+++ /dev/null
---- tomcat/trunk/java/org/apache/tomcat/util/scan/StandardJarScanner.java 2016/05/04 11:07:55 1742251
-+++ tomcat/trunk/java/org/apache/tomcat/util/scan/StandardJarScanner.java 2016/05/17 07:18:38 1744194
-@@ -370,40 +370,42 @@
- }
-
- Manifest manifest = jar.getManifest();
-- Attributes attributes = manifest.getMainAttributes();
-- String classPathAttribute = attributes.getValue("Class-Path");
-- if (classPathAttribute == null) {
-- return;
-- }
-- String[] classPathEntries = classPathAttribute.split(" ");
-- for (String classPathEntry : classPathEntries) {
-- classPathEntry = classPathEntry.trim();
-- if (classPathEntry.length() == 0) {
-- continue;
-+ if (manifest != null) {
-+ Attributes attributes = manifest.getMainAttributes();
-+ String classPathAttribute = attributes.getValue("Class-Path");
-+ if (classPathAttribute == null) {
-+ return;
- }
-- URL jarURL = jar.getJarFileURL();
-- URI jarURI;
-- try {
-- jarURI = jarURL.toURI();
-- } catch (URISyntaxException e) {
-- if (log.isDebugEnabled()) {
-- log.debug(sm.getString("jarScan.invalidUri", jarURL));
-+ String[] classPathEntries = classPathAttribute.split(" ");
-+ for (String classPathEntry : classPathEntries) {
-+ classPathEntry = classPathEntry.trim();
-+ if (classPathEntry.length() == 0) {
-+ continue;
-+ }
-+ URL jarURL = jar.getJarFileURL();
-+ URI jarURI;
-+ try {
-+ jarURI = jarURL.toURI();
-+ } catch (URISyntaxException e) {
-+ if (log.isDebugEnabled()) {
-+ log.debug(sm.getString("jarScan.invalidUri", jarURL));
-+ }
-+ continue;
- }
-- continue;
-+ /*
-+ * Note: Resolving the relative URLs from the manifest has the
-+ * potential to introduce security concerns. However, since
-+ * only JARs provided by the container and NOT those provided
-+ * by web applications are processed, there should be no
-+ * issues.
-+ * If this feature is ever extended to include JARs provided
-+ * by web applications, checks should be added to ensure that
-+ * any relative URL does not step outside the web application.
-+ */
-+ URI classPathEntryURI = jarURI.resolve(classPathEntry);
-+ URL classPathEntryURL = classPathEntryURI.toURL();
-+ classPathUrlsToProcess.add(classPathEntryURL);
- }
-- /*
-- * Note: Resolving the relative URLs from the manifest has the
-- * potential to introduce security concerns. However, since
-- * only JARs provided by the container and NOT those provided
-- * by web applications are processed, there should be no
-- * issues.
-- * If this feature is ever extended to include JARs provided
-- * by web applications, checks should be added to ensure that
-- * any relative URL does not step outside the web application.
-- */
-- URI classPathEntryURI = jarURI.resolve(classPathEntry);
-- URL classPathEntryURL = classPathEntryURI.toURL();
-- classPathUrlsToProcess.add(classPathEntryURL);
- }
- }
-
-diff --git a/apache-tomcat-9.0.0.M1-src/build.xml b/apache-tomcat-9.0.0.M1-src/build.xml
-index eab0c45..63ac495 100644
---- a/apache-tomcat-9.0.0.M1-src/build.xml
-+++ b/apache-tomcat-9.0.0.M1-src/build.xml
-@@ -711,24 +711,30 @@
+diff --git a/apache-tomcat-9.0.0.M8-src/build.xml b/apache-tomcat-9.0.0.M8-src/build.xml
+index dfec1f7..4dfc5d8 100644
+--- a/apache-tomcat-9.0.0.M8-src/build.xml
++++ b/apache-tomcat-9.0.0.M8-src/build.xml
+@@ -695,24 +695,30 @@
manifest="${tomcat.manifests}/annotations-api.jar.manifest" />
<!-- Servlet 4.0 Implementation JAR File -->
<!-- WebSocket 1.1 API JAR File -->
<jarIt jarfile="${websocket-api.jar}"
-@@ -1002,14 +1008,14 @@
+@@ -986,14 +992,14 @@
<target name="deploy" depends="package,build-docs,build-tomcat-jdbc,compile-webapp-examples"
description="Default. Builds a working Tomcat instance">
<!-- Copy scripts -->
<copy todir="${tomcat.build}/bin">
<fileset dir="bin">
-@@ -1069,7 +1075,7 @@
+@@ -1053,7 +1059,7 @@
<exclude name="${jdt.jar.filename}"/>
</fileset>
</delete>
<!-- Add sources for examples -->
<antcall target="examples-sources" />
-@@ -1103,7 +1109,7 @@
+@@ -1087,7 +1093,7 @@
</javac>
</target>
<!-- build the jdbc-pool jar and source jar-->
<echo message="Building Tomcat JDBC pool libraries"/>
<ant antfile="${tomcat.jdbc.dir}/build.xml" dir="${tomcat.jdbc.dir}"
-@@ -1118,7 +1124,7 @@
+@@ -1102,7 +1108,7 @@
<copy file="${tomcat-jdbc.jar}" todir="${tomcat.build}/lib"/>
</target>
<!-- build the jdbc-pool source jar-->
<echo message="Building Tomcat JDBC pool src JAR"/>
<ant antfile="${tomcat.jdbc.dir}/build.xml" dir="${tomcat.jdbc.dir}"
-@@ -1222,10 +1228,11 @@
+@@ -1206,10 +1212,11 @@
<copy file="${basedir}/LICENSE" todir="${tomcat.embed}" />
<copy file="${basedir}/NOTICE" todir="${tomcat.embed}" />
<!-- Note the meta-inf below will work as long as there is only one JAR
that needs to add entries. If there is more than one a more complex
solution will be required. -->
-@@ -1606,7 +1613,7 @@
-
- <target name="extras-commons-logging-prepare"
- depends="extras-prepare"
-- description="Prepare to build web services extras package">
-+ description="Prepare to build web services extras package" unless="noget">
-
- <antcall target="downloadfile-2">
- <param name="sourcefile.1" value="${commons-logging-src.loc.1}"/>
-@@ -1745,7 +1752,7 @@
+@@ -1583,7 +1590,7 @@
<target name="extras-webservices-prepare"
depends="extras-prepare"
<antcall target="downloadfile">
<param name="sourcefile" value="${jaxrpc-lib.loc}"/>
-@@ -1940,6 +1947,7 @@ Apache Tomcat ${version} native binaries for Win64 AMD64/EMT64 platform.
+@@ -1731,6 +1738,7 @@ Apache Tomcat ${version} native binaries for Win64 AMD64/EMT64 platform.
<target name="javadoc" depends="dist-source,extras-webservices-prepare"
description="Create the Tomcat javadoc" >
<javadoc packagenames="javax.servlet.*"
excludepackagenames="javax.servlet.jsp.*"
sourcepath="${tomcat.dist}/src/java"
-@@ -1998,6 +2006,7 @@ Apache Tomcat ${version} native binaries for Win64 AMD64/EMT64 platform.
+@@ -1795,6 +1803,7 @@ Apache Tomcat ${version} native binaries for Win64 AMD64/EMT64 platform.
<path location="${ant.core.lib}"/>
</classpath>
</javadoc>
<javadoc packagenames="javax.websocket.*"
sourcepath="${tomcat.dist}/src/java"
destdir="${tomcat.dist}/webapps/docs/websocketapi"
-@@ -2028,15 +2037,17 @@ Apache Tomcat ${version} native binaries for Win64 AMD64/EMT64 platform.
- docencoding="UTF-8"
- charset="UTF-8"
- additionalparam="-breakiterator -notimestamp"
-- maxmemory="256m" >
-+ maxmemory="512m" >
- <classpath>
- <path refid="compile.classpath"/>
+@@ -1835,9 +1844,11 @@ Apache Tomcat ${version} native binaries for Win64 AMD64/EMT64 platform.
<path refid="tomcat.webservices.classpath"/>
<path location="${ant.core.lib}"/>
</classpath>
<link href="../websocketapi"/>
<link href="http://docs.oracle.com/javase/7/docs/api/"/>
<link href="http://commons.apache.org/proper/commons-io/javadocs/api-release/"/>
-@@ -2775,7 +2786,7 @@ skip.installer property in build.properties" />
+@@ -2578,7 +2589,7 @@ skip.installer property in build.properties" />
</target>
<target name="download-compile"
<antcall target="downloadfile-2">
<param name="sourcefile.1" value="${tomcat-native.loc.1}"/>
-@@ -2809,7 +2820,7 @@ skip.installer property in build.properties" />
+@@ -2612,7 +2623,7 @@ skip.installer property in build.properties" />
</target>
<target name="download-test-compile"
<antcall target="downloadfile">
<param name="sourcefile" value="${junit.loc}"/>
-@@ -2866,7 +2877,7 @@ skip.installer property in build.properties" />
+@@ -2669,7 +2680,7 @@ skip.installer property in build.properties" />
</target>
<target name="download-dist"
<antcall target="downloadzip-2">
<param name="sourcefile.1" value="${tomcat-native.win.1}"/>
-@@ -2892,18 +2903,18 @@ skip.installer property in build.properties" />
+@@ -2695,18 +2706,18 @@ skip.installer property in build.properties" />
<!-- =============== Utility Targets to support downloads ================ -->
<!-- Download and extract the package -->
<local name="temp.file"/>
<mkdir dir="${base.path}"/>
-@@ -2915,7 +2926,7 @@ skip.installer property in build.properties" />
+@@ -2718,7 +2729,7 @@ skip.installer property in build.properties" />
<delete file="${temp.file}.tar.gz"/>
</target>
<!-- Download and extract the package from the two alternative locations -->
<local name="temp.file"/>
<mkdir dir="${base.path}"/>
-@@ -2934,7 +2945,7 @@ skip.installer property in build.properties" />
+@@ -2737,7 +2748,7 @@ skip.installer property in build.properties" />
<delete file="${temp.file}.tar.gz"/>
</target>
<!-- Download and extract the package -->
<local name="temp.file"/>
<mkdir dir="${base.path}"/>
-@@ -2945,7 +2956,7 @@ skip.installer property in build.properties" />
+@@ -2748,7 +2759,7 @@ skip.installer property in build.properties" />
<delete file="${temp.file}"/>
</target>
<!-- Download and extract the package from the two alternative locations -->
<local name="temp.file"/>
<mkdir dir="${base.path}"/>
-@@ -2963,7 +2974,7 @@ skip.installer property in build.properties" />
+@@ -2766,7 +2777,7 @@ skip.installer property in build.properties" />
<delete file="${temp.file}"/>
</target>
<!-- Download the file -->
<local name="temp.file"/>
<mkdir dir="${base.path}"/>
-@@ -2973,7 +2984,7 @@ skip.installer property in build.properties" />
+@@ -2776,7 +2787,7 @@ skip.installer property in build.properties" />
<move file="${temp.file}" tofile="${destfile}"/>
</target>
<!-- Download the file from the two alternative locations -->
<local name="temp.file"/>
<mkdir dir="${base.path}"/>
-@@ -2996,7 +3007,7 @@ skip.installer property in build.properties" />
+@@ -2799,7 +2810,7 @@ skip.installer property in build.properties" />
<move file="${temp.file}" tofile="${destfile}"/>
</target>
<condition property="trydownload.run">
<and>
<not>
-@@ -3007,7 +3018,7 @@ skip.installer property in build.properties" />
+@@ -2810,7 +2821,7 @@ skip.installer property in build.properties" />
</condition>
</target>
<!-- Downloads a file if not yet downloaded and the source URL is available -->
<get src="${sourcefile}" httpusecaches="${trydownload.httpusecaches}" dest="${destfile}" />
</target>
-@@ -3018,7 +3029,7 @@ skip.installer property in build.properties" />
+@@ -2821,7 +2832,7 @@ skip.installer property in build.properties" />
<target name="ide-eclipse"
depends="download-compile, extras-webservices-prepare, download-test-compile"