From daba3ce52b55da4a7ddec2cef8f2d2a21f712f74 Mon Sep 17 00:00:00 2001 From: Andy Wilkinson Date: Fri, 10 Mar 2023 16:28:21 +0000 Subject: [PATCH] Upgrade to Tomcat 10.1.7 Closes gh-34582 --- gradle.properties | 2 +- .../boot/autoconfigure/web/ServerProperties.java | 7 ++++++- .../TomcatWebServerFactoryCustomizerTests.java | 7 ++++++- .../boot/web/embedded/jetty/JasperInitializer.java | 6 +++--- .../boot/web/embedded/tomcat/TldPatterns.java | 10 ++++++++-- 5 files changed, 24 insertions(+), 8 deletions(-) diff --git a/gradle.properties b/gradle.properties index 5b5ccc05f4a..8b61614f9b0 100644 --- a/gradle.properties +++ b/gradle.properties @@ -5,7 +5,7 @@ org.gradle.parallel=true org.gradle.jvmargs=-Xmx2g -Dfile.encoding=UTF-8 kotlinVersion=1.8.10 -tomcatVersion=10.1.5 +tomcatVersion=10.1.7 nativeBuildToolsVersion=0.9.20 kotlin.stdlib.default.dependency=false diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java index 201d516c50b..1e8c85f381e 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java @@ -989,8 +989,13 @@ public class ServerProperties { + "192\\.168\\.\\d{1,3}\\.\\d{1,3}|" // 192.168/16 + "169\\.254\\.\\d{1,3}\\.\\d{1,3}|" // 169.254/16 + "127\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}|" // 127/8 + + "100\\.6[4-9]{1}\\.\\d{1,3}\\.\\d{1,3}|" // 100.64.0.0/10 + + "100\\.[7-9]{1}\\d{1}\\.\\d{1,3}\\.\\d{1,3}|" // 100.64.0.0/10 + + "100\\.1[0-1]{1}\\d{1}\\.\\d{1,3}\\.\\d{1,3}|" // 100.64.0.0/10 + + "100\\.12[0-7]{1}\\.\\d{1,3}\\.\\d{1,3}|" // 100.64.0.0/10 + "172\\.1[6-9]{1}\\.\\d{1,3}\\.\\d{1,3}|" // 172.16/12 - + "172\\.2[0-9]{1}\\.\\d{1,3}\\.\\d{1,3}|172\\.3[0-1]{1}\\.\\d{1,3}\\.\\d{1,3}|" // + + "172\\.2[0-9]{1}\\.\\d{1,3}\\.\\d{1,3}|" // 172.16/12 + + "172\\.3[0-1]{1}\\.\\d{1,3}\\.\\d{1,3}|" // 172.16/12 + "0:0:0:0:0:0:0:1|::1"; /** diff --git a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java index d0b9497063c..c4c06168f63 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java @@ -412,8 +412,13 @@ class TomcatWebServerFactoryCustomizerTests { + "192\\.168\\.\\d{1,3}\\.\\d{1,3}|" // 192.168/16 + "169\\.254\\.\\d{1,3}\\.\\d{1,3}|" // 169.254/16 + "127\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}|" // 127/8 + + "100\\.6[4-9]{1}\\.\\d{1,3}\\.\\d{1,3}|" // 100.64.0.0/10 + + "100\\.[7-9]{1}\\d{1}\\.\\d{1,3}\\.\\d{1,3}|" // 100.64.0.0/10 + + "100\\.1[0-1]{1}\\d{1}\\.\\d{1,3}\\.\\d{1,3}|" // 100.64.0.0/10 + + "100\\.12[0-7]{1}\\.\\d{1,3}\\.\\d{1,3}|" // 100.64.0.0/10 + "172\\.1[6-9]{1}\\.\\d{1,3}\\.\\d{1,3}|" // 172.16/12 - + "172\\.2[0-9]{1}\\.\\d{1,3}\\.\\d{1,3}|172\\.3[0-1]{1}\\.\\d{1,3}\\.\\d{1,3}|" // + + "172\\.2[0-9]{1}\\.\\d{1,3}\\.\\d{1,3}|" // 172.16/12 + + "172\\.3[0-1]{1}\\.\\d{1,3}\\.\\d{1,3}|" // 172.16/12 + "0:0:0:0:0:0:0:1|::1"; assertThat(remoteIpValve.getInternalProxies()).isEqualTo(expectedInternalProxies); } diff --git a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/jetty/JasperInitializer.java b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/jetty/JasperInitializer.java index 56ad824b31a..74b6b5a7561 100644 --- a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/jetty/JasperInitializer.java +++ b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/jetty/JasperInitializer.java @@ -1,5 +1,5 @@ /* - * Copyright 2012-2022 the original author or authors. + * Copyright 2012-2023 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -24,7 +24,6 @@ import java.net.URLStreamHandler; import java.net.URLStreamHandlerFactory; import jakarta.servlet.ServletContainerInitializer; -import org.apache.catalina.webresources.TomcatURLStreamHandlerFactory; import org.eclipse.jetty.util.component.AbstractLifeCycle; import org.eclipse.jetty.webapp.WebAppContext; @@ -64,13 +63,14 @@ class JasperInitializer extends AbstractLifeCycle { } @Override + @SuppressWarnings("deprecation") protected void doStart() throws Exception { if (this.initializer == null) { return; } if (ClassUtils.isPresent("org.apache.catalina.webresources.TomcatURLStreamHandlerFactory", getClass().getClassLoader())) { - TomcatURLStreamHandlerFactory.register(); + org.apache.catalina.webresources.TomcatURLStreamHandlerFactory.register(); } else { try { diff --git a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TldPatterns.java b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TldPatterns.java index 4f37e906394..6f58708f464 100644 --- a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TldPatterns.java +++ b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TldPatterns.java @@ -35,10 +35,12 @@ final class TldPatterns { Set skipPatterns = new LinkedHashSet<>(); skipPatterns.add("annotations-api.jar"); skipPatterns.add("ant-junit*.jar"); - skipPatterns.add("ant-launcher.jar"); - skipPatterns.add("ant.jar"); + skipPatterns.add("ant-launcher*.jar"); + skipPatterns.add("ant*.jar"); skipPatterns.add("asm-*.jar"); skipPatterns.add("aspectj*.jar"); + skipPatterns.add("bcel*.jar"); + skipPatterns.add("biz.aQute.bnd*.jar"); skipPatterns.add("bootstrap.jar"); skipPatterns.add("catalina-ant.jar"); skipPatterns.add("catalina-ha.jar"); @@ -51,6 +53,7 @@ final class TldPatterns { skipPatterns.add("commons-beanutils*.jar"); skipPatterns.add("commons-codec*.jar"); skipPatterns.add("commons-collections*.jar"); + skipPatterns.add("commons-compress*.jar"); skipPatterns.add("commons-daemon.jar"); skipPatterns.add("commons-dbcp*.jar"); skipPatterns.add("commons-digester*.jar"); @@ -93,6 +96,8 @@ final class TldPatterns { skipPatterns.add("mail*.jar"); skipPatterns.add("objenesis-*.jar"); skipPatterns.add("oraclepki.jar"); + skipPatterns.add("org.hamcrest.core_*.jar"); + skipPatterns.add("org.junit_*.jar"); skipPatterns.add("oro-*.jar"); skipPatterns.add("servlet-api-*.jar"); skipPatterns.add("servlet-api.jar"); @@ -111,6 +116,7 @@ final class TldPatterns { skipPatterns.add("tomcat-util.jar"); skipPatterns.add("tomcat-websocket.jar"); skipPatterns.add("tools.jar"); + skipPatterns.add("unboundid-ldapsdk-*.jar"); skipPatterns.add("websocket-api.jar"); skipPatterns.add("websocket-client-api.jar"); skipPatterns.add("wsdl4j*.jar");