawlerSessionManagerValve in a \ 
distributed environment does not trigger an error when the Valve registers \ 
itself in the session. (markt)
    Fix: Storeconfig handling of alternate cookie processors. (markt/remm)
    Fix: Storeconfig handling for socket properties. (remm)
    Add: Log a warning message if a user tries to configure the default session \ 
timeout via the deprecated (and ignored) Manager.setMaxInactiveInterval() \ 
method. (markt)
    Fix: Fix incorrect parsing of the NE and NC flags in rewrite rules. (remm)
    Fix: 59065: Correct the timing of the check for colons in paths on \ 
non-Windows systems implemented in catalina.sh so it works correctly with \ 
Cygwin. Patch provided by Ed Randall. (markt)
    Fix: When a Host is configured with an appBase that does not exist, create \ 
the appBase before trying to expand an external WAR file into it. (markt)
    Fix: 59115: When using the Servlet 3.0 file upload, the submitted file name \ 
may be provided as a token or a quoted-string. If a quoted-string, unquote the \ 
string before returning it to the user. (markt)
    Fix: 59123: Close NamingEnumeration objects used by the JNDIRealm once they \ 
are no longer required. (fschumacher/markt)
    Fix: 59138: Correct a false positive warning for ThreadLocal related memory \ 
leaks when the key class but not the value class has been loaded by the web \ 
application class loader. (markt)
    Fix: 59145: Don't log an invalid warning when a user logs out of a session \ 
associated with SSO. (markt)
    Fix: 59151: Fix a regression in the fix for 56917 that added additional (and \ 
arguably unnecessary) validation to the provided redirect location. (markt)
    Fix: 59154: Fix a NullPointerException in the JASSMemoryLoginModue resulting \ 
from the introduction of the CredentialHandler to Realms. (schultz/markt)

Coyote

    Fix: 58646: Correct a problem with sendfile that resulted in a Processor \ 
being added to the cache twice leading to broken responses. (markt)
    Fix: 59015: Fix potential cause of endless APR Poller loop during shutdown \ 
if the Poller experiences an error during the shutdown process. (markt)
    Fix: Align cipher aliases for kECDHE and ECDHE with the current OpenSSL \ 
implementation. (markt)
    Fix: 59081: Retain the user defined cipher order when defining ciphers using \ 
the OpenSSL format. (markt)
    Fix: 59089: Correctly ignore HTTP headers that include non-token characters \ 
in the header name. (markt)
    Add: Add support for additional OpenSSL cipher aliases from OpenSSL master \ 
when specifying ciphers using the OpenSSL syntax. (markt)

Jasper

    Fix: 57583: Improve the performance of \ 
javax.servlet.jsp.el.ScopedAttributeELResolver when resolving attributes that do \ 
not exist. This improvement only works when Jasper is used with with Tomcat's EL \ 
implementation. (markt)
    Update: 58111: Update to the Eclipse JDT Compiler 4.5. (markt)
    Add: Add Java 9 support for JSPs. (markt)

WebSocket

    Fix: 59014: Ensure that a WebSocket close message can be sent after a close \ 
message has been received. (markt)
    Fix: Correctly handle compression of partial messages when the final message \ 
fragment has a zero length payload. (markt)
    Fix: 59119: Correct read logic for WebSocket client when using secure \ 
connections. (markt)
    Fix: 59134: Correct client connect logic for secure connections made through \ 
a proxy. (markt)
    Fix: 59189: Explicitly release the native memory held by the Inflater and \ 
Deflater when using PerMessageDeflate and the WebSocket session ends. Based on a \ 
patch by Henrik Olsson. (markt)

Web applications

    Fix: Correct an error in the documentation of the expected behaviour for \ 
automatic deployment. If a WAR is updated and an expanded directory is present, \ 
the directory will always be deleted and recreated by expanding the WAR if \ 
unpackWARs is true. (markt)
    Fix: 58935: Remove incorrect references in the documentation to using \ 
jar:file: URLs with the Manager application. (markt)
    Fix: Correct the description of the ServletRequest.getServerPort() in Proxy \ 
How-To. Issue reported via comments.apache.org. (violetagg)
    Fix: Fix a potenital indefinite wait in the Comet Chat servlet in the \ 
examples web application. (markt)

Tribes

    Fix: If promoting a proxy node to a primary node when getting a session, \ 
notify the change of the new primary node to the original backup node. (kfujino)

Other

    Fix: 58283: Change the default download location for libraries during the \ 
build process from /usr/share/java to ${user.home}/temp. Patch provided by Ahmed \ 
Hosni. (markt)
    Fix: 59031: When using the Windows uninstaller, do not remove the contents \ 
of any directories that have been symlinked into the Tomcat directory structure. \ 
(markt)
    Update: Update the packaged version of the Tomcat Native Library to 1.2.5 to \ 
pick up the Windows binaries that are based on OpenSSL 1.0.2g and APR 1.5.1. \ 
(markt)
    Update: Modify the default tomcat-users.xml file to make it harder for users \ 
to configure the entries intended for use with the examples web application for \ 
the Manager application. (markt)