From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 04:53:48 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 73480 invoked by uid 500); 2 Apr 2001 04:53:47 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Received: (qmail 73471 invoked from network); 2 Apr 2001 04:53:47 -0000 User-Agent: Microsoft-Outlook-Express-Macintosh-Edition/5.02.2022 Date: Sun, 01 Apr 2001 21:53:48 -0700 Subject: FW: CHINANSL Security Advisory(CSA-200109) From: Jon Stevens <thomasnguyen@example.org> To: tomcat-dev <thomasnguyen@example.org> Message-ID: <thomasnguyen@example.org> In-Reply-To: <thomasnguyen@example.org> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N fyi. -jon ---------- From: lovehacker <thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Date: Mon, 2 Apr 2001 03:56:51 -0000 To: thomasnguyen@example.org Subject: Re: CHINANSL Security Advisory(CSA-200109) HI Sverre: Thanks your reply. your website is very nice. Today,I download Tomcat 4.0-b2 but it still can reveal script source code by special URL. please see CHINANSL Security Advisory (CSA- 200110). thanks again. lovehacker All Rights Reserved. http://www.chinansl.com thomasnguyen@example.org > [lovehacker] > > | Topic:Tomcat 4.0-b1 for winnt/2000 show ".jsp" > | source Vulnerability. [...] > > | exploits: > | http://target:8080/examples/snp/snoop%2ejsp > > This is the same problem I reported a few days ago. It has already > been fixed in Tomcat 4.0 beta 2. > > > Sverre. > > -- > <URL:mailto:thomasnguyen@example.org> > <URL:http://shh.thathost.com/> > > From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 04:59:48 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 80349 invoked by uid 500); 2 Apr 2001 04:59:45 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Received: (qmail 80335 invoked from network); 2 Apr 2001 04:59:44 -0000 User-Agent: Microsoft-Outlook-Express-Macintosh-Edition/5.02.2022 Date: Sun, 01 Apr 2001 21:59:50 -0700 Subject: FW: CHINANSL Security Advisory(CSA-200110) From: Jon Stevens <thomasnguyen@example.org> To: tomcat-dev <thomasnguyen@example.org> Message-ID: <thomasnguyen@example.org> In-Reply-To: <thomasnguyen@example.org> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N ---------- From: lovehacker <thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Date: Mon, 2 Apr 2001 03:49:00 -0000 To: thomasnguyen@example.org Subject: CHINANSL Security Advisory(CSA-200110) Topic:Tomcat 4.0-b2 for winnt/2000 show ".jsp" source Vulnerability. vulnerable: winnt/2000(maybe for other operating system also) + Tomcat 4.0-b2 discussion: A security vulnerability has been found in Windows NT/2000 systems that have Tomcat 4.0-b2 installed. The vulnerability allows remote attackers to get ".jsp" source. exploits: http://target:8080/examples/snp/snoop%252ejsp solution: None Copyright 2000-2001 CHINANSL. All Rights Reserved. Terms of use. CHINANSL Security Team <thomasnguyen@example.org> CHINANSL INFORMATION TECHNOLOGY CO.,LTD (http://www.chinansl.com) From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 06:06:07 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 12582 invoked by uid 500); 2 Apr 2001 06:06:06 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Delivered-To: moderator for thomasnguyen@example.org Received: (qmail 10509 invoked from network); 2 Apr 2001 06:00:07 -0000 Message-ID: <001101c0bb39$61d123c0$0183000a@Bishop> From: "glaive" <thomasnguyen@example.org> To: <thomasnguyen@example.org> Subject: declarative / programmatic security hybrid ... ? Date: Mon, 2 Apr 2001 00:54:29 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000E_01C0BB0F.78BF7250" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6700 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700 X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N This is a multi-part message in MIME format. ------=_NextPart_000_000E_01C0BB0F.78BF7250 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello, The current servlet specification describes an implementation of FORM = based authentication that simulates HTTP digest authentication. I'm = designing an application using Tomcat, and I'd really like to use the = container managed security, but I'd also like a more traditional user = experience... I'd like to be able to have a login form that contains (perhaps in a = hidden element) the url of the next page to be viewed. I would like the = form to post to a servlet much like j_security_check, and have the = container authenticate the user, and then pass them to the next page. = Yet, I'd still like the user to get tossed to a different login page if = they tried to access the secure resource directly... How plausable do = you think this is? What are my options? Would it be possible to write = a servlet similar to the j_security_check, only have it pass the next = page to be viewed based on data it recieves in the HTTP Request? Any help or suggestions that you can afford me are well appreciated. ~Norm Rupp ------=_NextPart_000_000E_01C0BB0F.78BF7250 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META content=3D"text/html; charset=3Diso-8859-1" = http-equiv=3DContent-Type> <META content=3D"MSHTML 5.00.2920.0" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=3D#ffffff> <DIV><FONT face=3DArial size=3D2> <DIV><FONT face=3DArial size=3D2> <DIV><FONT face=3DArial size=3D2>Hello,</FONT></DIV> <DIV>&nbsp;</DIV> <DIV>The current servlet specification describes an implementation of = FORM based=20 authentication that simulates HTTP digest authentication.&nbsp; I'm = designing an=20 application using Tomcat, and I'd really like to use the container = managed=20 security, but I'd also like a more traditional user experience...</DIV> <DIV>&nbsp;</DIV> <DIV>I'd like to be able to have a login form that contains (perhaps in = a hidden=20 element) the url of the next page to be viewed.&nbsp; I would like the = form to=20 post to a servlet much like j_security_check, and have the container=20 authenticate the user, and then pass them to the next page.&nbsp; Yet, = I'd still=20 like the user to get tossed to a different login page if they tried to = access=20 the secure resource directly... How plausable do you think this = is?&nbsp; What=20 are my options?&nbsp; Would it be possible to write a servlet similar to = the=20 j_security_check, only have it pass the next page to be viewed based on = data it=20 recieves in the HTTP Request?</DIV> <DIV>&nbsp;</DIV> <DIV>Any help or suggestions that you can afford me are well = appreciated.</DIV> <DIV>&nbsp;</DIV> <DIV><FONT face=3DArial size=3D2>~Norm=20 Rupp</FONT></DIV></FONT></DIV></FONT></DIV></BODY></HTML> ------=_NextPart_000_000E_01C0BB0F.78BF7250-- From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 06:45:06 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 34768 invoked by uid 500); 2 Apr 2001 06:45:03 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Received: (qmail 34759 invoked from network); 2 Apr 2001 06:45:02 -0000 User-Agent: Microsoft-Outlook-Express-Macintosh-Edition/5.02.2022 Date: Sun, 01 Apr 2001 23:45:08 -0700 Subject: FW: regards from lovehacker From: Jon Stevens <thomasnguyen@example.org> To: tomcat-dev <thomasnguyen@example.org> Message-ID: <thomasnguyen@example.org> In-Reply-To: <009c01c0bb3f$9ee0a4b0$230110ac@DavidWang> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N ---------- From: "lovehacker" <thomasnguyen@example.org> Date: Mon, 2 Apr 2001 14:39:08 +0800 To: <thomasnguyen@example.org> Subject: regards from lovehacker hi jon: >#1. Please report security issues to thomasnguyen@example.org >and/or thomasnguyen@example.org first. It seems >like that is a common courtesy. I am very sorry! i will report security issues to thomasnguyen@example.org first time. Tomcat 4.0-b2 Vulnerability look at this: http://Tomcat4.0-b2:8080/examples/jsp/snp/snoop%252ejsp "%252e" like "." or http://Tomcat4.0-b2:8080/examples/jsp/snp/snoop.jsp%2581 "%2581" like "?" or http://Tomcat4.0-b2:8080/examples/jsp/snp/snoop.js%2570 "%2570" like "p" lovehacker China Network Security League http://www.chinansl.com thomasnguyen@example.org From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 07:33:23 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 66536 invoked by uid 500); 2 Apr 2001 07:33:18 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Received: (qmail 66525 invoked from network); 2 Apr 2001 07:33:16 -0000 User-Agent: Microsoft-Outlook-Express-Macintosh-Edition/5.02.2022 Date: Mon, 02 Apr 2001 00:33:22 -0700 Subject: [CATALINA b2] weird issue From: Jon Stevens <thomasnguyen@example.org> To: tomcat-dev <thomasnguyen@example.org> Message-ID: <thomasnguyen@example.org> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N Craig, It seems that there is a bug in 4.0b2 where you must have at least one <context> defined in the server.xml. Is that right? It seems to me that the system should just pick up whatever .war files are in the webapps directory without having to define a <context> for each one thomasnguyen@example.org. This works with 3.2.2b2. You can replicate this by: grab this file: <http://jakarta.apache.org/builds/jakarta-velocity/demo/forumdemo-tomcat-3.2 .2b2.tar.gz> Take the forumdemo.war file out of the webapps directory. Delete all of the <context>'s in the server.xml file. start up tomcat 4.0b2. try to access: http://jonlap:8080/forumdemo/servlet/forum right now, i get: "HTTP Status 503 - This application is not currently available The requested service (This application is not currently available) is not currently available. " The .war file works fine with a stock 4.0b2 distribution, but if I try to remove the <Context path="/examples" docBase="examples" debug="0" reloadable="true"> from the server.xml file, then I start to run into a whole heap of problems. thanks, -jon From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 08:26:39 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 3654 invoked by uid 500); 2 Apr 2001 08:26:34 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Received: (qmail 3635 invoked by uid 500); 2 Apr 2001 08:26:30 -0000 Delivered-To: thomasnguyen@example.org Date: 2 Apr 2001 08:26:28 -0000 Message-ID: <thomasnguyen@example.org> From: thomasnguyen@example.org To: thomasnguyen@example.org Subject: cvs commit: jakarta-tomcat/src/native/mod_jk/apache2.0 mod_jk.c hgomez 01/04/02 01:26:28 Modified: src/native/mod_jk/apache2.0 mod_jk.c Log: Correct ap_get_remote_host() for post apache 2.0 alpha-15 (Thanks to Jeff Trawick) Revision Changes Path 1.11 +1 -4 jakarta-tomcat/src/native/mod_jk/apache2.0/mod_jk.c Index: mod_jk.c =================================================================== RCS file: /home/cvs/jakarta-tomcat/src/native/mod_jk/apache2.0/mod_jk.c,v retrieving revision 1.10 retrieving revision 1.11 diff -u -r1.10 -r1.11 --- mod_jk.c 2001/03/27 22:02:34 1.10 +++ mod_jk.c 2001/04/02 08:26:25 1.11 @@ -326,10 +326,7 @@ s->remote_user = NULL_FOR_EMPTY(r->user); s->protocol = r->protocol; - s->remote_host = (char *)ap_get_remote_host(r->connection, - r->per_dir_config, REMOTE_NAME, - REMOTE_HOST); - + s->remote_host = (char *)ap_get_remote_host(r->connection, r->per_dir_config, REMOTE_HOST, NULL); s->remote_host = NULL_FOR_EMPTY(s->remote_host); s->remote_addr = NULL_FOR_EMPTY(r->connection->remote_ip); From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 08:41:58 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 17499 invoked by uid 500); 2 Apr 2001 08:41:53 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Received: (qmail 17490 invoked by uid 500); 2 Apr 2001 08:41:50 -0000 Delivered-To: thomasnguyen@example.org Date: 2 Apr 2001 08:41:48 -0000 Message-ID: <thomasnguyen@example.org> From: thomasnguyen@example.org To: thomasnguyen@example.org Subject: cvs commit: jakarta-tomcat-4.0/catalina/src/share/org/apache/catalina/servlets DefaultServlet.java remm 01/04/02 01:41:48 Modified: catalina/src/share/org/apache/catalina/servlets DefaultServlet.java Log: - Fixes security problem reported by Jon and an anonymous hacker. Now http://83.161.120.155:8080/examples/jsp/dates/date%252ejsp returns 404, while http://83.161.120.155:8080/examples/jsp/dates/date%2ejsp returns the result of the execution of the JSP. Now Craig is going to have a lot of fun building new binaries ;) Revision Changes Path 1.32 +4 -6 jakarta-tomcat-4.0/catalina/src/share/org/apache/catalina/servlets/DefaultServlet.java Index: DefaultServlet.java =================================================================== RCS file: /home/cvs/jakarta-tomcat-4.0/catalina/src/share/org/apache/catalina/servlets/DefaultServlet.java,v retrieving revision 1.31 retrieving revision 1.32 diff -u -r1.31 -r1.32 --- DefaultServlet.java 2001/03/23 02:55:44 1.31 +++ DefaultServlet.java 2001/04/02 08:41:45 1.32 @@ -1,7 +1,7 @@ /* - * $Header: /home/cvs/jakarta-tomcat-4.0/catalina/src/share/org/apache/catalina/servlets/DefaultServlet.java,v 1.31 2001/03/23 02:55:44 remm Exp $ - * $Revision: 1.31 $ - * $Date: 2001/03/23 02:55:44 $ + * $Header: /home/cvs/jakarta-tomcat-4.0/catalina/src/share/org/apache/catalina/servlets/DefaultServlet.java,v 1.32 2001/04/02 08:41:45 remm Exp $ + * $Revision: 1.32 $ + * $Date: 2001/04/02 08:41:45 $ * * ==================================================================== * @@ -122,7 +122,7 @@ * * @author Craig R. McClanahan * @author Remy Maucherat - * @version $Revision: 1.31 $ $Date: 2001/03/23 02:55:44 $ + * @version $Revision: 1.32 $ $Date: 2001/04/02 08:41:45 $ */ public class DefaultServlet @@ -868,8 +868,6 @@ // Placed at the beginning of the chain so that encoded // bad stuff(tm) can be caught by the later checks String normalized = path; - if (normalized.indexOf('%') >= 0) - normalized = RequestUtil.URLDecode(normalized, "UTF8"); if (normalized == null) return (null); From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 08:43:32 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 19017 invoked by uid 500); 2 Apr 2001 08:43:28 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Received: (qmail 19006 invoked from network); 2 Apr 2001 08:43:27 -0000 Message-ID: <thomasnguyen@example.org> From: "Remy Maucherat" <thomasnguyen@example.org> To: <thomasnguyen@example.org> References: <thomasnguyen@example.org> Subject: Re: [CATALINA b2] weird issue Date: Mon, 2 Apr 2001 01:41:47 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4133.2400 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N > Craig, > > It seems that there is a bug in 4.0b2 where you must have at least one > <context> defined in the server.xml. Is that right? It seems to me that the > system should just pick up whatever .war files are in the webapps directory > without having to define a <context> for each one thomasnguyen@example.org. This works with > 3.2.2b2. > > You can replicate this by: > > grab this file: > <http://jakarta.apache.org/builds/jakarta-velocity/demo/forumdemo-tomcat-3.2 > .2b2.tar.gz> > > Take the forumdemo.war file out of the webapps directory. > > Delete all of the <context>'s in the server.xml file. > > start up tomcat 4.0b2. > > try to access: > > http://jonlap:8080/forumdemo/servlet/forum > > right now, i get: > > "HTTP Status 503 - This application is not currently available > The requested service (This application is not currently available) is not > currently available. " > > The .war file works fine with a stock 4.0b2 distribution, but if I try to > remove the <Context path="/examples" docBase="examples" debug="0" > reloadable="true"> from the server.xml file, then I start to run into a > whole heap of problems. I can't reproduce that one. I removed all context defs from my server.xml, and everything still works fine. You can check the logs to try to figure out what's going on. Remy From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 10:04:08 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 81722 invoked by uid 500); 2 Apr 2001 10:04:01 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Received: (qmail 81712 invoked from network); 2 Apr 2001 10:03:59 -0000 From: "Anil" <thomasnguyen@example.org> To: <thomasnguyen@example.org> Subject: I have got a query regarding PrintWriter, Date: Mon, 2 Apr 2001 15:30:42 +0530 Message-ID: <thomasnguyen@example.org> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) In-Reply-To: <thomasnguyen@example.org> X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Importance: Normal X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N I have been trying to intercept all the System.out and System.err request given in the tomcat. Here is the excerpts of the Code. I wrote a class WSPrintStream that extends PrintStream and overided the commonly used println(..) statements. >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>>>>>> /* * WSPrintStream.java * * Created on March 31, 2001, 1:13 PM */ package org.weume; /** * * @author anil oommen * @version */ public class WSPrintStream extends java.io.PrintStream { /** Holds value of property outputText. */ private java.lang.String outputText; private java.lang.StringBuffer new_outputText; /** Utility field used by bound properties. */ private java.beans.PropertyChangeSupport propertyChangeSupport = new java.beans.PropertyChangeSupport (this); /** Creates new WSPrintStream */ public WSPrintStream(java.io.OutputStream out){ super(out); outputText = new java.lang.String(); new_outputText = new java.lang.StringBuffer(); } public void print(boolean param) { new_outputText.append(param); updateOutputText(); } public void print(char param) { new_outputText.append(param); updateOutputText(); } public void print(char[] values) { new_outputText.append(values); updateOutputText(); } public void print(double param) { new_outputText.append(param); updateOutputText(); } public void print(float param) { new_outputText.append(param); updateOutputText(); } public void print(int param) { new_outputText.append(param); updateOutputText(); } public void print(java.lang.Object obj) { new_outputText.append(obj); updateOutputText(); } public void print(java.lang.String str) { new_outputText.append(str); updateOutputText(); } public void print(long param) { new_outputText.append(param); updateOutputText(); } public void println() { } public void println(boolean param) { new_outputText.append(param); updateOutputText(); } public void println(char param) { new_outputText.append(param); updateOutputText(); } public void println(char[] values) { new_outputText.append(values); updateOutputText(); } public void println(double param) { new_outputText.append(param); updateOutputText(); } public void println(float param) { new_outputText.append(param); updateOutputText(); } public void println(int param) { new_outputText.append(param); updateOutputText(); } public void println(java.lang.Object obj) { new_outputText.append(obj); updateOutputText(); } public void println(java.lang.String str) { new_outputText.append(str + "\n" ); updateOutputText(); } public void println(long param) { new_outputText.append(param); updateOutputText(); } /** Add a PropertyChangeListener to the listener list. * @param l The listener to add. */ public void addPropertyChangeListener(java.beans.PropertyChangeListener l) { propertyChangeSupport.addPropertyChangeListener (l); } /** Removes a PropertyChangeListener from the listener list. * @param l The listener to remove. */ public void removePropertyChangeListener(java.beans.PropertyChangeListener l) { propertyChangeSupport.removePropertyChangeListener (l); } /** Getter for property outputText. * @return Value of property outputText. */ public java.lang.String getOutputText() { return outputText; } /** Setter for property outputText. * @param outputText New value of property outputText. */ public synchronized void updateOutputText() { String old_outputText = this.outputText; this.outputText = this.outputText + new_outputText.toString(); this.new_outputText = new java.lang.StringBuffer(); propertyChangeSupport.firePropertyChange ("outputText", old_outputText, outputText); } } >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>>>> now before the execution of tomcat server I added this code >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> oldSystem_out = System.out; WSPrintStream wsp = new WSPrintStream(System.out); System.setOut(wsp); wsp.addPropertyChangeListener(this); >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Now I can catch all the println statements in the >>>>>>>>public void propertyChange(java.beans.PropertyChangeEvent evt){ when ever the System.out.println(....) is used in the System But,, This is a problem I encountered If I use >>>>>>>>>> java.io.PrintStream pw = new java.io.PrintStream(System.out); pw.println("helo try reading this"); >>>>>>> I am not able to catch the message from going to the default out put stream. i.e my WSPrintStream does not get invoked. It would be nice if somebody told me as to what I am doing wrong. And what would be the best way to do it. I have been trying to do GUI for TOMCAT and want to redirect all the Stream output to my display without editing or modifying any of the tomcat original source. Thanx in Advance, Anil Oommen Technical Member, Banyanlabs , Chennai India thomasnguyen@example.org thomasnguyen@example.org From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 12:39:37 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 26377 invoked by uid 500); 2 Apr 2001 12:39:37 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Received: (qmail 26367 invoked from network); 2 Apr 2001 12:39:36 -0000 Message-ID: <thomasnguyen@example.org> From: "Kommineni, Sateesh (IndSys)" <thomasnguyen@example.org> To: thomasnguyen@example.org Subject: Where the Servlet's generated from JSP's will be saved?? Date: Mon, 2 Apr 2001 18:11:48 +0530 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2652.35) Content-Type: text/plain X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N Hi, In Apache tomcat environment, where the Servlets that are generated by the JspEngine will be saved. thanks in advance... Sateesh From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 12:51:58 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 33422 invoked by uid 500); 2 Apr 2001 12:51:55 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Received: (qmail 33239 invoked from network); 2 Apr 2001 12:51:53 -0000 Reply-To: <thomasnguyen@example.org> From: =?iso-8859-1?Q?Emmanuel_L=E9charny?= <thomasnguyen@example.org> To: <thomasnguyen@example.org> Subject: RE: Where the Servlet's generated from JSP's will be saved?? Date: Mon, 2 Apr 2001 14:55:27 +0200 Message-ID: <001501c0bb74$316ef690$d23e05c0@victor> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 In-Reply-To: <thomasnguyen@example.org> Importance: Normal X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N look at <tomcat root directory>\work\localhost_8080%2Fexamples given that your installed Tomcat without modifying anyting in server.xml. Wathever, it's under <tomcat>\work\<some_directory> Emmanuel Lécharny, IKTEK 06 08 33 32 61, www.iktek.com <http://www.iktek.com> -----Message d'origine----- De : Kommineni, Sateesh (IndSys) [mailto:thomasnguyen@example.org] Envoyé : lundi 2 avril 2001 14:42 À : thomasnguyen@example.org Objet : Where the Servlet's generated from JSP's will be saved?? Hi, In Apache tomcat environment, where the Servlets that are generated by the JspEngine will be saved. thanks in advance... Sateesh From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 12:56:28 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 35582 invoked by uid 500); 2 Apr 2001 12:56:26 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Received: (qmail 35571 invoked from network); 2 Apr 2001 12:56:21 -0000 Message-ID: <thomasnguyen@example.org> Date: Mon, 02 Apr 2001 09:41:58 +0200 From: Alex =?iso-8859-1?Q?Fern=E1ndez?= <thomasnguyen@example.org> X-Mailer: Mozilla 4.7 [en] (WinNT; I) X-Accept-Language: en MIME-Version: 1.0 To: thomasnguyen@example.org Subject: Re: TC3.3 Proposal: Refactoring org.apache.jasper.servlet References: <thomasnguyen@example.org> Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N Oh, I knew that one :( Thanks anyway, y un saludo, Alex. Steve Downey wrote: > = > It's one of the alternate names for Abstract Factory, from the GoF book= =2E AKA > toolkit. > = > The idea is that you have a an abstract class with methods such as > createThing1 and createThing2, which return abstract Thing1s and Thing2= s. A > concrete implementation of the factory, xFactory, returns an xThing1 a= nd an > xThing2, and a yFactory returns yThing1 and yThing2. > = > A classic example is GUI widgets, where you might have MotifButton, > MotifScrollbar, MotifWindow, ..., or Win32Button, Win32Scrollbar, > Win32Window, ..., or GtkButton, GtkScrollbar, GtkWindow, ... > = > Here we have CommandLineMangler, CommmandLineContext, CommandLineCompil= er, > and JspMangler, JspEngineContext, JspCompiler, ... > = > They don't seem to be pure mix and match. That is, it doesn't necessari= ly > make sense to use an XCompiler with an XContext, although it might. So = the > overhead of having to create a new Factory implementation for a new > combination or style isn't that excessive. > = > > -----Original Message----- > > From: Alex Fern=E1ndez [mailto:thomasnguyen@example.org] > > Sent: Friday, March 30, 2001 2:49 AM > > To: thomasnguyen@example.org > > Subject: Re: TC3.3 Proposal: Refactoring org.apache.jasper.servlet > > > > > > Hi Steve! > > > > Steve Downey wrote: > > > Perhaps a Kit pattern is in order? > > > > Wow, a Kit pattern. I never heard of that one (or never got > > that far in > > the Patterns books :) > > > > Is it a standard one? If so, I'll check it out thomasnguyen@example.org. > > > > Un saludo, > > > > Alex. > > > <><><><><><><><><><><><><><><><><><><><><>This electronic mail transmis= sion > may contain confidential information and is intended only for the perso= n(s) > named. Any use, copying or disclosure by any other person is strictly > prohibited. If you have received this transmission in error, please no= tify > the sender via e-mail. <><><><><><><><><><><><><><><><><><><><><> From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 14:14:47 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 15605 invoked by uid 500); 2 Apr 2001 14:14:43 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Received: (qmail 15592 invoked from network); 2 Apr 2001 14:14:41 -0000 Message-ID: <thomasnguyen@example.org> From: "Kommineni, Sateesh (IndSys)" <thomasnguyen@example.org> To: thomasnguyen@example.org Subject: RE: Where the Servlet's generated from JSP's will be saved?? Date: Mon, 2 Apr 2001 19:46:52 +0530 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2652.35) Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N Thnaks a lot Emmanuel > ---------- > From: Emmanuel L=E9charny[SMTP:thomasnguyen@example.org] > Reply To: thomasnguyen@example.org > Sent: Monday, April 02, 2001 6:25 PM > To: thomasnguyen@example.org > Subject: RE: Where the Servlet's generated from JSP's will be = saved?? >=20 > look at <tomcat root directory>\work\localhost_8080%2Fexamples >=20 > given that your installed Tomcat without modifying anyting in = server.xml. >=20 > Wathever, it's under <tomcat>\work\<some_directory> >=20 > Emmanuel L=E9charny, IKTEK > 06 08 33 32 61, www.iktek.com <http://www.iktek.com> >=20 >=20 > -----Message d'origine----- > De : Kommineni, Sateesh (IndSys) = [mailto:thomasnguyen@example.org] > Envoy=E9 : lundi 2 avril 2001 14:42 > =C0 : thomasnguyen@example.org > Objet : Where the Servlet's generated from JSP's will be saved?? >=20 >=20 > Hi, > In Apache tomcat environment, where the Servlets that are = generated > by > the JspEngine will be saved. >=20 > thanks in advance... > Sateesh >=20 From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 17:04:34 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 16217 invoked by uid 500); 2 Apr 2001 17:04:29 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Received: (qmail 16201 invoked from network); 2 Apr 2001 17:04:27 -0000 User-Agent: Microsoft-Outlook-Express-Macintosh-Edition/5.02.2022 Date: Mon, 02 Apr 2001 11:04:23 -0700 Subject: FW: CHINANSL Security Advisory(CSA-200108) From: Jon Stevens <thomasnguyen@example.org> To: tomcat-dev <thomasnguyen@example.org> Message-ID: <thomasnguyen@example.org> In-Reply-To: <thomasnguyen@example.org> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N ---------- From: Stian Myhre <thomasnguyen@example.org> Reply-To: Stian Myhre <thomasnguyen@example.org> Date: Mon, 2 Apr 2001 11:54:52 +0200 To: thomasnguyen@example.org Subject: Re: CHINANSL Security Advisory(CSA-200108) Hi all. It is possible not only to get the listing but also the files. If you use replace the last / with %5c it will give you the file. example: > http://target:8080/%2e%2e/%2e%2e%5cyourfilehere%00.jsp -Njack From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 17:18:26 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 30391 invoked by uid 500); 2 Apr 2001 17:18:16 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Received: (qmail 30365 invoked from network); 2 Apr 2001 17:18:11 -0000 Message-ID: <thomasnguyen@example.org> From: "Remy Maucherat" <thomasnguyen@example.org> To: <thomasnguyen@example.org> References: <thomasnguyen@example.org> Subject: Re: CHINANSL Security Advisory(CSA-200108) Date: Mon, 2 Apr 2001 10:16:25 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4133.2400 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N > ---------- > From: Stian Myhre <thomasnguyen@example.org> > Reply-To: Stian Myhre <thomasnguyen@example.org> > Date: Mon, 2 Apr 2001 11:54:52 +0200 > To: thomasnguyen@example.org > Subject: Re: CHINANSL Security Advisory(CSA-200108) > > Hi all. > > It is possible not only to get the listing > but also the files. > If you use replace the last / with %5c it will > give you the file. > > example: > > http://target:8080/%2e%2e/%2e%2e%5cyourfilehere%00.jsp Did you try it ? I can't reproduce that one. It was probably a pre b2 problem. Remy From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 17:30:54 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 40866 invoked by uid 500); 2 Apr 2001 17:30:46 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Received: (qmail 40854 invoked from network); 2 Apr 2001 17:30:43 -0000 Message-ID: <thomasnguyen@example.org> Date: Mon, 2 Apr 2001 10:30:18 -0700 (PDT) From: Mel Martinez <thomasnguyen@example.org> Subject: Re: I have got a query regarding PrintWriter, To: thomasnguyen@example.org In-Reply-To: <thomasnguyen@example.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N --- Anil <thomasnguyen@example.org> wrote: > I have been trying to intercept all the System.out > and System.err request > given in the tomcat. Here is the excerpts of the > Code. > > I wrote a class WSPrintStream that extends > PrintStream and overided the > commonly used println(..) statements. > > [definition of WSPrintStream trimmed except to note that it is implemented by overriding each println() method to fire a PropertyChangeEvent.] >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > >>>>>>> > > now before the execution of tomcat server I added > this code > > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > oldSystem_out = System.out; > WSPrintStream wsp = new > WSPrintStream(System.out); > System.setOut(wsp); > wsp.addPropertyChangeListener(this); > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > Now I can catch all the println statements in the > >>>>>>>public void > propertyChange( > java.beans.PropertyChangeEvent evt){ > when ever the System.out.println(....) is used in the > System > > But,, > > > This is a problem I encountered > If I use > >>>>>>>>>> java.io.PrintStream pw = new > java.io.PrintStream(System.out); > pw.println("helo try reading this"); >>>>>> Umm... just curious, but why not use System.out.println("helo..."); instead of wrapping it here? Since (according to your use of System.setOut(), then the following should be true: System.out instanceof WSPrintStream and System.out.println() -> WSPrintStream.println() this is not the real, problem though (see below). > I am not able to catch the message from going to the > default out put > stream. > i.e my WSPrintStream does not get invoked. > Your WSPrintStream subclass needs to override the write(byte b) method. When you wrap one OutputStream around another, the data is passed from one stream to another through the OutputStream write() method. The println() method is not part of OutputStream interface and so as far as the wrapping PrintStream object is concerned they (your println methods) do not exist. I hope this helps. Cheers, Dr. Mel Martinez G1440, Inc. __________________________________________________ Do You Yahoo!? Get email at your own domain with Yahoo! Mail. http://personal.mail.yahoo.com/?.refer=text From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 17:59:18 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 63279 invoked by uid 500); 2 Apr 2001 17:59:15 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Received: (qmail 63270 invoked from network); 2 Apr 2001 17:59:12 -0000 From: "Marc Saegesser" <thomasnguyen@example.org> To: <thomasnguyen@example.org> Subject: RE: CHINANSL Security Advisory(CSA-200108) Date: Mon, 2 Apr 2001 12:59:13 -0500 Message-ID: <thomasnguyen@example.org> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 In-Reply-To: <thomasnguyen@example.org> Importance: Normal X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N I've been trying to reproduce this using 3.2.1 on Win2000 (as the original reported stated) and so far I can't make it happen. In all cases I get a 404. I get the same results using 3.2.2b2. > -----Original Message----- > From: Jon Stevens [mailto:thomasnguyen@example.org] > Sent: Monday, April 02, 2001 1:04 PM > To: tomcat-dev > Subject: FW: CHINANSL Security Advisory(CSA-200108) > > > > ---------- > From: Stian Myhre <thomasnguyen@example.org> > Reply-To: Stian Myhre <thomasnguyen@example.org> > Date: Mon, 2 Apr 2001 11:54:52 +0200 > To: thomasnguyen@example.org > Subject: Re: CHINANSL Security Advisory(CSA-200108) > > Hi all. > > It is possible not only to get the listing > but also the files. > If you use replace the last / with %5c it will > give you the file. > > example: > > http://target:8080/%2e%2e/%2e%2e%5cyourfilehere%00.jsp > > -Njack From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 18:51:44 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 33956 invoked by uid 500); 2 Apr 2001 18:51:39 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Received: (qmail 33916 invoked from network); 2 Apr 2001 18:51:37 -0000 Message-ID: <thomasnguyen@example.org> From: GOMEZ Henri <thomasnguyen@example.org> To: thomasnguyen@example.org Subject: RE: [ANNOUNCE] Tomcat 4.0 Beta 2 Date: Mon, 2 Apr 2001 20:51:34 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Content-Type: multipart/mixed; boundary="----_=_NextPart_000_01C0BBA5.F1E07B34" X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_000_01C0BBA5.F1E07B34 Content-Type: text/plain; charset="iso-8859-1" Hi, Just finished to see how to rebuild the beta2 and I notice that many build.xml must be adapted to allow users with non-standard jar location to works. Attached are my patches. The bad news came from mod_webapp which didn't compile at all on my gcc (many bad structs declarations, missing includes in wa.h) Did Pier has commited all his change to cvs before beta2 was closed ? ------_=_NextPart_000_01C0BBA5.F1E07B34 Content-Type: application/octet-stream; name="catalina-build.xml.diff" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="catalina-build.xml.diff" --- ./catalina/build.xml.orig Mon Apr 2 18:55:59 2001=0A= +++ ./catalina/build.xml Mon Apr 2 19:19:59 2001=0A= @@ -13,13 +13,17 @@=0A= <!-- =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Derived = Property Values = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D -->=0A= <property name=3D"jaxp.jar" = value=3D"${catalina.jaxp.home}/jaxp.jar"/>=0A= <property name=3D"parser.jar" = value=3D"${catalina.jaxp.home}/${catalina.jaxp.parser.jar}"/>=0A= - <property name=3D"jcert.jar" = value=3D"${jsse.home}/lib/jcert.jar"/>=0A= - <property name=3D"jndi.jar" = value=3D"${jndi.home}/lib/jndi.jar"/>=0A= - <property name=3D"jnet.jar" = value=3D"${jsse.home}/lib/jnet.jar"/>=0A= - <property name=3D"jsse.jar" = value=3D"${jsse.home}/lib/jsse.jar"/>=0A= - <property name=3D"jmxri.jar" = value=3D"${jmx.home}/lib/jmxri.jar"/>=0A= + <property name=3D"jsse.lib" value=3D"${jsse.home}/lib/"/>=0A= + <property name=3D"jmx.lib" value=3D"${jmx.home}/lib/"/>=0A= + <property name=3D"jndi.lib" value=3D"${jndi.home}/lib/"/>=0A= + <property name=3D"servlet.lib" = value=3D"${servletapi.home}/lib/"/>=0A= + <property name=3D"jcert.jar" = value=3D"${jsse.lib}/jcert.jar"/>=0A= + <property name=3D"jndi.jar" = value=3D"${jndi.lib}/jndi.jar"/>=0A= + <property name=3D"jnet.jar" = value=3D"${jsse.lib}/jnet.jar"/>=0A= + <property name=3D"jsse.jar" = value=3D"${jsse.lib}/jsse.jar"/>=0A= + <property name=3D"jmxri.jar" = value=3D"${jmx.lib}/jmxri.jar"/>=0A= <property name=3D"regexp.jar" = value=3D"${regexp.home}/jakarta-regexp-1.2.jar"/>=0A= - <property name=3D"servlet.jar" = value=3D"${servletapi.home}/lib/servlet.jar"/>=0A= + <property name=3D"servlet.jar" = value=3D"${servletapi.lib}/servlet.jar"/>=0A= =0A= <!-- =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D = BUILD: Create Directories = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D = -->=0A= <target name=3D"build-prepare">=0A= @@ -69,9 +73,7 @@=0A= <copy file=3D"${parser.jar}" =0A= = tofile=3D"${catalina.build}/server/lib/${catalina.jaxp.parser.jar}" = />=0A= <!-- Catalina needs the regular expression library -->=0A= - <copy todir=3D"${catalina.build}/server/lib">=0A= - <fileset dir=3D"${regexp.home}" includes=3D"*.jar"/>=0A= - </copy>=0A= + <copy file=3D"${regexp.jar}" = tofile=3D"${catalina.build}/server/lib/regexp.jar"/>=0A= <!-- Catalina needs the JSSE packages -->=0A= <!--=0A= <copy file=3D"${jcert.jar}" = tofile=3D"${catalina.build}/server/lib/jcert.jar"/>=0A= ------_=_NextPart_000_01C0BBA5.F1E07B34 Content-Type: application/octet-stream; name="jasper-build.xml.diff" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="jasper-build.xml.diff" --- ./jasper/build.xml.orig Mon Apr 2 19:02:52 2001=0A= +++ ./jasper/build.xml Mon Apr 2 19:04:34 2001=0A= @@ -11,7 +11,8 @@=0A= <!-- =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Derived = Property Values = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D -->=0A= <property name=3D"jaxp.jar" = value=3D"${jasper.jaxp.home}/jaxp.jar"/>=0A= <property name=3D"parser.jar" = value=3D"${jasper.jaxp.home}/${jasper.jaxp.parser.jar}"/>=0A= - <property name=3D"servlet.jar" = value=3D"${servletapi.home}/lib/servlet.jar"/>=0A= + <property name=3D"servletapi.lib" = value=3D"${servletapi.home}/lib"/>=0A= + <property name=3D"servlet.jar" = value=3D"${servletapi.lib}/servlet.jar"/>=0A= <property name=3D"tools.jar" = value=3D"${java.home}/lib/tools.jar"/>=0A= =0A= =0A= ------_=_NextPart_000_01C0BBA5.F1E07B34 Content-Type: application/octet-stream; name="webapp-build.xml.diff" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="webapp-build.xml.diff" --- ./webapps/build.xml.orig Mon Apr 2 19:05:02 2001=0A= +++ ./webapps/build.xml Mon Apr 2 19:05:32 2001=0A= @@ -10,7 +10,8 @@=0A= =0A= =0A= <!-- =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Derived = Property Values = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D -->=0A= - <property name=3D"servlet.jar" = value=3D"${servletapi.home}/lib/servlet.jar"/>=0A= + <property name=3D"servletapi.lib" = value=3D"${servletapi.home}/lib"/>=0A= + <property name=3D"servlet.jar" = value=3D"${servletapi.lib}/servlet.jar"/>=0A= =0A= =0A= <!-- =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D = BUILD: Create Directories = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D = -->=0A= ------_=_NextPart_000_01C0BBA5.F1E07B34 Content-Type: application/octet-stream; name="webapps-webdav-build.xml.diff" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="webapps-webdav-build.xml.diff" --- ./webapps/webdav/build.xml.orig Mon Apr 2 19:07:23 2001=0A= +++ ./webapps/webdav/build.xml Mon Apr 2 19:06:44 2001=0A= @@ -10,7 +10,8 @@=0A= =0A= =0A= <!-- =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Derived = Property Values = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D -->=0A= - <property name=3D"servlet.jar" = value=3D"${servletapi.home}/lib/servlet.jar"/>=0A= + <property name=3D"servletapi.lib" = value=3D"${servletapi.home}/lib"/>=0A= + <property name=3D"servlet.jar" = value=3D"${servletapi.lib}/servlet.jar"/>=0A= =0A= =0A= <!-- =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D = BUILD: Create Directories = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D = -->=0A= ------_=_NextPart_000_01C0BBA5.F1E07B34-- From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 19:03:24 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 98864 invoked by uid 500); 2 Apr 2001 19:03:18 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Received: (qmail 98843 invoked from network); 2 Apr 2001 19:03:17 -0000 Date: Mon, 2 Apr 2001 12:03:11 -0700 (PDT) From: thomasnguyen@example.org Subject: Re: [ANNOUNCE] Tomcat 4.0 Beta 2 To: thomasnguyen@example.org In-Reply-To: <thomasnguyen@example.org> MIME-Version: 1.0 Content-Type: TEXT/plain; charset=us-ascii Message-Id: <thomasnguyen@example.org> X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N On 2 Apr, GOMEZ Henri wrote: > The bad news came from mod_webapp which didn't compile at all on > my gcc (many bad structs declarations, missing includes in wa.h) > > Did Pier has commited all his change to cvs before beta2 was closed ? > I have seen this for quite a while(several weeks), and just thought it was my copy of the CVS. =eas= From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 19:24:35 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 20929 invoked by uid 500); 2 Apr 2001 19:24:21 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Received: (qmail 20912 invoked from network); 2 Apr 2001 19:24:17 -0000 User-Agent: Microsoft-Outlook-Express-Macintosh-Edition/5.02.2022 Date: Mon, 02 Apr 2001 12:24:08 -0700 Subject: FW: [thomasnguyen@example.org: Tomcat may reveal script source code by URL trickery 2] From: Jon Stevens <thomasnguyen@example.org> To: tomcat-dev <thomasnguyen@example.org> Message-ID: <thomasnguyen@example.org> In-Reply-To: <thomasnguyen@example.org> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N ---------- From: "Sverre H. Huseby" <thomasnguyen@example.org> Date: Mon, 2 Apr 2001 21:03:30 +0200 To: thomasnguyen@example.org Subject: [thomasnguyen@example.org: Tomcat may reveal script source code by URL trickery 2] Jon, I sent the following to thomasnguyen@example.org a few days ago, as you requested. Now I wonder if it reached the correct people. I see that you cite "lovehacker" on the Tomcat developer list, even if his advisory appeared on Bugtraq a day after I sent mine to you. At least it showed up a day after in my mailbox. Comments? Sverre. ----- Forwarded message from "Sverre H. Huseby" <thomasnguyen@example.org> ----- From: "Sverre H. Huseby" <thomasnguyen@example.org> Subject: Tomcat may reveal script source code by URL trickery 2 Date: Sun, 1 Apr 2001 11:55:00 +0200 To: thomasnguyen@example.org User-Agent: Mutt/1.2.5i NOTE! This is not the same advisory that I sent you some days ago. Your fix for that advisory introduced a new bug, which is described here. I'm sending you this before contacting Bugtraq this time. Please tell me when you have a fix ready. Sverre. ===================================================================== Tomcat may reveal script source code by URL trickery 2 ------------------------------------------------------ Sverre H. Huseby security advisory #4, 2001-04-01 Systems affected ---------------- Tomcat 4.0-b2, which includes fixes for a similar bug. Other versions may be vulnerable too. The problem is only present when using Tomcat's built in web server, not when using Tomcat with Apache Web Server. Description ----------- Tomcat (http://jakarta.apache.org/tomcat/), the Reference Implementation for the Java Servlet 2.2 and JavaServer Pages 1.1 Technologies, may be tricked into revealing the source code of JSP scripts by using simple URL encoding. Details ------- It seems that the built in web server in affected versions of Tomcat does URL decoding twice. URLs like the following http://someplace.com:8080/index.js%2570 where %25 is an URL encoded '%', and 70 is the hexadecimal value for 'p', returns the source code of index.jsp rather than running the script on the server side. To speculate (read: guess): The JSP handler is skipped as this URL does not end in ".jsp" (after URL decoding the first time), but the static file handler is nevertheless able to map the URL into a correct file name (doing URL decoding a second time). Impact ------ This design error makes it possible to fetch the source code of JSP scripts. Such source code may contain database passwords and file names, and may reveal design errors or programming bugs that make it possible to further exploit the server or service. Reported by Sverre H. Huseby, thomasnguyen@example.org -- <URL:mailto:thomasnguyen@example.org> <URL:http://shh.thathost.com/> ----- End forwarded message ----- -- <URL:mailto:thomasnguyen@example.org> <URL:http://shh.thathost.com/> From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 20:12:44 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 74311 invoked by uid 500); 2 Apr 2001 20:12:32 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Delivered-To: moderator for thomasnguyen@example.org Received: (qmail 56998 invoked from network); 2 Apr 2001 09:24:40 -0000 Message-ID: <thomasnguyen@example.org> From: "Stian Myhre" <thomasnguyen@example.org> To: <thomasnguyen@example.org>, <thomasnguyen@example.org> Subject: Tomcat 3.2.1 continued Date: Mon, 2 Apr 2001 11:28:10 +0200 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_00CF_01C0BB67.FF6E05C0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6700 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700 X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N This is a multi-part message in MIME format. ------=_NextPart_000_00CF_01C0BB67.FF6E05C0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi. Below is a sniplet of a mail sent to Buqtraq last weekend. I've been playing around with this a bit and I discovered that you can also download files using an url like this: http://target:8080/%2e%2e/%2e%2e%5cfilenamehere%00.jsp (%5c =3D "/") this will give you the file you want. Stian Myhre Norway. on 3/30/01 11:26 PM, "lovehacker" <thomasnguyen@example.org> wrote: > Topic: > Tomcat 3.2.1 for win2000 Directory traversal > Vulnerability > > vulnerable: > Tomcat 3.2.1 for win2000 > maybe for other operating system also. > > discussion: > A security vulnerability has been found in Windows > NT/2000 systems that have Tomcat 3.2.1 > installed.The > vulnerability allows remote attackers to access files > outside the document root directory scope. > > exploits: > http://target:8080/%2e%2e/%2e%2e/%00.jsp > It is possible to cause the Tomcat server to Listing > outside the document root directory scope. > > solution: > None > > Copyright 2000-2001 CHINANSL. All Rights > Reserved. Terms of use. > > CHINANSL Security Team > <thomasnguyen@example.org> > CHINANSL INFORMATION TECHNOLOGY CO.,LTD > (http://www.chinansl.com) ------=_NextPart_000_00CF_01C0BB67.FF6E05C0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META content=3D"text/html; charset=3Diso-8859-1" = http-equiv=3DContent-Type> <META content=3D"MSHTML 5.00.2920.0" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=3D#ffffff> <DIV><FONT face=3DArial size=3D2>Hi.</FONT></DIV> <DIV>&nbsp;</DIV> <DIV><FONT face=3DArial size=3D2>Below is a sniplet of a mail sent to = Buqtraq last=20 weekend.</FONT></DIV> <DIV><FONT face=3DArial size=3D2>I've been playing around with this a = bit and I=20 discovered that you</FONT></DIV> <DIV><FONT face=3DArial size=3D2>can also download files using an url = like=20 this:</FONT></DIV> <DIV>&nbsp;</DIV> <DIV><FONT face=3DArial size=3D2><A=20 href=3D"http://target:8080/%2e%2e/%2e%2e%5cfilenamehere%00.jsp">http://ta= rget:8080/%2e%2e/%2e%2e%5cfilenamehere%00.jsp</A></FONT></DIV> <DIV><FONT face=3DArial size=3D2>(%5c =3D "/")</FONT></DIV> <DIV>&nbsp;</DIV> <DIV><FONT face=3DArial size=3D2>this will give you the file you = want.</FONT></DIV> <DIV>&nbsp;</DIV> <DIV><FONT face=3DArial size=3D2>Stian Myhre</FONT></DIV> <DIV><FONT face=3DArial size=3D2>Norway.</FONT></DIV> <DIV>&nbsp;</DIV> <DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV> <DIV><FONT face=3DArial size=3D2>on 3/30/01 11:26 PM, "lovehacker" = &lt;<A=20 href=3D"mailto:thomasnguyen@example.org">thomasnguyen@example.org</A>&gt; = wrote:<BR><BR>&gt;=20 Topic:<BR>&gt; Tomcat 3.2.1 for win2000 Directory traversal<BR>&gt;=20 Vulnerability<BR>&gt;<BR>&gt; vulnerable:<BR>&gt; Tomcat 3.2.1 for=20 win2000<BR>&gt; maybe for other operating system also.<BR>&gt;<BR>&gt;=20 discussion:<BR>&gt; A security vulnerability has been found in = Windows<BR>&gt;=20 NT/2000 systems that have Tomcat 3.2.1<BR>&gt; installed.The<BR>&gt;=20 vulnerability allows remote attackers to access files<BR>&gt; outside = the=20 document root directory scope.<BR>&gt;<BR>&gt; exploits:<BR>&gt; <A=20 href=3D"http://target:8080/../../">http://target:8080/%2e%2e/%2e%2e/%00.j= sp</A><BR>&gt;=20 It is possible to cause the Tomcat server to Listing<BR>&gt; outside the = document root directory scope.<BR>&gt;<BR>&gt; solution:<BR>&gt;=20 None<BR>&gt;<BR>&gt; Copyright 2000-2001 CHINANSL. All Rights<BR>&gt; = Reserved.=20 Terms of use.<BR>&gt;<BR>&gt; CHINANSL Security Team<BR>&gt; &lt;<A=20 href=3D"mailto:thomasnguyen@example.org">thomasnguyen@example.org</A>&gt;<B= R>&gt;=20 CHINANSL INFORMATION TECHNOLOGY CO.,LTD<BR>&gt; (<A=20 href=3D"http://www.chinansl.com">http://www.chinansl.com</A>)<BR></DIV></= FONT></BODY></HTML> ------=_NextPart_000_00CF_01C0BB67.FF6E05C0-- From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 20:13:28 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 75867 invoked by uid 500); 2 Apr 2001 20:13:21 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Delivered-To: moderator for thomasnguyen@example.org Received: (qmail 66234 invoked from network); 2 Apr 2001 09:34:01 -0000 Message-ID: <thomasnguyen@example.org> Date: Mon, 02 Apr 2001 11:37:36 +0200 From: "Peter Thomas" <thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Organization: SecurityWatch.Com X-Mailer: Mozilla 4.61 [en] (WinNT; I) X-Accept-Language: en MIME-Version: 1.0 To: thomasnguyen@example.org, thomasnguyen@example.org Subject: [Fwd: Re: CHINANSL Security Advisory(CSA-200108)] Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N Dear Apache, Further to these postings on Bugtraq, could you confirm whether this directory traversal vulnerability has indeed been fixed in the latest versions of TomCat. Kindest regards, Peter Thomas - Editor - http://www.securitywatch.com tel 385.997.2725 - fax 385.997.2725 Grensstraat 1b - B-3010 Leuven - Belgium *E-security rule #1: ignorance is never a defense* -------- Original Message -------- From: thomasnguyen@example.org (Jon Stevens) Subject: Re: CHINANSL Security Advisory(CSA-200108) Newsgroups: lists.bugtraq on 3/30/01 11:26 PM, "lovehacker" <thomasnguyen@example.org> wrote: > Topic: > Tomcat 3.2.1 for win2000 Directory traversal > Vulnerability > > vulnerable: > Tomcat 3.2.1 for win2000 > maybe for other operating system also. > > discussion: > A security vulnerability has been found in Windows > NT/2000 systems that have Tomcat 3.2.1 > installed.The > vulnerability allows remote attackers to access files > outside the document root directory scope. > > exploits: > http://target:8080/%2e%2e/%2e%2e/%00.jsp > It is possible to cause the Tomcat server to Listing > outside the document root directory scope. > > solution: > None > > Copyright 2000-2001 CHINANSL. All Rights > Reserved. Terms of use. > > CHINANSL Security Team > <thomasnguyen@example.org> > CHINANSL INFORMATION TECHNOLOGY CO.,LTD > (http://www.chinansl.com) What is with this Copyright stuff? #1. Please report security issues to thomasnguyen@example.org and/or thomasnguyen@example.org first. It seems like that is a common courtesy. #2. Please test against the latest Tomcat 4.0 which is 4.0b2. I believe that this has already been fixed. p.s. Your thomasnguyen@example.org email address bounces. -jon From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 20:14:15 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 76058 invoked by uid 500); 2 Apr 2001 20:13:53 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Delivered-To: moderator for thomasnguyen@example.org Received: (qmail 94129 invoked from network); 2 Apr 2001 10:21:54 -0000 Reply-To: <thomasnguyen@example.org> From: "Michael Hopf" <thomasnguyen@example.org> To: <thomasnguyen@example.org> Subject: jaxp1.1 and tomcat 3.2.1 ? Date: Mon, 2 Apr 2001 12:21:00 +0200 Message-ID: <thomasnguyen@example.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_0000_01C0BB6F.60C54980" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700 X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N This is a multi-part message in MIME format. ------=_NextPart_000_0000_01C0BB6F.60C54980 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit hi, our xml framework is build on the xerces1_2_3 and jaxp1.1. A servlet that uses our xml stuff always throws a no such method error exactly in the line of code where the method saxParser.getXMLReader() is called. I assume that the jaxp.jar file in the $(TOMCAT_HOME)/lib directory is jaxp version 1.0.1 or older and that this causes the exception. Whatever I do tomcat seems to use the jaxp classes (SaxParserFactory and SaxParser) from that jaxp.jar file. I tried to put the version 1.1 of jaxp.jar in the $(TOMCAT_HOME)/lib directory. But then tomcat does not start any more. Is there a way of rucnning the to jaxp versions parallel ? What do you suggest ? Many thanks in advance, Michael ------=_NextPart_000_0000_01C0BB6F.60C54980 Content-Type: text/x-vcard; name="Michael Hopf.vcf" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="Michael Hopf.vcf" BEGIN:VCARD VERSION:2.1 N:Hopf;Michael FN:Michael Hopf TITLE:Dipl. Inf. TEL;WORK;VOICE:385.997.2725 TEL;HOME;VOICE:385.997.2725 TEL;CELL;VOICE:385.997.2725 TEL;WORK;FAX:385.997.2725 ADR;WORK:;;Friedrichstr. 28 a;Dresden;;01067 LABEL;WORK;ENCODING=QUOTED-PRINTABLE:Friedrichstr. 28 a=0D=0ADresden 01067 EMAIL;PREF;INTERNET:thomasnguyen@example.org EMAIL;INTERNET:thomasnguyen@example.org EMAIL;INTERNET:thomasnguyen@example.org REV:20010226T102856Z END:VCARD ------=_NextPart_000_0000_01C0BB6F.60C54980-- From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 20:15:01 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 76267 invoked by uid 500); 2 Apr 2001 20:14:30 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Delivered-To: moderator for thomasnguyen@example.org Received: (qmail 97749 invoked from network); 2 Apr 2001 15:37:52 -0000 Date: Mon, 2 Apr 2001 16:24:52 +0100 From: Thom May <thomasnguyen@example.org> To: thomasnguyen@example.org Subject: Re: VHosting Message-ID: <thomasnguyen@example.org> References: <thomasnguyen@example.org> <thomasnguyen@example.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.3.15i In-Reply-To: <thomasnguyen@example.org>; from thomasnguyen@example.org on Fri, Mar 23, 2001 at 11:55:42 -0500 X-Operating-System: Linux/2.4.0-xfs (i686) X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N Dan, STAR! :-) Thanks to you and henri for making this kick ass! cheers, -Thom, making note to liberally distribute beer to both of you if he gets the chance * Dan Milstein (thomasnguyen@example.org) wrote on Fri Mar 23, 2001 at 11:55:42 -0500: > Thom, > > There was vigorous back and forth about this on the mailing list a few > weeks back -- I'll paste in the final message in the thread -- you could > also take a look in the archives for more details. This is from Henri: > > -Dan From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 20:15:15 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 76422 invoked by uid 500); 2 Apr 2001 20:14:55 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Delivered-To: moderator for thomasnguyen@example.org Received: (qmail 43652 invoked from network); 2 Apr 2001 16:16:58 -0000 Date: Mon, 02 Apr 2001 09:17:34 -0700 From: Bip Thelin <thomasnguyen@example.org> Subject: Re: Behavior of new Server Side Include Functionality To: thomasnguyen@example.org Reply-to: thomasnguyen@example.org Message-id: <thomasnguyen@example.org> Organization: Razorfish MIME-version: 1.0 X-Mailer: Mozilla 4.75 [en] (Windows NT 5.0; U) Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-Accept-Language: en References: <Pine.BSF.4.21.0103311343320.31897-100000@localhost> X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N "Craig R. McClanahan" wrote: > > > We can provide this option since this kind of makes sense in a web-app > > environment. However, I think the default way should be relative to the > > server's root following NCSA. What do you think? > > > > +1 on defaulting to NCSA rules, but I'd really like to see a configurable > option that virtual paths can be webapp-relative. Yes a webapp-relative option would seem good, but the option/standard way to run SSI should be NCSA compatible of course. You want to take this bug Amy? Let me know if you have any problems or need any help, I know I could of documented the code a bit better ;) ..bip From tomcat-dev-returnthomasnguyen@example.org Mon Apr 02 20:19:39 2001 Return-Path: <tomcat-dev-returnthomasnguyen@example.org> Delivered-To: thomasnguyen@example.org Received: (qmail 85706 invoked by uid 500); 2 Apr 2001 20:19:34 -0000 Mailing-List: contact thomasnguyen@example.org; run by ezmlm Precedence: bulk list-help: <mailto:thomasnguyen@example.org> list-unsubscribe: <mailto:thomasnguyen@example.org> list-post: <mailto:thomasnguyen@example.org> Reply-To: thomasnguyen@example.org Delivered-To: mailing list thomasnguyen@example.org Received: (qmail 85531 invoked from network); 2 Apr 2001 20:19:32 -0000 Message-ID: <thomasnguyen@example.org> Date: Mon, 02 Apr 2001 13:23:21 -0700 From: Amy Roh <thomasnguyen@example.org> X-Mailer: Mozilla 4.61 [en] (WinNT; U) X-Accept-Language: en MIME-Version: 1.0 To: thomasnguyen@example.org Subject: Re: CGI support servlet (TC 4) -- feedback wanted References: <thomasnguyen@example.org> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N Hi Martin, See comments below. Martin Dengler wrote: > I am putting together the next round of updates to the CGIGatewayServlet > which provides CGI capabilities (especially if you map it to /cgi-bin/* :)). > > Hopefully this will take it to full beta-level; I would like to get it > to a point where it can be included in CVS & the next beta of Tomcat 4.0. > > A couple of issues have arisen and I would like to solicit opinions on: > > 1) Name, Package, and Inner Classes > 2) Providing Functional testing classes > 3) Providing Examples > 4) Addition to default context > 5) Default location of cgi scripts > > This is my first attempt at wide feedback/partipation, so please let me > know any meta-comments, definitely. (For example, is this off-topic, too > much detail, etc.?) > > Issues: > > 1) Name, Package, and Inner Classes: > > Name: Current name is CGIGatewayServlet. The rationale is "this is the > first name I thought of." Would we prefer CGIInvokerServlet? > I personally prefer CGIInvokerServlet than CGIGatewayServlet since CGIGatewayServlet sounds kind of redundant (because it is CGI(Common Gateway Interface) GatewayServlet. This doesn't matter much though. > > Package: Right now I have put this code in one source file in the > org.apache.catalina.servlets package. I believe this to be the right > package based on WebDav, SsiInvoker, and other similar servlets. Any > suggestions? I think the invoker servlet is in the right place (org.apache.catalina.servlets). > > > Inner Classes: The CGIGatewayServlet.java file has one main class and > two inner classes. Do we have any design-type preferences or lack > thereof vis-a-vis inner classes? The inner classes could be moved out > to org.apache.catalina.util as a thought. My personal inclination would > be to leave them as inner classes, since they are not particularly > applicable to other parts of catalina. However, that could be viewed as > slightly detracting from their maintainability... > BIG +1 for separating those inner classes and putting them in org.apache.catalina.util.cgi. It will be a LOT easier to maintain. I did this already for myself to review your code. I can send them to you if you want to save a little time. :-) > > 2) Addition to default context > > Would this CGI servlet be added to the default context similar to > SsiInvokerServlet? Yes. > If so, would people prefer I do that myself and > submit a load of file patches for the commit of the CGI servlet & > related files which included the catalina web.xml? This is a minor issue adding a few lines to catalina web.xml. I have done this already on my CVS tree. > > > 3) Providing Examples > > Would it be appropriate to provide some links in the examples webapp > along with an example cgi script? I would have thought so... YES. In fact, could you send me some? > > 3) Providing Functional testing classes > > I was wondering if and how I should add any
{'source': 'Apache Software Foundation Public Mail Archives'}