RE: Contexts: can there be a hierarchy?

2018-08-22 Thread Caldarale, Charles R
> From: James H. H. Lampert [mailto:jam...@touchtonecorp.com] > Subject: Contexts: can there be a hierarchy? > Suppose we have a Tomcat 8 server Let's hope that's Tomcat 8.5, since 8.0 has reached EOL. > Is there a way to set up contexts in a hierarchy, such that requests for > "https://xyz.ex

Contexts: can there be a hierarchy?

2018-08-22 Thread James H. H. Lampert
Ladies and Gentlemen: Suppose we have a Tomcat 8 server, "https://xyz.example"; for argument's sake, running on Debian (with all of the weird, decentralized file locations that entails). Is there a way to set up contexts in a hierarchy, such that requests for "https://xyz.example/foo/ham,";

Re: how to prevent user access to JSP pages?

2018-08-22 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cris, On 8/22/18 11:22 AM, Berneburg, Cris J. - US wrote: > Chris > > [combining messages] > > cjb> Am I mistaken, but does vulnerability scanning software cjb> > seem to feed on that sort of thing? > > cs> Most vulnerability scanners just try to

Re: Tomcat service gets stuck

2018-08-22 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Bab, On 8/22/18 9:49 AM, Bab Alemzadeh wrote: > I am using Windows Server 2008/2012, datacenter edition. We have > installed: KB4338815. > > So the task gets stuck, it is probably not consuming any CPU. But > the memory usage gets stuck. I enclosed

Re: how to prevent user access to JSP pages?

2018-08-22 Thread David Wall
Has any decision been made on how the original poster will do this? As I read through the various responses, while you can always argue certain structures are better, it's simply not true that if you create messy/insecure JSPs, you'll somehow create clean/secure servlets.  Any error you would

Re: how to prevent user access to JSP pages?

2018-08-22 Thread Terence M. Bandoian
On 8/21/2018 11:44 AM, Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cris, On 8/20/18 1:31 PM, Berneburg, Cris J. - US wrote: Hi Mark Thanks for taking the time to reply. :-) cjb> Due to security concerns and general fussiness on my part, I'd like cjb> to preven

Re: how to prevent user access to JSP pages?

2018-08-22 Thread Woonsan Ko
On Wed, Aug 22, 2018 at 11:44 AM, Berneburg, Cris J. - US wrote: > Hi Woonsan > > cjb> I'd like to prevent users from requesting JSP pages directly > > cjb> a. [...] adding a for each folder. > > cjb> b. [...] JSP files under the WEB-INF folder. > > wk> c. Implement a servlet filter which is mapp

RE: how to prevent user access to JSP pages?

2018-08-22 Thread Berneburg, Cris J. - US
Hi Woonsan cjb> I'd like to prevent users from requesting JSP pages directly cjb> a. [...] adding a for each folder. cjb> b. [...] JSP files under the WEB-INF folder. wk> c. Implement a servlet filter which is mapped to /* with wk> dispatcher options: REQUEST, INCLUDE, FORWARD. The filter may

RE: how to prevent user access to JSP pages?

2018-08-22 Thread Berneburg, Cris J. - US
Chris [combining messages] cjb> Am I mistaken, but does vulnerability scanning software cjb> seem to feed on that sort of thing? cs> Most vulnerability scanners just try to detect your server's cs> version and look-up any publicly-reported vulnerabilities in cs> e.g. NVD. They are really stupid

RE: Tomcat service gets stuck

2018-08-22 Thread Louis Zipes
Hi Bab, I assume you mean it is getting stuck with a Windows service or not true? Can you please share logs with the specific error you are seeing. Thanks, Louis From: Bab Alemzadeh [mailto:b...@eyequestion.nl] Sent: Wednesday, August 22, 2018 9:16 AM To: users@tomcat.apache.org Subject: Tomcat

Re: Tomcat service gets stuck

2018-08-22 Thread Bab Alemzadeh
Hi Chris, I am using Windows Server 2008/2012, datacenter edition. We have installed: KB4338815. So the task gets stuck, it is probably not consuming any CPU. But the memory usage gets stuck. I enclosed the screenshot, this screenshot is AFTER the tomcat service was stopped. The memory usage is s

Re: Tomcat service gets stuck

2018-08-22 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Bab, On 8/22/18 9:15 AM, Bab Alemzadeh wrote: > I have a problem with tomcat 8.5.20 and 8.5.32. When I stop the > service the PROCESS gets stuck on a specific memory usage. Can you explain this a little more? What does "stuck on a specific memory u

Tomcat service gets stuck

2018-08-22 Thread Bab Alemzadeh
Hi, I have a problem with tomcat 8.5.20 and 8.5.32. When I stop the service the PROCESS gets stuck on a specific memory usage. I cannot even end the task, I have to restart the server. If I just restart the service, it will create an additional process. The other process will remain stuck at the e

Re: Anything changed with Tomcat 9.0.11 and JSPs?

2018-08-22 Thread Francesco Chicchiriccò
On 2018/08/22 11:56:42, Mark Thomas wrote: > On 22/08/18 11:35, Francesco Chicchiriccò wrote: > > > > > > On 2018/08/22 09:48:36, Mark Thomas wrote: > >> On 22/08/18 10:13, Francesco Chicchiriccò wrote: > >>> Hi all, > >>> after upgrading from Tomcat 9.0.10 to Tomcat 9.0.11, my application's

Re: Anything changed with Tomcat 9.0.11 and JSPs?

2018-08-22 Thread Mark Thomas
On 22/08/18 11:35, Francesco Chicchiriccò wrote: > > > On 2018/08/22 09:48:36, Mark Thomas wrote: >> On 22/08/18 10:13, Francesco Chicchiriccò wrote: >>> Hi all, >>> after upgrading from Tomcat 9.0.10 to Tomcat 9.0.11, my application's >>> startup fails with error: >>> >>> GRAVE: Servlet.servi

Re: Anything changed with Tomcat 9.0.11 and JSPs?

2018-08-22 Thread Francesco Chicchiriccò
On 2018/08/22 09:48:36, Mark Thomas wrote: > On 22/08/18 10:13, Francesco Chicchiriccò wrote: > > Hi all, > > after upgrading from Tomcat 9.0.10 to Tomcat 9.0.11, my application's > > startup fails with error: > > > > GRAVE: Servlet.service() for servlet [jsp] in context with path [/XXX] >

Re: Anything changed with Tomcat 9.0.11 and JSPs?

2018-08-22 Thread Mark Thomas
On 22/08/18 10:13, Francesco Chicchiriccò wrote: > Hi all, > after upgrading from Tomcat 9.0.10 to Tomcat 9.0.11, my application's startup > fails with error: > > GRAVE: Servlet.service() for servlet [jsp] in context with path [/XXX] threw > exception [java.lang.NoClassDefFoundError: > org/ecli

Anything changed with Tomcat 9.0.11 and JSPs?

2018-08-22 Thread Francesco Chicchiriccò
Hi all, after upgrading from Tomcat 9.0.10 to Tomcat 9.0.11, my application's startup fails with error: GRAVE: Servlet.service() for servlet [jsp] in context with path [/XXX] threw exception [java.lang.NoClassDefFoundError: org/eclipse/jdt/internal/compiler/ast/RequiresStatement] with root caus