чт, 3 сент. 2026 г. в 18:32, csutherl (via GitHub) <[email protected]>: > > > csutherl opened a new pull request, #1059: > URL: https://github.com/apache/tomcat/pull/1059 > > This change fixes what I think is a bug in how we override > `ServerInfo.properties` at runtime. The issue is that when using an override > `ServerInfo.properties` in `lib/` and not setting some values (i.e. > `server.built`), the defaults that are hardcoded in the class are used rather > than the bundled values. > > [...]
What is the use case? Overriding ServerInfo.properties is used to hide that they are running Tomcat, or hide what version of Tomcat they are running. If they are hiding the version then leaking "server.built" timestamp is essentially the same as leaking the version number, which contradicts with the intent to hide it. The "unknown" string (as used nowadays) is a good default value. If they are hiding that this is Tomcat then our build timestamps are not relevant. It is essentially a different software. Thus I am -1 to the proposed changes. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
