The Apache Tomcat Servlet/JSP Container

Apache Tomcat 7

Version 7.0.55, Jul 18 2014
Apache Logo


User Guide


Apache Tomcat Development


Tomcat 7.0.55 (violetagg)
fix 44312: Log an error if there is a conflict between Host and Alias names. Improve host management methods in Mapper to avoid occasionally removing a wrong host. Check that host management operations are performed on the host and not on an alias. (kkolinko)
fix 55282: Ensure that one and the same application listener is added only once when starting the web application. (violetagg)
add 56461: New failCtxIfServletStartFails attribute on Context and Host configuration to force the context startup to fail if a load-on-startup servlet fails its startup. (slaurent)
add 56526: Improved the StuckThreadDetectionValve to optionally interrupt stuck threads to attempt to unblock them. (slaurent)
fix 56545: Pre-load an additional class, the loading of which may otherwise be triggered by a web application which in turn would trigger an exception when running under a security manager. (kkolinko)
fix 56578: Correct regression in the fix for 56339 that prevented sessions from expiring when using clustering. (markt)
code 56588: Update deprecation of Context.addApplicationListener() methods according to changes in Tomcat 8. (kkolinko)
fix 56600: In WebdavServlet: Do not waste time generating response for broken PROPFIND request. (kkolinko)
fix Provide a better error message when asynchronous operations are not supported by a filter or servlet. Patch provided by Romain Manni-Bucau. (violetagg)
fix 56606: User entries in tomcat-users.xml file are recommended to use "username" attribute rather than legacy "name" attribute. Fix inconsistencies in Windows installer, examples. Update digester rules and documentation for MemoryRealm. (markt/kkolinko)
code 56611: Refactor code to remove inefficient calls to Method.isAnnotationPresent(). Based on a patch by Jian Mou. (markt/kkolinko)
fix 56653: Fix concurrency issue with lists of contexts in Mapper when stopping Contexts. (kkolinko)
fix 56657: When using parallel deployment, if the same session id matches different versions of a web application, prefer the latest version. Ensure that remapping selects the version that we expect. (kkolinko)
fix Assert that mapping result object is empty before performing mapping work in Mapper. (kkolinko)
fix 56658: Avoid delay between registrations of mappings for context and for its servlets. (kkolinko)
fix 56665: Correct the generation of the effective web.xml when elements contain an empty string as value. (violetagg)
fix 56666: When clearing the SSO cookie use the same values for domain, path, httpOnly and secure as were used to set the SSO cookie. (markt)
fix 56677: Ensure that HttpServletRequest.getServletContext() returns the correct value during a cross-context dispatch. (markt)
fix 56684: Ensure that Tomcat does not shut down if the socket waiting for the shutdown command experiences a SocketTimeoutException. (markt)
fix When the current PathInfo is modified as a result of dispatching a request, ensure that a call to HttpServletRequest.getPathTranslated() returns a value that is based on the modified PathInfo. (markt)
fix 56698: When persisting idle sessions, only persist newly idle sessions. Patch provided by Felix Schumacher. (markt)
fix 56710: Do not map requests to servlets when context is being reloaded. (kkolinko)
fix 56712: Fix session idle time calculations in PersistenceManager. (kkolinko)
fix 56717: Fix duplicate registration of MapperListener during repeated starts of embedded Tomcat. (kkolinko)
add 56724: Write an error message to Tomcat logs if container background thread is aborted unexpectedly. (kkolinko)
fix 56518: When using NIO, do not attempt to write to the socket if the thread is marked interrupted as this will lead to a connection limit leak. This fix was based on analysis of the issue by hanyong. (markt)
fix 56521: Re-use the asynchronous write buffer between writes to reduce allocation and GC overhead. Based on a patch by leonzhx. Also make the buffer size configurable and remove copying of data within buffer when the buffer is only partially written on a subsequent write. (markt)
fix Correct a copy/paste error and return a 500 response rather than a 400 response when an internal server error occurs on early stages of request processing. (markt)
code 56582: Use switch(actionCode) in processors instead of a chain of "elseif"s. (kkolinko)
fix If request contains an unrecognized Expect header, respond with error 417 (Expectation Failed), according to RFC2616 chapter 14.20. (markt)
fix When an error occurs after the response has been committed close the connection immediately rather than attempting to finish the response to make it easier for the client to differentiate between a complete response and one that failed part way though. (markt)
fix 56620: Avoid bogus access log entries when pausing the NIO HTTP connector and ensure that access log entries generated by error conditions use the correct request start time. (markt)
add Add a new limit, defaulting to 2MB, for the amount of data Tomcat will swallow for an aborted upload. (markt)
update Allow to configure maxSwallowSize attribute of an HTTP connector via JMX. (kkolinko)
fix 56661: Fix getLocalAddr() for AJP connectors. The complete fix is only available with a recent AJP forwarder like the forthcoming mod_jk 1.2.41. (rjung)
fix 56334#c15: Fix a regression in EL parsing when quoted string follows a whitespace. (kkolinko/markt)
fix 56543: Update to the Eclipse JDT Compiler 4.4. (violetagg)
fix 56561: Avoid NoSuchElementException while handling attributes with empty string value. (violetagg)
update 56581: If an error on a JSP page occurs when response has already been committed, do not clear the buffer of JspWriter, but flush it. It will make more clear where the error occurred. (kkolinko)
fix 56612: Correctly parse two consecutive escaped single quotes when used in UEL expression in a JSP. (markt)
update Move code that parses EL expressions within JSP template text from Parser to JspReader class for better performance. (kkolinko)
fix 56577: Improve the executor configuration used for the callbacks associated with asynchronous writes. (markt)
Web applications
fix Set the path for cookies created by the examples web application so they only returned to the examples application. This reduces the opportunity for using such cookies for malicious purposes should the advice to remove the examples web application from security sensitive systems be ignored. (markt/kkolinko)
fix Attempt to obfuscate session cookie values associated with other web applications when viewing HTTP request headers with the Request Header example from the examples web application. This reduces the opportunity to use this example for malicious purposes should the advice to remove the examples web application from security sensitive systems be ignored. (markt)
update Update optional Checkstyle library to 5.7. (kkolinko)
fix 56685: Add quotes necessary for to work correctly on Solaris. Based on a suggesiton by lfuka. (markt)
update 56596: Update to Tomcat Native Library version 1.1.31 to pick up the Windows binaries that are based on OpenSSL 1.0.1h. (markt)
Tomcat 7.0.54 (violetagg)released 2014-05-22
fix Fix custom UTF-8 decoder so that a byte of value 0xC1 is always rejected immediately as it is never valid in a UTF-8 byte sequence. Update UTF-8 decoder tests to account for UTF-8 decoding improvements in Java 8. The custom UTF-8 decoder is still required due to bugs in the UTF-8 decoder provided by Java. Java 8's decoder is better than Java 7's but it is still buggy. (markt)
fix 56027: Add more options for managing FIPS mode in the AprLifecycleListener. (schultz/kkolinko)
fix 56321: When a WAR is modified, undeploy the web application before deleting any expanded directory as the undeploy process may refer to classes that need to be loaded from the expanded directory. If the expanded directory is deleted first, any attempt to load a new class during undeploy will fail. (markt)
fix 56339: Avoid an infinite loop if an application calls session.invalidate() from the session destroyed event for that session. (markt)
update 56365: Simplify file name pattern matching code in StandardJarScanner. Ignore leading and trailing whitespace and empty strings when configuring patterns. Improve documentation. (kkolinko)
fix 56369: Ensure that removing an MBean notification listener reverts all the operations performed when adding an MBean notification listener. (markt)
add 56382: Information about finished deployment and its execution time is added to the log files. Patch is provided by Danila Galimov. (violetagg)
add 56383: Properties for disabling server information and error report are added to the org.apache.catalina.valves.ErrorReportValve. Based on the patch provided by Nick Bunn. (violetagg/kkolinko)
fix Fix CVE-2014-0119: Only create XML parsing objects if required and fix associated potential memory leak in the default Servlet. Extend XML factory, parser etc. memory leak protection to cover some additional locations where, theoretically, a memory leak could occur. Ensure that a TLD parser obtained from the cache has the correct value of blockExternal. (markt)
fix Modify generic exception handling so that StackOverflowError is not treated as a fatal error and can handled and/or logged as required. (markt)
fix 56409: Avoid StackOverflowError on non-Windows systems if a file named \ is encountered when scanning for TLDs. (markt)
add 56430: Extend checks for suspicious URL patterns to include patterns of the form *.a.b which are not valid patterns for extension mappings. (markt)
fix 56441: Raise the visibility of exceptions thrown when a problem is encountered calling a getter or setter on a component attribute. The logging level is raised from debug to warning. (markt)
fix 56451: Make resources accessed via a context alias accessible via JNDI in the same way standard resources are available. (markt)
add 56463: Property for disabling server information is added to the DefaultServlet. Server information is presented in the response sent to the client when directory listings is enabled. (violetagg)
add Add the org.apache.naming package to the packages requiring code to have the defineClassInPackage permission when running under a security manager. (markt)
add Add the org.apache.naming.resources package to the packages requiring code to have the accessClassInPackage permission when running under a security manager. (markt)
fix Make the naming context tokens for containers more robust. Require RuntimePermission when introducing a new token. (markt/kkolinko)
fix 56472: Allow NamingContextListener to clean up on stop if its start failed. (kkolinko)
add 56492: Avoid eclipse debugger pausing on uncaught exceptions when tomcat renews its threads. (slaurent)
fix Minor fixes to ThreadLocalLeakPreventionListener. Do not trigger threads renewal for failed contexts. Do not ignore threadRenewalDelay setting. Improve documentation. (kkolinko)
fix Correct regression introduced in r797162 that broke authentication of users when using the JAASMemoryLoginModule. (markt)
fix 56501: HttpServletRequest.getContextPath() should return the undecoded context path used by the user agent. (markt)
fix 56523: When using SPNEGO authentication, log the exceptions associated with failed user logins at debug level rather than error level. (markt)
fix 56536: Ensure that HttpSessionBindingListener.valueUnbound() uses the correct class loader when the SingleSignOn valve is used. (markt)
add 56399: Assert that both Coyote and Catalina request objects have been properly recycled. (kkolinko)
fix 56416: Correct documentation for default value of socket linger for the AJP and HTTP connectors. (markt)
fix 56334: Fix a regression in the handling of back-slash escaping introduced by the fix for 55735. (markt/kkolinko)
fix 56425: Improve method matching for EL expressions. When looking for matching methods, an exact match between parameter types is preferred followed by an assignable match followed by a coercible match. (markt)
fix Correct the handling of back-slash escaping in the EL parser and no longer require that \$ or \# must be followed by { in order for the back-slash escaping to take effect. (markt)
fix 56529: Avoid NoSuchElementException while handling attributes with empty string value in custom tags. Patch provided by Hariprasad Manchi. (violetagg)
fix Remove cluster and replicationValve from cluster manager template. These instance are not necessary to template. (kfujino)
fix Add support for cross context session replication to org.apache.catalina.ha.session.BackupManager. (kfujino)
fix Remove the unnecessary cross context check. It does not matter whether the context that is referenced by other context is set to crossContext=true. The context that refers to the different context must be set to crossContext=true. (kfujino)
code Move to org.apache.catalina.ha.session.ClusterManagerBase common logics of org.apache.catalina.ha.session.BackupManager and org.apache.catalina.ha.session.DeltaManager. (kfujino)
code Simplify the code of o.a.c.ha.tcp.SimpleTcpCluster. In order to add or remove cluster valve to Container, use pipeline instead of IntrospectionUtils. (kfujino)
fix There is no need to set cluster instance when SimpleTcpCluster.unregisterClusterValve is called. Set null than cluster instance for cleanup. (kfujino)
code Backport refactoring of AbstractReplicatedMap to implement Map rather than extend ConcurrentHashMap to enable Tomcat 7 to be built with Java 8. (markt)
fix 56343: Avoid a NPE if Tomcat's Java WebSocket 1.0 implementation is used with the Java WebSocket 1.0 API JAR from the reference implementation. (markt)
fix Increase the default maximum size of the executor used by the WebSocket implementation for call backs associated with asynchronous writes from 10 to 200. (markt)
add Add a warning if the thread group created for WebSocket asynchronous write call backs can not be destroyed when the web application is stopped. (markt)
fix Ensure that threads created to support WebSocket clients are stopped when no longer required. This will happen automatically for WebSocket client connections initiated by web applications but stand alone clients must call WsWebSocketContainer.destroy(). (markt)
fix 56449: When creating a new session, add the message handlers to the session before calling Endpoint.onOpen() so the message handlers are in place should the onOpen() method trigger the sending of any messages. (markt)
fix 56458: Report WebSocket sessions that are created over secure connections as secure rather than as not secure. (markt)
fix Stop threads used for secure WebSocket client connections when they are no longer required and give them better names for easier debugging while they are running. (markt)
Web applications
fix Add Support for copyXML attribute of Host to Host Manager. (kfujino)
fix Ensure that "name" request parameter is used as a application base of host if "webapps" request parameter is not set when adding host in HostManager Application. (kfujino)
fix Correct documentation on Windows service options, aligning it with Apache Commons Daemon documentation. (kkolinko)
update 55215: Improve log4j configuration example. Clarify access logging documentation. Based on patches provided by Brian Burch. (kkolinko)
update 55383: Backport improved HTML markup for tables and code fragments from Tomcat 8 documentation. (kkolinko)
fix 56418: Ensure that the Manager web application does not report success for a web application deployment that fails. (slaurent)
fix Fix target and rel attributes on links in documentation. They were lost during XSLT transformation. (kkolinko)
update Improve valves documentation. Split valves into groups. (kkolinko)
fix Align DisplayName of Tomcat installed by service.bat with one installed by the *.exe installer. Print a warning in case if neither server nor client jvm is found by service.bat. (kkolinko)
update 56363: Update to version 1.1.30 of Tomcat Native library. (schultz)
update Update package renamed Apache Commons BCEL to r1593495 to pick up some additional changes for Java 7 support and some code clean up. (markt)
add In tests: allow to configure directory where JUnit reports and access log are written to. (kkolinko)
Tomcat 7.0.53 (violetagg)released 2014-03-30
add Make it easier for applications embedding and/or extending Tomcat to modify the javaseClassLoader attribute of the WebappClassLoader. (markt)
fix Improve the robustness of web application undeployment based on some code analysis triggered by the report for 54315. (markt)
fix 56219: Improve merging process for web.xml files to take account of the elements and attributes supported by the Servlet version of the merged file. (markt)
fix 56190: The response should be closed (i.e. no further output is permitted) when a call to AsyncContext.complete() takes effect. (markt)
fix 56236: Enable Tomcat to work with alternative Servlet and JSP API JARs that package the XML schemas in such as way as to require a dependency on the JSP API before enabling validation for web.xml. Tomcat has no such dependency. (markt)
fix 56246: Fix NullPointerException in MemoryRealm when authenticating an unknown user. (markt)
fix 56248: Allow the deployer to update an existing WAR file without undeploying the existing application if the update flag is set. This allows any existing custom context.xml for the application to be retained. To update an application and remove any existing context.xml simply undeploy the old version of the application before deploying the new version. (markt)
fix Fix CVE-2014-0096: Redefine the globalXsltFile initialisation parameter of the DefaultServlet as relative to CATALINA_BASE/conf or CATALINA_HOME/conf. Prevent user supplied XSLTs used by the DefaultServlet from defining external entities. (markt)
add Add a work around for validating XML documents (often TLDs) that use just the file name to refer to refer to the JavaEE schema on which they are based. (markt)
fix 56293: Cache resources loaded by the class loader from /META-INF/services/ for better performance for repeated look ups. (markt)
fix 53119: Make sure the NIO AJP output buffer is cleared on any error to prevent any possible overflow if it is written to again before the connection is closed. This extends the original fix for the APR/native output buffer to the NIO connector. (kkolinko)
fix 56172: Avoid possible request corruption when using the AJP NIO connector and a request is sent using more than one AJP message. Patch provided by Amund Elstad. (markt)
fix 56213: Reduce garbage collection when the NIO connector is under heavy load. (markt)
fix Fix CVE-2014-0075: Improve processing of chuck size from chunked headers. Avoid overflow and use a bit shift instead of a multiplication as it is marginally faster. (markt/kkolinko)
fix Fix CVE-2014-0099: Fix possible overflow when parsing long values from a byte array. (markt)
fix 54475: Add Java 8 support to SMAP generation for JSPs. Patch by Robbie Gibson. (markt)
fix 55483: Improve handing of overloaded methods and constructors in expression language implementation. (markt)
fix 56208: Restore the validateXml option to Jasper that was previously renamed validateTld. Both options are now supported. validateXml controls the validation of web.xml files when Jasper parses them and validateTld controls the validation of *.tld files when Jasper parses them. (markt)
fix 56223: Throw an IllegalStateException if a call is made to ServletContext.setInitParameter() after the ServletContext has been initialized. (markt)
fix 56265: Do not escape values of dynamic tag attributes containing EL expressions. (kkolinko)
fix Make the default compiler source and target versions for JSPs Java 6 since Tomcat 7 requires Java 6 as a minimum. (markt)
update 56283: Update to the Eclipse JDT Compiler P20140317-1600 which adds support for Java 8 syntax to JSPs. Add support for value "1.8" for the compilerSourceVM and compilerTargetVM options. (markt)
fix Avoid a possible deadlock when one thread is shutting down a connection while another thread is trying to write to it. (markt)
fix Call onError if an exception is thrown calling onClose when closing a session. (remm)
Web applications
code In the documentation: add support for several documentation tags from Tomcat 8. Such as <version-major/>. (kkolinko)
add 56093: Add the SSL Valve to the documentation web application. (markt)
fix 56217: Improve readability by using left alignment for the table cell containing the request information on the Manager application status page. (markt)
fix Fixed java.lang.NegativeArraySizeException when using "Expire sessions" command in the manager web application on a context where the session timeout is disabled. (kfujino)
fix Add support for LAST_ACCESS_AT_START system property to Manager web application. (kfujino)
fix Add definition of org.apache.catalina.ant.FindLeaksTask. (kfujino)
fix 56273: If the Manager web application does not perform an operation because the web application is already being serviced, report an error rather than reporting success. (markt)
fix 56304: Add a note to the documentation about not using WebSocket with BIO HTTP in production. (markt)
fix 56143: Improve service.bat so that it can be launched from a non-UAC console. This includes using a single call to tomcat7.exe to install the Windows service rather than three calls, and using command line arguments instead of environment variables to pass the settings. (markt/kkolinko)
fix Fix regression in 7.0.52: when using service.bat install to install the service the values for --StdOutput, --StdError options were passed as blank instead of "auto". (kkolinko)
fix Align options between service.bat and exe Windows installer. For service.bat the changes are in --Classpath, --DisplayName, --StartPath, --StopPath. For exe installer the changes are in --JvmMs, --JvmMx options, which are now 128 Mb and 256 Mb respectively instead of being empty. Explicitly specify --LogPath path when uninstalling Windows service, avoiding default value for that option. (kkolinko)
code Simplify Windows *.bat files: remove %OS% checks, as java 6 does not run on ancient non-NT operating systems. (kkolinko)
fix 56137: Explicitly use the BIO connector in the SSL example in server.xml so it doesn't break if APR is enabled. (markt)
fix 56139: Avoid a web application class loader leak in some unit tests when running on Windows. (markt)
fix Correct build script to avoid building JARs with empty packages. (markt)
add Allow to limit JUnit test run to a number of selected test case methods. (kkolinko)
fix 56189: Remove used file cpappend.bat from the distribution. (markt)
Tomcat 7.0.52 (violetagg)released 2014-02-17
fix Generate a valid root element for the effective web.xml for a web application for all supported versions of web.xml. (markt)
code Pull up SocketWrapper to AbstractProcessor. (markt)
fix In some circumstances asynchronous requests could time out too soon. (markt)
Tomcat 7.0.51 (violetagg)not released
fix 55287: ServletContainerInitializer defined in the container may not be found. (markt/jboynes)
fix 55855: Provide a per Context option (containerSciFilter) to exclude container SCIs. (markt)
fix 55937: When deploying applications, treat a context path of /ROOT as equivalent to /. (markt)
fix 55943: Improve the implementation of the class loader check that prevents web applications from trying to override J2SE implementation classes. As part of this fix, refactor the way a null parent class loader is handled which enables a number of null checks and object creation calls to be removed. (markt)
fix 55958: Differentiate between foo.war the WAR file and foo.war the directory. (markt)
fix 55960: Improve the single sign on (SSO) unit tests. Patch provided by Brian Burch. (markt)
fix 55974: Retain order when reporting errors and warnings while parsing XML configuration files. (markt)
fix 56013: Fix issue with SPNEGO authentication when using IBM JREs. IBM JREs only understand the option of infinite lifetime for Kerberos credentials. Based on a patch provided by Arunav Sanyal. (markt)
fix 56016: When loading resources for XML schema validation, take account of the possibility that servlet-api.jar and jsp-api.jar may not be loaded by the same class loader. Patch by Juan Carlos Estibariz. (markt)
fix 56025: When creating a WebSocket connection, always call ServerEndpointConfig.Configurator.getNegotiatedSubprotocol() and always create the EndPoint instance after calling ServerEndpointConfig.Configurator.modifyHandshake(). (markt)
fix 56032: Ensure that the WebSocket connection is closed after an IO error or an interrupt while sending a WebSocket message. (markt)
fix 56042: If a request in async mode has an error but has already been dispatched don't generate an error page in the ErrorReportValve so the dispatch target can handle it. (markt)
fix Add missing javax.annotation.sql.* classes to annotations-api.jar. (markt)
fix The type of logger attribute of Context MBean should be not org.apache.commons.logging.Log but org.apache.juli.logging.Log. (kfujino)
fix 56082: Fix a concurrency bug in JULI's LogManager implementation. (markt)
fix 56096: When the attribute rmiBindAddress of the JMX Remote Lifecycle Listener is specified it's value will be used when constructing the address of a JMX API connector server. Patch is provided by Jim Talbut. (violetagg)
fix When environment entry with one and the same name is defined in the web deployment descriptor and with annotation then the one specified in the web deployment descriptor is with priority. (violetagg)
fix Change default value of xmlBlockExternal attribute of Context. It is true now. (kkolinko)
fix Avoid possible NPE if a content type is specified without a character set. (markt)
fix 55956: Make the forwarded remote IP address available to the Connectors via a request attribute. (markt)
fix 55976: Fix sendfile support for the HTTP NIO connector. (markt)
fix 55996: Ensure Async requests timeout correctly when using the NIO HTTP connector. (markt)
add 56021: Make it possible to use the Windows-MY key store with the BIO and NIO connectors for SSL configuration. It requires a keystoreFile="" keystoreType="Windows-My" to be set on the connector. Based on a patch provided by Asanka. (markt)
fix Correct a regression in the XML refactoring that meant that errors in TLD files were swallowed. (markt)
fix 55671: Correct typo in the log message for a wrong value of genStringAsCharArray init-param of JspServlet. This parameter had a different name in Tomcat 6. (kkolinko)
fix 55973: Fix processing of XML schemas when validation is enabled in Jasper. (kkolinko)
fix 56010: Don't throw an IllegalArgumentException when JspFactory.getPageContext is used with JspWriter.DEFAULT_BUFFER. Based on a patch by Eugene Chung. (markt)
fix 56012: When using the extends attribute of the page directive do not import the super class if it is in an unnamed package as imports from unnamed packages are now explicitly illegal. (markt)
fix 56029: A regression in the fix for 55198 meant that when EL containing a ternary expression was used in an attribute a compilation error would occur for some expressions. (markt)
fix Correct several errors in jspxml Schema and DTD. (kkolinko)
fix Change default value of the blockExternal attribute of JspC task. The default value is true. Add support for -no-blockExternal switch when JspC is run as a standalone application. (kkolinko)
code Simplify the code of o.a.c.ha.tcp.SimpleTcpCluster.createManager(String). Remove unnecessary class cast. (kfujino)
fix Do not return an empty string for the Sec-WebSocket-Protocol HTTP header when no sub-protocol has been requested or no sub-protocol could be agreed as RFC6455 requires that no Sec-WebSocket-Protocol header is returned in this case. (markt)
Web applications
fix Add index.xhtml to the welcome files list for the examples web application. (kkolinko)
fix Clarify that the connectionTimeout may also be used as the read timeout when reading a request body (if any) in the documentation web application. (markt)
fix Clarify the behaviour of the maxConnections attribute for a connector in the documentation web application. (markt)
fix 55888: Update the documentation web application to make it clearer that a Container may define no more than one Realm. (markt)
fix 55956: Where available, displayed the forwarded remote IP address available on the status page of the Manager web application. (markt)
fix Correct links to the Tomcat mailing lists in the ROOT web application. (kkolinko)
fix In Manager web application improve handling of file upload errors. Display a message instead of error 500 page. Simplify parts handling code, as it is known that Tomcat takes care of them when recycling a request. (kkolinko)
fix 55166, 56045: Copy the XML schemas used for validation that are packaged in jsp-api.jar to servlet-api.jar so that an embedded Tomcat instance can start without Jasper being available. This also enables validation to work without Jasper being available. (markt/kkolinko)
fix 56039: Enable the JmxRemoteLifecycleListener to work over SSL. Patch by esengstrom. (markt)
fix 55743: Enable the stop script to work when the shutdown port is disabled and a PID file is defined. This is only available on platforms that use (markt)
fix 55986: When forcing Tomcat to stop via kill -9 $CATALINA_PID, the script could incorrectly report that Tomcat had not yet completely stopped when it had. Based on a patch by jess. (markt)
fix Package correct license and notice files with embedded JARs. (markt)
code Remove svn keywords (such as $Id) from source files and documentation. (kkolinko)
fix Fix CVE-2014-0050, a denial of service with a malicious, malformed Content-Type header and multipart request processing. Fixed by merging latest code (r1565163) from Commons FileUpload. (markt)
fix 56115: Expose the httpusecaches property of Ant's get task as some users may need to change the default. Based on a suggestion by Anthony. (markt)
Tomcat 7.0.50 (violetagg)released 2014-01-08
fix Handle the case where a context.xml file is added to a web application deployed from a directory. Previously the file was ignored until Tomcat was restarted. Now (assuming automatic deployment is enabled) it will trigger a redeploy of the web application. (markt)
fix Fix string comparison in HostConfig.setContextClass(). (kkolinko)
code Streamline handling of WebSocket messages when no handler is configured for the message currently being received. (markt)
fix Handle the case where a WebSocket annotation configures a message size limit larger than the default permitted by Tomcat. (markt)
fix 55855: This is a partial fix that bypasses the relatively expensive check for a WebSocket upgrade request if no WebSocket endpoints have been registered. (markt)
fix 55905: Prevent a NPE when web.xml references a taglib file that does not exist. Provide better error message. (violetagg)
fix When using the BIO connector with an internal executor, do not display a warning that the executor has not shutdown as the default configuration for BIO connectors is not to wait. This is because threads in keep-alive connections cannot be interrupted and therefore the warning was nearly always displayed. (markt)
fix JspC uses servlet context initialization parameters to pass configuration so ensure that the servlet context used supports initialization parameters. (markt)
fix In AbstractReplicatedMap#finalize, remove rpcChannel from channel Listener of group channel before sending MapMessage.MSG_STOP message. This prevents that the node that sent the MapMessage.MSG_STOP by normal shutdown is added to member map again by ping at heartbeat thread in the node that received the MapMessage.MSG_STOP. (kfujino)
fix Add time stamp to GET_ALL_SESSIONS message. (kfujino)
Web applications
fix Fix the sample configuration of StaticMembershipInterceptor in order to prevent warning log. uniqueId must be 16 bytes. (kfujino)
update Update dependencies that are used to build tomcat-juli extras component. Apache Avalon Framework is updated to version 4.1.5, Apache Log4J to version 1.2.17. (rjung)
Tomcat 7.0.49 (violetagg)not released
fix Correct a regression in the new XML local resolver that triggered false failures when XML validation was configured. (markt)
fix Prevent a NPE when destroying HTTP upgrade handler for WebSocket connections. (violetagg)
Tomcat 7.0.48 (violetagg)not released
add 51294: Add support for unpacking WARs located outside of the Host's appBase in to the appBase. (markt)
fix 55656: Configure the Digester to use the server class loader when parsing server.xml rather than the class loader that loaded StandardServer. Patch provided by Roberto Benedetti. (markt)
fix 55664: Correctly handle JSR 356 WebSocket Encoder, Decoder and MessageHandler implementations that use a generic type such as Encoder.Text<List<String>>. Includes a test case by Niki Dokovski. (markt)
fix Correctly handle WebSocket Encoders, Decoders HTTP/1.1 403 Forbidden Content-Type: text/html Content-Length: 134 Connection: close 403 Forbidden

403 Forbidden