Hi Konstantin, On Thu, Sep 3, 2026 at 1:44 PM Konstantin Kolinko <[email protected]> wrote:
> чт, 3 сент. 2026 г. в 18:32, csutherl (via GitHub) <[email protected]>: > > > > > > csutherl opened a new pull request, #1059: > > URL: https://github.com/apache/tomcat/pull/1059 > > > > This change fixes what I think is a bug in how we override > `ServerInfo.properties` at runtime. The issue is that when using an > override `ServerInfo.properties` in `lib/` and not setting some values > (i.e. `server.built`), the defaults that are hardcoded in the class are > used rather than the bundled values. > > > > [...] > > What is the use case? > The use case would be someone building their own tomcat and calling it some other name without wanting to override the bundled values. Maybe it's important for version info to be available for internal security audit purposes or something like that too. The security howto suggestion to only override one value also makes it unclear (to me at least) whether you should expect it to fall back to using hardcoded defaults or use bundled values for the other properties. My reading of the override implied that the file would only change that one property. If you only provide the server name as the guide suggests, you would still expose Tomcat's major version number in the version string. > > Overriding ServerInfo.properties is used to hide that they are running > Tomcat, or hide what version of Tomcat they are running. > > If they are hiding the version then leaking "server.built" timestamp > is essentially the same as leaking the version number, which > contradicts with the intent to hide it. The "unknown" string (as used > nowadays) is a good default value. > Is that exposed to the end user anywhere? I was under the impression that it's only in the logging, but I haven't looked too deeply at it. > > If they are hiding that this is Tomcat then our build timestamps are > not relevant. It is essentially a different software. > > Thus I am -1 to the proposed changes. > If we oppose the change, we should update the documentation to explicitly define the behavior, as it's currently not clear enough (to me). While we're at it, I'll create another PR/thread to discuss why version.sh and runtime serverinfo differ when using the override file. The doc says that's expected, but why? > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > >
