svn commit: r1225464 - in /tomcat/trunk/java/org/apache/el: lang/ExpressionBuilder.java lang/FunctionMapperFactory.java parser/AstMethodParameters.java parser/SimpleNode.java

2011-12-29 Thread markt
Author: markt Date: Thu Dec 29 08:06:24 2011 New Revision: 1225464 URL: http://svn.apache.org/viewvc?rev=1225464view=rev Log: Code clean-up. Run UCDetector over o.a.el Modified: tomcat/trunk/java/org/apache/el/lang/ExpressionBuilder.java

svn commit: r1225465 - /tomcat/trunk/java/org/apache/catalina/authenticator/NonLoginAuthenticator.java

2011-12-29 Thread markt
Author: markt Date: Thu Dec 29 08:07:03 2011 New Revision: 1225465 URL: http://svn.apache.org/viewvc?rev=1225465view=rev Log: Fix import order Modified: tomcat/trunk/java/org/apache/catalina/authenticator/NonLoginAuthenticator.java Modified:

Re: [GUMP@vmgump]: Project tomcat-trunk-validate (in module tomcat-trunk) failed

2011-12-29 Thread Mark Thomas
On 29/12/2011 07:49, Brian Burch wrote: On 29/12/11 15:50, Bill Barker wrote: Thanks for looking at the two errors for me, Bill. It was hard to see your comments because the formatting of your reply appeared mangled when I received it. I have snipped out everything except the important bits

svn commit: r1225467 - in /tomcat/trunk/java/org/apache/juli: ./ logging/

2011-12-29 Thread markt
Author: markt Date: Thu Dec 29 08:07:54 2011 New Revision: 1225467 URL: http://svn.apache.org/viewvc?rev=1225467view=rev Log: Code clean-up. Run UCDetector over o.a.juli Modified: tomcat/trunk/java/org/apache/juli/AsyncFileHandler.java

svn commit: r1225468 - /tomcat/trunk/java/org/apache/naming/factory/EjbFactory.java

2011-12-29 Thread markt
Author: markt Date: Thu Dec 29 08:08:33 2011 New Revision: 1225468 URL: http://svn.apache.org/viewvc?rev=1225468view=rev Log: Clean-up. No functional change. Modified: tomcat/trunk/java/org/apache/naming/factory/EjbFactory.java Modified:

svn commit: r1225469 - in /tomcat/tc7.0.x/trunk: ./ java/org/apache/catalina/authenticator/NonLoginAuthenticator.java

2011-12-29 Thread markt
Author: markt Date: Thu Dec 29 08:09:40 2011 New Revision: 1225469 URL: http://svn.apache.org/viewvc?rev=1225469view=rev Log: Fix import order Modified: tomcat/tc7.0.x/trunk/ (props changed) tomcat/tc7.0.x/trunk/java/org/apache/catalina/authenticator/NonLoginAuthenticator.java

Re: [SECURITY] Apache Tomcat and the hashtable collision DoS vulnerability

2011-12-29 Thread Christopher Schultz
Mark, On 12/28/11 5:28 PM, Mark Thomas wrote: Tomcat has implemented a work-around for this issue by providing a new option (maxParameterCount) to limit the number of parameters processed for a single request. This default limit is 1: high enough to be unlikely to affect any application;

[GUMP@vmgump]: Project tomcat-trunk-test (in module tomcat-trunk) failed

2011-12-29 Thread Bill Barker
To whom it may engage... This is an automated request, but not an unsolicited one. For more information please visit http://gump.apache.org/nagged.html, and/or contact the folk at gene...@gump.apache.org. Project tomcat-trunk-test has an issue affecting its community integration. This

RE: [SECURITY] Apache Tomcat and the hashtable collision DoS vulnerability

2011-12-29 Thread Luke Meyer
From: Mark Thomas While both POST-size-limiting and parameter-count-limiting are both reasonable mitigating procedures, would the use of a randomized-hash be something worth doing? I don't know. My instinct is that it wouldn't but I could be wrong. Referring to

[Tomcat Wiki] Update of FrontPage by KonstantinKolinko

2011-12-29 Thread Apache Wiki
Dear Wiki user, You have subscribed to a wiki page or wiki category on Tomcat Wiki for change notification. The FrontPage page has been changed by KonstantinKolinko: http://wiki.apache.org/tomcat/FrontPage?action=diffrev1=29rev2=30 Comment: Protect the page + #acl

Re: Improving wiki security

2011-12-29 Thread Konstantin Kolinko
2011/12/28 Mark Thomas ma...@apache.org: Given we see almost as many spam changes as valid ones, is it time for this: http://wiki.apache.org/general/OurWikiFarm#per_wiki_access_control_-_tighten_your_wiki_just_a_little.2C_benefit_just_a_lot -1. I do not see benefits from proposed change and I

Re: Improving wiki security

2011-12-29 Thread Mark Thomas
On 29/12/2011 18:00, Konstantin Kolinko wrote: 2011/12/28 Mark Thomas ma...@apache.org: Given we see almost as many spam changes as valid ones, is it time for this: http://wiki.apache.org/general/OurWikiFarm#per_wiki_access_control_-_tighten_your_wiki_just_a_little.2C_benefit_just_a_lot -1.

svn commit: r1225625 - in /tomcat/trunk/java/org/apache/naming: ./ factory/webservices/ resources/

2011-12-29 Thread markt
Author: markt Date: Thu Dec 29 19:35:29 2011 New Revision: 1225625 URL: http://svn.apache.org/viewvc?rev=1225625view=rev Log: UCDetector changes Modified: tomcat/trunk/java/org/apache/naming/ContextAccessController.java tomcat/trunk/java/org/apache/naming/NamingContext.java

Re: [SECURITY] Apache Tomcat and the hashtable collision DoS vulnerability

2011-12-29 Thread Mark Thomas
On 29/12/2011 15:44, Christopher Schultz wrote: Mark, On 12/28/11 5:28 PM, Mark Thomas wrote: Tomcat has implemented a work-around for this issue by providing a new option (maxParameterCount) to limit the number of parameters processed for a single request. This default limit is 1:

svn commit: r1225626 - in /tomcat/trunk/java/org/apache/naming/resources: ProxyDirContext.java ResourceCache.java WARDirContext.java

2011-12-29 Thread markt
Author: markt Date: Thu Dec 29 19:44:04 2011 New Revision: 1225626 URL: http://svn.apache.org/viewvc?rev=1225626view=rev Log: UCDetector changes. Make read-only fields final Modified: tomcat/trunk/java/org/apache/naming/resources/ProxyDirContext.java

Re: [SECURITY] Apache Tomcat and the hashtable collision DoS vulnerability

2011-12-29 Thread Konstantin Kolinko
2011/12/29 Christopher Schultz ch...@christopherschultz.net: Mark, On 12/28/11 5:28 PM, Mark Thomas wrote: Tomcat has implemented a work-around for this issue by providing a new option (maxParameterCount) to limit the number of parameters processed for a single request. This default limit is

svn commit: r1225627 - in /tomcat/trunk/java/org/apache/naming: ContextBindings.java resources/ProxyDirContext.java resources/ResourceAttributes.java resources/ResourceCache.java

2011-12-29 Thread markt
Author: markt Date: Thu Dec 29 19:44:49 2011 New Revision: 1225627 URL: http://svn.apache.org/viewvc?rev=1225627view=rev Log: UCDetector. Deprecate / add TODOs to currently unused code Modified: tomcat/trunk/java/org/apache/naming/ContextBindings.java

svn commit: r1225628 - in /tomcat/trunk/java/org/apache/naming: ContextBindings.java resources/ProxyDirContext.java resources/ResourceAttributes.java resources/ResourceCache.java

2011-12-29 Thread markt
Author: markt Date: Thu Dec 29 19:45:32 2011 New Revision: 1225628 URL: http://svn.apache.org/viewvc?rev=1225628view=rev Log: Remove unused code Modified: tomcat/trunk/java/org/apache/naming/ContextBindings.java tomcat/trunk/java/org/apache/naming/resources/ProxyDirContext.java

svn commit: r1225629 - in /tomcat/trunk: build.properties.default build.xml

2011-12-29 Thread markt
Author: markt Date: Thu Dec 29 19:45:58 2011 New Revision: 1225629 URL: http://svn.apache.org/viewvc?rev=1225629view=rev Log: Make frequently failing test disabled by default until we can figure out what is going wrong Modified: tomcat/trunk/build.properties.default

svn commit: r1225631 - in /tomcat/tc7.0.x/trunk: ./ java/org/apache/naming/ java/org/apache/naming/resources/

2011-12-29 Thread markt
Author: markt Date: Thu Dec 29 19:49:28 2011 New Revision: 1225631 URL: http://svn.apache.org/viewvc?rev=1225631view=rev Log: UCDectetor: Deprecate / add TODOs to currently unused code Modified: tomcat/tc7.0.x/trunk/ (props changed)

svn commit: r1225632 - in /tomcat/tc7.0.x/trunk: ./ build.properties.default build.xml

2011-12-29 Thread markt
Author: markt Date: Thu Dec 29 19:51:43 2011 New Revision: 1225632 URL: http://svn.apache.org/viewvc?rev=1225632view=rev Log: Disable Comet tests by default for now Modified: tomcat/tc7.0.x/trunk/ (props changed) tomcat/tc7.0.x/trunk/build.properties.default

svn commit: r1225634 - /tomcat/trunk/java/org/apache/catalina/startup/ContextConfig.java

2011-12-29 Thread markt
Author: markt Date: Thu Dec 29 20:06:45 2011 New Revision: 1225634 URL: http://svn.apache.org/viewvc?rev=1225634view=rev Log: Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=52326 Log all classloading errors during HandlesTypes processing at debug Modified:

svn commit: r1225635 - in /tomcat/tc7.0.x/trunk: ./ java/org/apache/catalina/startup/ContextConfig.java webapps/docs/changelog.xml

2011-12-29 Thread markt
Author: markt Date: Thu Dec 29 20:09:03 2011 New Revision: 1225635 URL: http://svn.apache.org/viewvc?rev=1225635view=rev Log: Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=52326 Reduce log level for class loading errors during @HandlesTypes processing to debug Modified:

DO NOT REPLY [Bug 52326] Lower log level for failed class loading

2011-12-29 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=52326 Mark Thomas ma...@apache.org changed: What|Removed |Added Status|NEW |RESOLVED

DO NOT REPLY [Bug 52381] Please add OSGi metadata

2011-12-29 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=52381 Mark Thomas ma...@apache.org changed: What|Removed |Added Severity|normal |enhancement ---

Re: [SECURITY] Apache Tomcat and the hashtable collision DoS vulnerability

2011-12-29 Thread Christopher Schultz
Luke, On 12/29/11 12:35 PM, Luke Meyer wrote: From: Mark Thomas While both POST-size-limiting and parameter-count-limiting are both reasonable mitigating procedures, would the use of a randomized-hash be something worth doing? I don't know. My instinct is that it wouldn't but I could be

RE: Improving wiki security

2011-12-29 Thread Caldarale, Charles R
From: Konstantin Kolinko [mailto:knst.koli...@gmail.com] Subject: Re: Improving wiki security I propose to drop the sites using Tomcat list. I have to respectfully disagree with removing that list - I think it serves a significant purpose as Tomcat marketing material. I would add a caveat

Re: unit test debugging under Netbeans

2011-12-29 Thread Brian Burch
On 28/12/11 22:27, Konstantin Kolinko wrote: Thanks very much for your time and valuable thoughts, Konstantin. 2011/12/28 Brian Burchbr...@pingtoo.com: snip/ However, I was a bit surprised to discover I couldn't simply wire up netbeans to compile, run and debug any of the tomcat unit tests!