开源软件构建与测试

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Changes of Revision 2

_service:tar_scm:jetty.spec Changed

@@ -8,11 +8,11 @@
 %global rundir %{_localstatedir}/run/%{name}
 %global jettylibdir %{_localstatedir}/lib/%{name}
 %global appdir %{jettylibdir}/webapps
-%global addver .v20190215
+%global addver .v20190411
 %bcond_with jp_minimal
 Name: jetty
-Version: 9.4.15
-Release: 9
+Version: 9.4.16
+Release: 4
 Summary: Java Webserver and Servlet Container
 License: ASL 2.0 or EPL-1.0 or EPL-2.0
 URL: http://www.eclipse.org/jetty/
@@ -22,24 +22,21 @@
 Source5: %{name}.service
 Source6: LICENSE-MIT
 Patch0: CVE-2020-27216.patch
-Patch1: CVE-2020-27223-pre-1.patch
-Patch2: CVE-2020-27223-pre-2.patch
-Patch3: CVE-2020-27223-pre-3.patch
-Patch4: CVE-2020-27223-pre-4.patch
-Patch5: CVE-2020-27223.patch
-Patch6: CVE-2021-28165-1.patch
-Patch7: CVE-2021-28165-2.patch
-Patch8: CVE-2021-28169.patch
-Patch9: CVE-2021-34428.patch
-
-BuildRequires: maven-local mvn(javax.servlet:javax.servlet-api)
+Patch1: CVE-2020-27223.patch
+Patch2: CVE-2021-28165.patch
+Patch3: CVE-2021-28169.patch
+Patch4: CVE-2021-34428.patch
+Patch5: CVE-2022-2047.patch
+Patch6: CVE-2022-2048.patch
+
+BuildRequires: maven-local mvn(javax.servlet:javax.servlet-api) < 4.0.0
 BuildRequires: mvn(org.apache.felix:maven-bundle-plugin)
 BuildRequires: mvn(org.apache.maven.plugins:maven-shade-plugin)
 BuildRequires: mvn(org.codehaus.mojo:build-helper-maven-plugin) mvn(org.slf4j:slf4j-api)
 %if %{without jp_minimal}
 BuildRequires: maven-local mvn(com.github.jnr:jnr-unixsocket)
 BuildRequires: mvn(javax.annotation:javax.annotation-api) mvn(javax.enterprise:cdi-api)
-BuildRequires: mvn(javax.servlet:javax.servlet-api)
+BuildRequires: mvn(javax.servlet:javax.servlet-api) < 4.0.0
 BuildRequires: mvn(javax.servlet.jsp:javax.servlet.jsp-api) mvn(javax.servlet:jstl)
 BuildRequires: mvn(javax.transaction:javax.transaction-api)
 BuildRequires: mvn(javax.websocket:javax.websocket-api)
@@ -84,6 +81,7 @@
 BuildRequires: jboss-websocket-1.0-api
 Requires: jboss-websocket-1.0-api
 Requires: java-1.8.0-openjdk-headless
+Requires: glassfish-servlet-api < 4.0.0
 %endif # without jp_minimal
 BuildArch: noarch
 %if %{without jp_minimal}
@@ -195,6 +193,7 @@
 %package jsp
 Summary: jsp module for Jetty
 Requires: glassfish-el
+Requires: glassfish-servlet-api < 4.0.0
 %description jsp
 %{extdesc} %{summary}.
 
@@ -205,6 +204,7 @@
 
 %package server
 Summary: server module for Jetty
+Requires: glassfish-servlet-api < 4.0.0
 %description server
 %{extdesc} %{summary}.
 
@@ -271,6 +271,7 @@
 
 %package fcgi-server
 Summary: FastCGI client module for Jetty
+Requires: glassfish-servlet-api < 4.0.0
 %description fcgi-server
 %{extdesc} %{summary}.
 
@@ -311,6 +312,7 @@
 
 %package rewrite
 Summary: rewrite module for Jetty
+Requires: glassfish-servlet-api < 4.0.0
 %description rewrite
 %{extdesc} %{summary}.
 
@@ -361,6 +363,7 @@
 
 %package websocket-servlet
 Summary: websocket-servlet module for Jetty
+Requires: glassfish-servlet-api < 4.0.0
 %description websocket-servlet
 %{extdesc} %{summary}.
 
@@ -381,6 +384,7 @@
 
 %package httpservice
 Summary: httpservice module for Jetty
+Requires: glassfish-servlet-api < 4.0.0
 %description httpservice
 %{extdesc} %{summary}.
 
@@ -396,6 +400,7 @@
 
 %package osgi-boot-jsp
 Summary: osgi-boot-jsp module for Jetty
+Requires: glassfish-servlet-api < 4.0.0
 %description osgi-boot-jsp
 %{extdesc} %{summary}.
 
@@ -510,6 +515,7 @@
 %pom_disable_module jetty-alpn-conscrypt-client jetty-alpn
 %pom_remove_dep -r :jetty-alpn-conscrypt-server
 %pom_remove_dep -r :jetty-alpn-conscrypt-client
+sed -i 's|9.3.0.RC0|${project.version}|g' tests/test-webapps/test-servlet-spec/test-spec-webapp/pom.xml
 rm -fr examples/embedded/src/main/java/org/eclipse/jetty/embedded/ManyConnectors.java
 cp %{SOURCE6} .
 sed -i '/<SystemProperty name="jetty.state"/d' \
@@ -790,6 +796,18 @@
 %license LICENSE NOTICE.txt LICENSE-MIT
 
 %changelog
+* Tue Mar 14 2023 caodongxia <caodongxia@h-partners.com> - 9.4.16-4
+- Fix self-compilation failure
+
+* Wed Mar 01 2023 Ge Wang <wangge20@h-partners.com> - 9.4.16-3
+- Fix EBS build failure due to jetty-util version mismatch
+
+* Wed Dec 28 2022 jiangpeng <jiangpeng01@ncti-gba.cn> - 9.4.16-2
+- Fix CVE-2022-2047 and CVE-2022-2048
+
+* Tue Sep 13 2022 liangqifeng <liangqifeng@ncti-gba.cn> - 9.4.16-1
+- update to 9.4.14 to Fix CVE-2019-10241
+
 * Thu Jul 1 2021 wutao <wutao61@huawei.com> - 9.4.15-9
 - Fix CVE-2021-34428

_service:tar_scm:CVE-2020-27216.patch Changed

@@ -1,22 +1,17 @@
-From 53e0e0e9b25a6309bf24ee3b10984f4145701edb Mon Sep 17 00:00:00 2001
-From: Joakim Erdfelt <joakim.erdfelt@gmail.com>
-Date: Thu, 15 Oct 2020 17:39:30 -0500
-Subject: PATCH Merge pull request from GHSA-g3wg-6mcf-8jj6
+From: Markus Koschany <apo@debian.org>
+Date: Sat, 3 Jul 2021 22:05:57 +0200
+Subject: CVE-2020-27216
 
-* Issue #5451 - Improving temp directory creation.
-
-+ Using new Files.createTempDirectory() instead
- of nonsense around File.createTempFile()
-
-Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
-
-* Fixes #5451 - Restoring File.deleteOnExit
+Origin: https://github.com/eclipse/jetty.project/commit/53e0e0e9b25a6309bf24ee3b10984f4145701edb
+Origin: https://github.com/eclipse/jetty.project/commit/9ad6beb80543b392c91653f6bfce233fc75b9d5f
 ---
- .../jetty/webapp/WebInfConfiguration.java | 20 +++++++------------
- 1 file changed, 7 insertions(+), 13 deletions(-)
+ .../eclipse/jetty/webapp/WebInfConfiguration.java | 20 +--
+ .../server/session/InfinispanTestSupport.java | 173 +++++++++++++--------
+ .../test/java/org/eclipse/jetty/TestServer.java | 54 +++----
+ 3 files changed, 135 insertions(+), 112 deletions(-)
 
 diff --git a/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java b/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java
-index b94f788..f39432d 100644
+index b94f788..19663bc 100644
 --- a/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java
 +++ b/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java
 @@ -24,6 +24,8 @@ import java.net.URI;
@@ -41,9 +36,9 @@
 - tmpDir.deleteOnExit();
 - context.setTempDirectory(tmpDir);
 + Path tmpDir = Files.createTempDirectory(template.getTempDirectory().getParentFile().toPath(), WebInfConfiguration.getCanonicalNameForWebAppTmpDir(context));
-+	File tmpDirAsFile = tmpDir.toFile();
-+	tmpDirAsFile.deleteOnExit();
-+	context.setTempDirectory(tmpDirAsFile);
++ File tmpDirAsFile = tmpDir.toFile();
++ tmpDirAsFile.deleteOnExit();
++ context.setTempDirectory(tmpDirAsFile);
 }
 
 
@@ -60,6 +55,423 @@
 }
 configureTempDirectory(tmpDir, context);
 
--- 
-2.23.0
-
+diff --git a/tests/test-sessions/test-infinispan-sessions/src/test/java/org/eclipse/jetty/server/session/InfinispanTestSupport.java b/tests/test-sessions/test-infinispan-sessions/src/test/java/org/eclipse/jetty/server/session/InfinispanTestSupport.java
+index 57ecb1f..663e8dd 100644
+--- a/tests/test-sessions/test-infinispan-sessions/src/test/java/org/eclipse/jetty/server/session/InfinispanTestSupport.java
++++ b/tests/test-sessions/test-infinispan-sessions/src/test/java/org/eclipse/jetty/server/session/InfinispanTestSupport.java
+@@ -1,6 +1,6 @@
+ //
+ // ========================================================================
+-// Copyright (c) 1995-2019 Mort Bay Consulting Pty. Ltd.
++// Copyright (c) 1995-2021 Mort Bay Consulting Pty Ltd and others.
+ // ------------------------------------------------------------------------
+ // All rights reserved. This program and the accompanying materials
+ // are made available under the terms of the Eclipse Public License v1.0
+@@ -16,38 +16,44 @@
+ // ========================================================================
+ //
+ 
+-
+ package org.eclipse.jetty.server.session;
+ 
+-import static org.junit.jupiter.api.Assertions.assertEquals;
+-import static org.junit.jupiter.api.Assertions.assertTrue;
+-
+ import java.io.File;
++import java.lang.annotation.ElementType;
++import java.nio.file.Files;
++import java.nio.file.Path;
++import java.util.Properties;
+ 
++import org.eclipse.jetty.toolchain.test.FS;
+ import org.eclipse.jetty.util.IO;
++import org.hibernate.search.cfg.Environment;
++import org.hibernate.search.cfg.SearchMapping;
+ import org.infinispan.Cache;
+-import org.infinispan.configuration.cache.Configuration;
+ import org.infinispan.configuration.cache.ConfigurationBuilder;
++import org.infinispan.configuration.cache.ConfigurationChildBuilder;
++import org.infinispan.configuration.cache.Index;
+ import org.infinispan.configuration.global.GlobalConfigurationBuilder;
+ import org.infinispan.manager.DefaultCacheManager;
+ import org.infinispan.manager.EmbeddedCacheManager;
+ 
++import static org.junit.jupiter.api.Assertions.assertEquals;
++import static org.junit.jupiter.api.Assertions.assertTrue;
++
+ /**
+ * InfinispanTestSupport
+- *
+- *
+ */
+ public class InfinispanTestSupport
+ {
+- public static final String DEFAULT_CACHE_NAME = "session_test_cache";
+- public Cache _cache;
+- 
++ public static final String DEFAULT_CACHE_NAME = "session_test_cache";
++ public Cache _cache;
++
+ public ConfigurationBuilder _builder;
+- private File _tmpdir;
++ private File _tmpdir;
+ private boolean _useFileStore;
++ private boolean _serializeSessionData;
+ private String _name;
+- public static EmbeddedCacheManager _manager;
+- 
++ public static EmbeddedCacheManager _manager;
++
+ static
+ {
+ try
+@@ -59,53 +65,84 @@ public class InfinispanTestSupport
+ e.printStackTrace();
+ }
+ }
+- 
+- 
+- 
+- 
+- public InfinispanTestSupport ()
++
++ public InfinispanTestSupport()
+ {
+- this (null);
++ this(null);
+ }
+- 
++
+ public InfinispanTestSupport(String cacheName)
+- { 
++ {
+ if (cacheName == null)
+- cacheName = DEFAULT_CACHE_NAME+System.currentTimeMillis();
+- 
++ cacheName = DEFAULT_CACHE_NAME + System.currentTimeMillis();
++
+ _name = cacheName;
+ _builder = new ConfigurationBuilder();
+ }
+- 
+- public void setUseFileStore (boolean useFileStore)
++
++ public void setUseFileStore(boolean useFileStore)
+ {
+ _useFileStore = useFileStore;
+ }
+- 
+- public Cache getCache ()
++
++ public void setSerializeSessionData(boolean serializeSessionData)
+ {
+- return _cache;
++ _serializeSessionData = serializeSessionData;
+ }
+ 
+- public void setup () throws Exception
++ public Cache getCache()
+ {
+- if (_useFileStore)
+- { 
+- _tmpdir = File.createTempFile("infini", "span");
+- _tmpdir.delete();
+- _tmpdir.mkdir();
+- Configuration config = _builder.persistence().addSingleFileStore().location(_tmpdir.getAbsolutePath()).storeAsBinary().build();
+- _manager.defineConfiguration(_name, config);
+- }
+- else
+- {
+- _manager.defineConfiguration(_name, _builder.build());
+- }
+- _cache = _manager.getCache(_name);
++ return _cache;
+ }
+ 
++ public void setup(Path root) throws Exception
++ {
++ Path indexesDir = root.resolve("indexes");
++ FS.ensureDirExists(indexesDir);
++
++ SearchMapping mapping = new SearchMapping();
++ mapping.entity(SessionData.class).indexed().providedId().property("expiry", ElementType.FIELD).field();
++ Properties properties = new Properties();
++ properties.put(Environment.MODEL_MAPPING, mapping);
++ properties.put("hibernate.search.default.indexBase", indexesDir.toString());
++
++ if (_useFileStore)
++ {
++ Path tmpDir = Files.createTempDirectory("infinispan");

_service:tar_scm:CVE-2020-27223-pre-4.patch Deleted

@@ -1,1167 +0,0 @@
-From cec50b3d2cea7bdf6b2f00d45c8554139aebbf87 Mon Sep 17 00:00:00 2001
-From: Greg Wilkins <gregw@webtide.com>
-Date: Wed, 8 May 2019 21:07:22 +0200
-Subject: PATCH Issue #3630 Optimized ForwardedRequestCustomizer
-
-Signed-off-by: Greg Wilkins <gregw@webtide.com>
----
- .../eclipse/jetty/http/HostPortHttpField.java | 17 +-
- .../org/eclipse/jetty/http/QuotedCSV.java | 264 +---------------
- .../eclipse/jetty/http/QuotedCSVParser.java | 288 ++++++++++++++++++
- .../server/ForwardedRequestCustomizer.java | 249 +++++++--------
- .../ForwardedRequestCustomizerTest.java | 99 +++++-
- 5 files changed, 507 insertions(+), 410 deletions(-)
- create mode 100644 jetty-http/src/main/java/org/eclipse/jetty/http/QuotedCSVParser.java
-
-diff --git a/jetty-http/src/main/java/org/eclipse/jetty/http/HostPortHttpField.java b/jetty-http/src/main/java/org/eclipse/jetty/http/HostPortHttpField.java
-index dc386665339..6c9f3b921e8 100644
---- a/jetty-http/src/main/java/org/eclipse/jetty/http/HostPortHttpField.java
-+++ b/jetty-http/src/main/java/org/eclipse/jetty/http/HostPortHttpField.java
-@@ -22,9 +22,9 @@
- import org.eclipse.jetty.util.HostPort;
- 
- 
--
--/* ------------------------------------------------------------ */
- /**
-+ * A HttpField holding a preparsed Host and port number
-+ * @see HostPort
- */
- public class HostPortHttpField extends HttpField
- {
-@@ -35,7 +35,6 @@ public HostPortHttpField(String authority)
- this(HttpHeader.HOST,HttpHeader.HOST.asString(),authority);
- }
- 
-- /* ------------------------------------------------------------ */
- protected HostPortHttpField(HttpHeader header, String name, String authority)
- {
- super(header,name,authority);
-@@ -49,20 +48,17 @@ protected HostPortHttpField(HttpHeader header, String name, String authority)
- }
- }
- 
-- /* ------------------------------------------------------------ */
- public HostPortHttpField(String host, int port)
- {
- this(new HostPort(host, port));
- }
- 
-- /* ------------------------------------------------------------ */
-- protected HostPortHttpField(HostPort hostport)
-+ public HostPortHttpField(HostPort hostport)
- {
- super(HttpHeader.HOST,HttpHeader.HOST.asString(),hostport.toString());
- _hostPort = hostport;
- }
- 
-- /* ------------------------------------------------------------ */
- /** Get the host.
- * @return the host
- */
-@@ -71,7 +67,6 @@ public String getHost()
- return _hostPort.getHost();
- }
- 
-- /* ------------------------------------------------------------ */
- /** Get the port.
- * @return the port
- */
-@@ -80,7 +75,6 @@ public int getPort()
- return _hostPort.getPort();
- }
- 
-- /* ------------------------------------------------------------ */
- /** Get the port.
- * @param defaultPort The default port to return if no port set
- * @return the port
-@@ -89,4 +83,9 @@ public int getPort(int defaultPort)
- {
- return _hostPort.getPort(defaultPort);
- }
-+
-+ public HostPort getHostPort()
-+ {
-+ return _hostPort;
-+ }
- }
-diff --git a/jetty-http/src/main/java/org/eclipse/jetty/http/QuotedCSV.java b/jetty-http/src/main/java/org/eclipse/jetty/http/QuotedCSV.java
-index 9ca7dbeec2c..8ebc2c36307 100644
---- a/jetty-http/src/main/java/org/eclipse/jetty/http/QuotedCSV.java
-+++ b/jetty-http/src/main/java/org/eclipse/jetty/http/QuotedCSV.java
-@@ -22,8 +22,6 @@
- import java.util.Iterator;
- import java.util.List;
- 
--import org.eclipse.jetty.util.QuotedStringTokenizer;
--
- /* ------------------------------------------------------------ */
- /**
- * Implements a quoted comma separated list of values
-@@ -32,226 +30,26 @@
- * @see "https://tools.ietf.org/html/rfc7230#section-3.2.6"
- * @see "https://tools.ietf.org/html/rfc7230#section-7"
- */
--public class QuotedCSV implements Iterable<String>
--{ 
-- private enum State { VALUE, PARAM_NAME, PARAM_VALUE};
-- 
-+public class QuotedCSV extends QuotedCSVParser implements Iterable<String>
-+{
- protected final List<String> _values = new ArrayList<>();
-- protected final boolean _keepQuotes;
-- 
-- /* ------------------------------------------------------------ */
-+
- public QuotedCSV(String... values)
- {
- this(true,values);
- }
- 
-- /* ------------------------------------------------------------ */
- public QuotedCSV(boolean keepQuotes,String... values)
- {
-- _keepQuotes=keepQuotes;
-+ super(keepQuotes);
- for (String v:values)
- addValue(v);
- }
-- 
-- /* ------------------------------------------------------------ */
-- /** Add and parse a value string(s) 
-- * @param value A value that may contain one or more Quoted CSV items.
-- */
-- public void addValue(String value)
-- {
-- if (value == null)
-- return;
-- 
-- StringBuffer buffer = new StringBuffer();
-- 
-- int l=value.length();
-- State state=State.VALUE;
-- boolean quoted=false;
-- boolean sloshed=false;
-- int nws_length=0;
-- int last_length=0;
-- int value_length=-1;
-- int param_name=-1;
-- int param_value=-1;
-- 
-- for (int i=0;i<=l;i++)
-- {
-- char c=i==l?0:value.charAt(i);
-- 
-- // Handle quoting https://tools.ietf.org/html/rfc7230#section-3.2.6
-- if (quoted && c!=0)
-- {
-- if (sloshed)
-- sloshed=false;
-- else
-- {
-- switch(c)
-- {
-- case '\\':
-- sloshed=true;
-- if (!_keepQuotes)
-- continue;
-- break;
-- case '"':
-- quoted=false;
-- if (!_keepQuotes)
-- continue;
-- break;
-- }
-- }
--
-- buffer.append(c);
-- nws_length=buffer.length();
-- continue;
-- }
-- 
-- // Handle common cases
-- switch(c)
-- {
-- case ' ':
-- case '\t':
-- if (buffer.length()>last_length) // not leading OWS
-- buffer.append(c);
-- continue;
--
-- case '"':
-- quoted=true;
-- if (_keepQuotes)
-- {
-- if (state==State.PARAM_VALUE && param_value<0)
-- param_value=nws_length;
-- buffer.append(c);
-- }
-- else if (state==State.PARAM_VALUE && param_value<0)

_service:tar_scm:CVE-2020-27223.patch Changed

@@ -1,22 +1,670 @@
-From 10e531756b972162eed402c44d0244f7f6b85131 Mon Sep 17 00:00:00 2001
-From: Joakim Erdfelt <joakim.erdfelt@gmail.com>
-Date: Thu, 18 Feb 2021 07:14:38 -0600
-Subject: PATCH Merge pull request from GHSA-m394-8rww-3jr7
+From: Markus Koschany <apo@debian.org>
+Date: Sat, 31 Jul 2021 17:21:57 +0200
+Subject: CVE-2020-27223
 
-Use comparator based sort
-Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
-Signed-off-by: gregw <gregw@webtide.com>
-
-Co-authored-by: gregw <gregw@webtide.com>
 ---
- .../eclipse/jetty/http/QuotedQualityCSV.java | 117 +++++++++++++-----
- 1 file changed, 86 insertions(+), 31 deletions(-)
+ .../java/org/eclipse/jetty/http/QuotedCSV.java | 280 ++-----------------
+ .../org/eclipse/jetty/http/QuotedCSVParser.java | 303 +++++++++++++++++++++
+ .../org/eclipse/jetty/http/QuotedQualityCSV.java | 140 ++++++----
+ .../eclipse/jetty/http/QuotedQualityCSVTest.java | 143 +++++-----
+ 4 files changed, 479 insertions(+), 387 deletions(-)
+ create mode 100644 jetty-http/src/main/java/org/eclipse/jetty/http/QuotedCSVParser.java
 
+diff --git a/jetty-http/src/main/java/org/eclipse/jetty/http/QuotedCSV.java b/jetty-http/src/main/java/org/eclipse/jetty/http/QuotedCSV.java
+index 9ca7dbe..a356213 100644
+--- a/jetty-http/src/main/java/org/eclipse/jetty/http/QuotedCSV.java
++++ b/jetty-http/src/main/java/org/eclipse/jetty/http/QuotedCSV.java
+@@ -1,6 +1,6 @@
+ //
+ // ========================================================================
+-// Copyright (c) 1995-2019 Mort Bay Consulting Pty. Ltd.
++// Copyright (c) 1995-2021 Mort Bay Consulting Pty Ltd and others.
+ // ------------------------------------------------------------------------
+ // All rights reserved. This program and the accompanying materials
+ // are made available under the terms of the Eclipse Public License v1.0
+@@ -22,236 +22,36 @@ import java.util.ArrayList;
+ import java.util.Iterator;
+ import java.util.List;
+ 
+-import org.eclipse.jetty.util.QuotedStringTokenizer;
+-
+-/* ------------------------------------------------------------ */
+ /**
+ * Implements a quoted comma separated list of values
+ * in accordance with RFC7230.
+ * OWS is removed and quoted characters ignored for parsing.
++ *
+ * @see "https://tools.ietf.org/html/rfc7230#section-3.2.6"
+ * @see "https://tools.ietf.org/html/rfc7230#section-7"
+ */
+-public class QuotedCSV implements Iterable<String>
+-{ 
+- private enum State { VALUE, PARAM_NAME, PARAM_VALUE};
+- 
++public class QuotedCSV extends QuotedCSVParser implements Iterable<String>
++{
+ protected final List<String> _values = new ArrayList<>();
+- protected final boolean _keepQuotes;
+- 
+- /* ------------------------------------------------------------ */
++
+ public QuotedCSV(String... values)
+ {
+- this(true,values);
++ this(true, values);
+ }
+- 
+- /* ------------------------------------------------------------ */
+- public QuotedCSV(boolean keepQuotes,String... values)
+- {
+- _keepQuotes=keepQuotes;
+- for (String v:values)
+- addValue(v);
+- }
+- 
+- /* ------------------------------------------------------------ */
+- /** Add and parse a value string(s) 
+- * @param value A value that may contain one or more Quoted CSV items.
+- */
+- public void addValue(String value)
++
++ public QuotedCSV(boolean keepQuotes, String... values)
+ {
+- if (value == null)
+- return;
+- 
+- StringBuffer buffer = new StringBuffer();
+- 
+- int l=value.length();
+- State state=State.VALUE;
+- boolean quoted=false;
+- boolean sloshed=false;
+- int nws_length=0;
+- int last_length=0;
+- int value_length=-1;
+- int param_name=-1;
+- int param_value=-1;
+- 
+- for (int i=0;i<=l;i++)
++ super(keepQuotes);
++ for (String v : values)
+ {
+- char c=i==l?0:value.charAt(i);
+- 
+- // Handle quoting https://tools.ietf.org/html/rfc7230#section-3.2.6
+- if (quoted && c!=0)
+- {
+- if (sloshed)
+- sloshed=false;
+- else
+- {
+- switch(c)
+- {
+- case '\\':
+- sloshed=true;
+- if (!_keepQuotes)
+- continue;
+- break;
+- case '"':
+- quoted=false;
+- if (!_keepQuotes)
+- continue;
+- break;
+- }
+- }
+-
+- buffer.append(c);
+- nws_length=buffer.length();
+- continue;
+- }
+- 
+- // Handle common cases
+- switch(c)
+- {
+- case ' ':
+- case '\t':
+- if (buffer.length()>last_length) // not leading OWS
+- buffer.append(c);
+- continue;
+-
+- case '"':
+- quoted=true;
+- if (_keepQuotes)
+- {
+- if (state==State.PARAM_VALUE && param_value<0)
+- param_value=nws_length;
+- buffer.append(c);
+- }
+- else if (state==State.PARAM_VALUE && param_value<0)
+- param_value=nws_length;
+- nws_length=buffer.length();
+- continue;
+- 
+- case ';': 
+- buffer.setLength(nws_length); // trim following OWS
+- if (state==State.VALUE)
+- {
+- parsedValue(buffer);
+- value_length=buffer.length();
+- }
+- else
+- parsedParam(buffer,value_length,param_name,param_value);
+- nws_length=buffer.length();
+- param_name=param_value=-1;
+- buffer.append(c);
+- last_length=++nws_length;
+- state=State.PARAM_NAME;
+- continue;
+- 
+- case ',':
+- case 0:
+- if (nws_length>0)
+- {
+- buffer.setLength(nws_length); // trim following OWS
+- switch(state)
+- {
+- case VALUE:
+- parsedValue(buffer);
+- value_length=buffer.length();
+- break;
+- case PARAM_NAME:
+- case PARAM_VALUE:
+- parsedParam(buffer,value_length,param_name,param_value);
+- break;
+- }
+- _values.add(buffer.toString());
+- }
+- buffer.setLength(0);
+- last_length=0;
+- nws_length=0;
+- value_length=param_name=param_value=-1;
+- state=State.VALUE;
+- continue;
+-
+- case '=':
+- switch (state)
+- {
+- case VALUE:
+- // It wasn't really a value, it was a param name

_service:tar_scm:CVE-2021-28165-1.patch Deleted

@@ -1,36 +0,0 @@
-From 00d379c94ba865dced2025c2d1bc3e2e0e41e880 Mon Sep 17 00:00:00 2001
-From: Joakim Erdfelt <joakim.erdfelt@gmail.com>
-Date: Thu, 18 Mar 2021 08:08:55 -0500
-Subject: PATCH Fixes #6072 - jetty server high CPU when client send data
- length > 17408.
-
-Avoid spinning if the input buffer is full.
-
-Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
-Co-authored-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
----
- .../main/java/org/eclipse/jetty/io/ssl/SslConnection.java | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java b/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java
-index bc2431d..b2482e7 100644
---- a/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java
-+++ b/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java
-@@ -603,7 +603,13 @@ public class SslConnection extends AbstractConnection implements Connection.Upgr
- 
- case BUFFER_UNDERFLOW:
- if (net_filled > 0)
-- continue; // try filling some more
-+ {
-+ if (BufferUtil.space(_encryptedInput) > 0)
-+ continue; // try filling some more
-+ BufferUtil.clear(_encryptedInput);
-+ throw new SSLHandshakeException("Encrypted buffer max length exceeded");
-+ }
-+
- _underflown = true;
- if (net_filled < 0 && _sslEngine.getUseClientMode())
- {
--- 
-2.23.0
-

_service:tar_scm:CVE-2021-28165-2.patch Deleted

@@ -1,39 +0,0 @@
-From 294b2ba02b667548617a94cd99592110ac230add Mon Sep 17 00:00:00 2001
-From: Simone Bordet <simone.bordet@gmail.com>
-Date: Mon, 22 Mar 2021 10:39:36 +0100
-Subject: PATCH Fixes #6072 - jetty server high CPU when client send data
- length > 17408.
-
-Updates after review.
-
-Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
----
- .../main/java/org/eclipse/jetty/io/ssl/SslConnection.java | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
-diff --git a/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java b/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java
-index b2482e7..44c7f10 100644
---- a/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java
-+++ b/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java
-@@ -602,14 +602,15 @@ public class SslConnection extends AbstractConnection implements Connection.Upgr
- return filled = -1;
- 
- case BUFFER_UNDERFLOW:
-- if (net_filled > 0)
-+ if (BufferUtil.space(_encryptedInput) == 0)
- {
-- if (BufferUtil.space(_encryptedInput) > 0)
-- continue; // try filling some more
- BufferUtil.clear(_encryptedInput);
- throw new SSLHandshakeException("Encrypted buffer max length exceeded");
- }
- 
-+ if (net_filled > 0)
-+ continue; // try filling some more
-+
- _underflown = true;
- if (net_filled < 0 && _sslEngine.getUseClientMode())
- {
--- 
-2.23.0
-

_service:tar_scm:CVE-2020-27223-pre-1.patch -> _service:tar_scm:CVE-2021-28165.patch Changed

@@ -1,545 +1,533 @@
-From 8011c48685e78850a88e7cc06650f678a375037d Mon Sep 17 00:00:00 2001
-From: Greg Wilkins <gregw@webtide.com>
-Date: Thu, 28 Feb 2019 18:37:02 +1100
-Subject: PATCH 1/4 Issue #3404 Updated QCSV Double usage
+From: Markus Koschany <apo@debian.org>
+Date: Sat, 31 Jul 2021 17:24:07 +0200
+Subject: CVE-2021-28165
 
-Signed-off-by: Greg Wilkins <gregw@webtide.com>
 ---
- .../eclipse/jetty/http/QuotedQualityCSV.java | 58 ++++++++++---------
- 1 file changed, 30 insertions(+), 28 deletions(-)
+ .../org/eclipse/jetty/io/ssl/SslConnection.java | 12 +
+ .../eclipse/jetty/server/ssl/SSLEngineTest.java | 267 +++++++++++++--------
+ 2 files changed, 183 insertions(+), 96 deletions(-)
 
-diff --git a/jetty-http/src/main/java/org/eclipse/jetty/http/QuotedQualityCSV.java b/jetty-http/src/main/java/org/eclipse/jetty/http/QuotedQualityCSV.java
-index 61cee88bfd5..c7047c57a4b 100644
---- a/jetty-http/src/main/java/org/eclipse/jetty/http/QuotedQualityCSV.java
-+++ b/jetty-http/src/main/java/org/eclipse/jetty/http/QuotedQualityCSV.java
-@@ -25,6 +25,8 @@
- import java.util.List;
- import java.util.function.Function;
- 
-+import org.eclipse.jetty.util.log.Log;
-+
- /* ------------------------------------------------------------ */
- /**
- * Implements a quoted comma separated list of quality values
-@@ -37,21 +39,16 @@
- */
- public class QuotedQualityCSV extends QuotedCSV implements Iterable<String>
- { 
-- private final static Double ZERO=new Double(0.0);
-- private final static Double ONE=new Double(1.0);
-- 
-+ private final static Double ZERO = 0.0D;
-+ private final static Double ONE = 1.0D;
- 
- /**
-- * Function to apply a most specific MIME encoding secondary ordering 
-+ * Lambda to apply a most specific MIME encoding secondary ordering
- */
-- public static Function<String, Integer> MOST_SPECIFIC = new Function<String, Integer>()
-+ public static Function<String, Integer> MOST_SPECIFIC = s ->
- {
-- @Override
-- public Integer apply(String s)
-- {
-- String elements = s.split("/");
-- return 1000000*elements.length+1000*elements0.length()+elementselements.length-1.length();
-- }
-+ String elements = s.split("/");
-+ return 1000000*elements.length+1000*elements0.length()+elementselements.length-1.length();
- };
- 
- private final List<Double> _quality = new ArrayList<>();
-@@ -74,7 +71,8 @@ public QuotedQualityCSV()
- */
- public QuotedQualityCSV(String preferredOrder)
- {
-- this((s) -> {
-+ this((s) ->
-+ {
- for (int i=0;i<preferredOrder.length;++i)
- if (preferredOrderi.equals(s))
- return preferredOrder.length-i;
-@@ -101,6 +99,8 @@ public QuotedQualityCSV(Function<String, Integer> secondaryOrdering)
- protected void parsedValue(StringBuffer buffer)
- {
- super.parsedValue(buffer);
-+
-+ // Assume a quality of ONE
- _quality.add(ONE);
+diff --git a/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java b/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java
+index a2c1fdc..c385f27 100644
+--- a/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java
++++ b/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java
+@@ -330,6 +330,11 @@ public class SslConnection extends AbstractConnection implements Connection.Upgr
+ _decryptedEndPoint.onFillableFail(cause == null ? new IOException() : cause);
 }
 
-@@ -108,30 +108,32 @@ protected void parsedValue(StringBuffer buffer)
++ protected SSLEngineResult unwrap(SSLEngine sslEngine, ByteBuffer input, ByteBuffer output) throws SSLException
++ {
++ return sslEngine.unwrap(input, output);
++ }
++
 @Override
- protected void parsedParam(StringBuffer buffer, int valueLength, int paramName, int paramValue)
+ public String toConnectionString()
 {
-- if (paramName<0)
-+ if (paramName < 0)
- {
-- if (buffer.charAt(buffer.length()-1)==';')
-- buffer.setLength(buffer.length()-1);
-+ if (buffer.charAt(buffer.length() - 1) == ';')
-+ buffer.setLength(buffer.length() - 1);
- }
-- else if (paramValue>=0 && 
-- buffer.charAt(paramName)=='q' && paramValue>paramName && 
-- buffer.length()>=paramName && buffer.charAt(paramName+1)=='=')
-+ else if (paramValue >= 0 &&
-+ buffer.charAt(paramName) == 'q' && paramValue > paramName &&
-+ buffer.length() >= paramName && buffer.charAt(paramName + 1) == '=')
- {
- Double q;
- try
- {
-- q=(_keepQuotes && buffer.charAt(paramValue)=='"')
-- ?new Double(buffer.substring(paramValue+1,buffer.length()-1))
-- :new Double(buffer.substring(paramValue));
-+ q = (_keepQuotes && buffer.charAt(paramValue) == '"')
-+ ? Double.valueOf(buffer.substring(paramValue + 1, buffer.length() - 1))
-+ : Double.valueOf(buffer.substring(paramValue));
- }
-- catch(Exception e)
-+ catch (Exception e)
- {
-- q=ZERO;
-- } 
-- buffer.setLength(Math.max(0,paramName-1));
-- 
-- if (!ONE.equals(q))
-- _quality.set(_quality.size()-1,q);
-+ Log.getLogger(QuotedQualityCSV.class).ignore(e);
-+ q = ZERO;
-+ }
-+ buffer.setLength(Math.max(0, paramName - 1));
+@@ -602,8 +607,15 @@ public class SslConnection extends AbstractConnection implements Connection.Upgr
+ return filled = -1;
+ 
+ case BUFFER_UNDERFLOW:
++ if (BufferUtil.space(_encryptedInput) == 0)
++ {
++ BufferUtil.clear(_encryptedInput);
++ throw new SSLHandshakeException("Encrypted buffer max length exceeded");
++ }
 +
-+ if (!ONE.equals(q))
-+ // replace assumed quality
-+ _quality.set(_quality.size() - 1, q);
- }
- }
+ if (net_filled > 0)
+ continue; // try filling some more
++
+ _underflown = true;
+ if (net_filled < 0 && _sslEngine.getUseClientMode())
+ {
+diff --git a/jetty-server/src/test/java/org/eclipse/jetty/server/ssl/SSLEngineTest.java b/jetty-server/src/test/java/org/eclipse/jetty/server/ssl/SSLEngineTest.java
+index ae6a5b6..aa1b9c9 100644
+--- a/jetty-server/src/test/java/org/eclipse/jetty/server/ssl/SSLEngineTest.java
++++ b/jetty-server/src/test/java/org/eclipse/jetty/server/ssl/SSLEngineTest.java
+@@ -1,6 +1,6 @@
+ //
+ // ========================================================================
+-// Copyright (c) 1995-2019 Mort Bay Consulting Pty. Ltd.
++// Copyright (c) 1995-2021 Mort Bay Consulting Pty Ltd and others.
+ // ------------------------------------------------------------------------
+ // All rights reserved. This program and the accompanying materials
+ // are made available under the terms of the Eclipse Public License v1.0
+@@ -34,20 +34,31 @@ import java.net.Socket;
+ import java.net.SocketException;
+ import java.net.SocketTimeoutException;
+ import java.net.URL;
+-
++import java.nio.ByteBuffer;
++import java.util.Arrays;
++import java.util.concurrent.atomic.AtomicLong;
++import javax.net.SocketFactory;
+ import javax.net.ssl.HostnameVerifier;
+ import javax.net.ssl.HttpsURLConnection;
+ import javax.net.ssl.SSLContext;
++import javax.net.ssl.SSLEngine;
++import javax.net.ssl.SSLEngineResult;
++import javax.net.ssl.SSLException;
+ import javax.net.ssl.SSLSession;
+ import javax.servlet.ServletException;
+ import javax.servlet.ServletOutputStream;
+ import javax.servlet.http.HttpServletRequest;
+ import javax.servlet.http.HttpServletResponse;
 
-
-From ca8a10a9d5a50e7d814c65134144f776bff1c07a Mon Sep 17 00:00:00 2001
-From: Greg Wilkins <gregw@webtide.com>
-Date: Fri, 1 Mar 2019 10:17:02 +1100
-Subject: PATCH 2/4 Issue #3404 Cleanup QCSV mime ordering
-
-Signed-off-by: Greg Wilkins <gregw@webtide.com>
----
- .../org/eclipse/jetty/http/HttpFields.java | 16 ++++++++-
- .../eclipse/jetty/http/QuotedQualityCSV.java | 35 ++++++++++---------
- .../jetty/http/QuotedQualityCSVTest.java | 2 +-
- .../jetty/server/handler/ErrorHandler.java | 3 +-
- 4 files changed, 37 insertions(+), 19 deletions(-)
-
-diff --git a/jetty-http/src/main/java/org/eclipse/jetty/http/HttpFields.java b/jetty-http/src/main/java/org/eclipse/jetty/http/HttpFields.java

_service:tar_scm:CVE-2021-28169.patch Changed

@@ -1,30 +1,24 @@
-From aec4092cc718b61998c1de221c9c728f377cd430 Mon Sep 17 00:00:00 2001
-From: Lachlan <lachlan@webtide.com>
-Date: Thu, 13 May 2021 01:13:30 +1000
-Subject: PATCH Fixes #6263 - Review URI encoding in ConcatServlet &
-WelcomeFilter.
+From: Markus Koschany <apo@debian.org>
+Date: Sat, 3 Jul 2021 20:47:31 +0200
+Subject: CVE-2021-28169
 
-Review URI encoding in ConcatServlet & WelcomeFilter and improve testing.
-
-Signed-off-by: Lachlan Roberts <lachlan@webtide.com>
-Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
-Co-authored-by: Simone Bordet <simone.bordet@gmail.com>
+Origin: https://github.com/eclipse/jetty.project/commit/1c05b0bcb181c759e98b060bded0b9376976b055
 ---
- .../eclipse/jetty/server/ResourceService.java | 4 +-
- .../eclipse/jetty/servlets/ConcatServlet.java | 4 +-
- .../eclipse/jetty/servlets/WelcomeFilter.java | 8 +-
- .../jetty/servlets/ConcatServletTest.java | 83 ++++++----
- .../jetty/servlets/WelcomeFilterTest.java | 143 ++++++++++++++++++
- .../webapp/WebAppDefaultServletTest.java | 142 +++++++++++++++++
- 6 files changed, 353 insertions(+), 31 deletions(-)
+ .../org/eclipse/jetty/server/ResourceService.java | 4 +-
+ .../org/eclipse/jetty/servlets/ConcatServlet.java | 4 +-
+ .../org/eclipse/jetty/servlets/WelcomeFilter.java | 8 +-
+ .../eclipse/jetty/servlets/ConcatServletTest.java | 34 +++--
+ .../eclipse/jetty/servlets/WelcomeFilterTest.java | 143 +++++++++++++++++++++
+ .../jetty/webapp/WebAppDefaultServletTest.java | 142 ++++++++++++++++++++
+ 6 files changed, 313 insertions(+), 22 deletions(-)
 create mode 100644 jetty-servlets/src/test/java/org/eclipse/jetty/servlets/WelcomeFilterTest.java
 create mode 100644 jetty-webapp/src/test/java/org/eclipse/jetty/webapp/WebAppDefaultServletTest.java
 
 diff --git a/jetty-server/src/main/java/org/eclipse/jetty/server/ResourceService.java b/jetty-server/src/main/java/org/eclipse/jetty/server/ResourceService.java
-index 3d3f05c..5ce24b4 100644
+index 048bd71..737f461 100644
 --- a/jetty-server/src/main/java/org/eclipse/jetty/server/ResourceService.java
 +++ b/jetty-server/src/main/java/org/eclipse/jetty/server/ResourceService.java
-@@ -236,7 +236,7 @@ public class ResourceService
+@@ -234,7 +234,7 @@ public class ResourceService
 // Find the content
 content=_contentFactory.getContent(pathInContext,response.getBufferSize());
 if (LOG.isDebugEnabled())
@@ -33,12 +27,12 @@
 
 // Not found?
 if (content==null || !content.getResource().exists())
-@@ -422,7 +422,7 @@ public class ResourceService
+@@ -420,7 +420,7 @@ public class ResourceService
 return;
 }
 
 - RequestDispatcher dispatcher=context.getRequestDispatcher(welcome);
-+	 RequestDispatcher dispatcher = context.getRequestDispatcher(URIUtil.encodePath(welcome));
++ RequestDispatcher dispatcher = context.getRequestDispatcher(URIUtil.encodePath(welcome));
 if (dispatcher!=null)
 {
 // Forward to the index
@@ -65,7 +59,7 @@
 dispatchers.add(dispatcher);
 }
 diff --git a/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/WelcomeFilter.java b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/WelcomeFilter.java
-index e67a067..492a8ca 100644
+index e67a067..22ea603 100644
 --- a/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/WelcomeFilter.java
 +++ b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/WelcomeFilter.java
 @@ -28,6 +28,8 @@ import javax.servlet.ServletRequest;
@@ -92,140 +86,114 @@
 - request.getRequestDispatcher(path+welcome).forward(request,response);
 + {
 + String uriInContext = URIUtil.encodePath(URIUtil.addPaths(path, welcome));
-+	 request.getRequestDispatcher(uriInContext).forward(request, response);
-+	}
++ request.getRequestDispatcher(uriInContext).forward(request, response);
++ }
 else
 chain.doFilter(request, response);
 }
 diff --git a/jetty-servlets/src/test/java/org/eclipse/jetty/servlets/ConcatServletTest.java b/jetty-servlets/src/test/java/org/eclipse/jetty/servlets/ConcatServletTest.java
-index 3fcb9af..b815b35 100644
+index 3fcb9af..f8ea087 100644
 --- a/jetty-servlets/src/test/java/org/eclipse/jetty/servlets/ConcatServletTest.java
 +++ b/jetty-servlets/src/test/java/org/eclipse/jetty/servlets/ConcatServletTest.java
-@@ -32,6 +32,7 @@ import java.nio.charset.StandardCharsets;
+@@ -1,6 +1,6 @@
+ //
+ // ========================================================================
+-// Copyright (c) 1995-2019 Mort Bay Consulting Pty. Ltd.
++// Copyright (c) 1995-2021 Mort Bay Consulting Pty Ltd and others.
+ // ------------------------------------------------------------------------
+ // All rights reserved. This program and the accompanying materials
+ // are made available under the terms of the Eclipse Public License v1.0
+@@ -18,11 +18,6 @@
+ 
+ package org.eclipse.jetty.servlets;
+ 
+-import static org.junit.jupiter.api.Assertions.assertEquals;
+-import static org.junit.jupiter.api.Assertions.assertNotNull;
+-import static org.junit.jupiter.api.Assertions.assertNull;
+-import static org.junit.jupiter.api.Assertions.assertTrue;
+-
+ import java.io.BufferedReader;
+ import java.io.File;
+ import java.io.IOException;
+@@ -31,7 +26,6 @@ import java.io.StringReader;
+ import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
- 
-+import java.util.stream.Stream;
+-
 import javax.servlet.RequestDispatcher;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServlet;
-@@ -48,7 +49,12 @@ import org.junit.jupiter.api.AfterEach;
- 
+@@ -45,10 +39,14 @@ import org.eclipse.jetty.servlet.ServletHolder;
+ import org.eclipse.jetty.toolchain.test.MavenTestingUtils;
+ import org.eclipse.jetty.webapp.WebAppContext;
+ import org.junit.jupiter.api.AfterEach;
+-
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
-+import org.junit.jupiter.params.ParameterizedTest;
-+import org.junit.jupiter.params.provider.Arguments;
-+import org.junit.jupiter.params.provider.MethodSource;
 
-+import static org.hamcrest.MatcherAssert.assertThat;
-+import static org.hamcrest.Matchers.startsWith;
++import static org.junit.jupiter.api.Assertions.assertEquals;
++import static org.junit.jupiter.api.Assertions.assertNotNull;
++import static org.junit.jupiter.api.Assertions.assertNull;
++import static org.junit.jupiter.api.Assertions.assertTrue;
++
 public class ConcatServletTest
 {
 private Server server;
-@@ -114,7 +120,7 @@ public class ConcatServletTest
- }
- 
- @Test
-- public void testWEBINFResourceIsNotServed() throws Exception
-+ public void testDirectoryNotAccessible() throws Exception
- {
- File directoryFile = MavenTestingUtils.getTargetTestingDir();
- Path directoryPath = directoryFile.toPath();
-@@ -136,9 +142,8 @@ public class ConcatServletTest
- // Verify that I can get the file programmatically, as required by the spec.
- assertNotNull(context.getServletContext().getResource("/WEB-INF/one.js"));
- 
-- // Having a path segment and then ".." triggers a special case
-- // that the ConcatServlet must detect and avoid.
-- String uri = contextPath + concatPath + "?/trick/../WEB-INF/one.js";
-+	// Make sure ConcatServlet cannot see file system files.
-+	String uri = contextPath + concatPath + "?/trick/../../" + directoryFile.getName();
- String request = "" +
- "GET " + uri + " HTTP/1.1\r\n" +
+@@ -92,8 +90,8 @@ public class ConcatServletTest
+ String resource1 = "/resource/one.js";
+ String resource2 = "/resource/two.js";
+ String uri = contextPath + concatPath + "?" + resource1 + "&" + resource2;
+- String request = "" +
+- "GET " + uri + " HTTP/1.1\r\n" +
++ String request =
++ "GET " + uri + " HTTP/1.1\r\n" +
 "Host: localhost\r\n" +
-@@ -146,35 +151,59 @@ public class ConcatServletTest
+ "Connection: close\r\n" +
 "\r\n";
- String response = connector.getResponse(request);
- assertTrue(response.startsWith("HTTP/1.1 404 "));
-+ }
+@@ -139,8 +137,8 @@ public class ConcatServletTest
+ // Having a path segment and then ".." triggers a special case
+ // that the ConcatServlet must detect and avoid.
+ String uri = contextPath + concatPath + "?/trick/../WEB-INF/one.js";
+- String request = "" +
+- "GET " + uri + " HTTP/1.1\r\n" +
++ String request =
++ "GET " + uri + " HTTP/1.1\r\n" +
+ "Host: localhost\r\n" +
+ "Connection: close\r\n" +
+ "\r\n";
+@@ -149,8 +147,8 @@ public class ConcatServletTest
 
-- // Make sure ConcatServlet behaves well if it's case insensitive.
-- uri = contextPath + concatPath + "?/trick/../web-inf/one.js";
+ // Make sure ConcatServlet behaves well if it's case insensitive.
+ uri = contextPath + concatPath + "?/trick/../web-inf/one.js";
 - request = "" +
 - "GET " + uri + " HTTP/1.1\r\n" +
-- "Host: localhost\r\n" +
-- "Connection: close\r\n" +
-- "\r\n";
-- response = connector.getResponse(request);
-- assertTrue(response.startsWith("HTTP/1.1 404 "));
-+ public static Stream<Arguments> webInfTestExamples()
-+ {
-+ return Stream.of(

_service:tar_scm:CVE-2021-34428.patch Changed

@@ -1,21 +1,16 @@
-From 91d9850d64076cad97611a3379775e01acddf986 Mon Sep 17 00:00:00 2001
-From: Jan Bartel <janb@webtide.com>
-Date: Sun, 16 May 2021 09:45:50 +1000
-Subject: PATCH Issue #6277 Better handling of exceptions thrown in
- sessionDestroyed (#6278)
-
-* Issue #6277 Better handling of exceptions thrown in sessionDestroyed
-
-Signed-off-by: Jan Bartel <janb@webtide.com>
+From: Markus Koschany <apo@debian.org>
+Date: Sat, 3 Jul 2021 20:28:06 +0200
+Subject: CVE-2021-34428
 
+Origin: https://github.com/eclipse/jetty.project/commit/cd6462a6252d083b3c9ea2684aab0b4c9669ed19
 ---
- .../eclipse/jetty/server/session/Session.java | 9 +-
- .../session/TestHttpSessionListener.java | 26 ++++--
- .../server/session/SessionListenerTest.java | 82 +++++++++++++++++--
- 3 files changed, 102 insertions(+), 15 deletions(-)
+ .../org/eclipse/jetty/server/session/Session.java | 9 +-
+ .../server/session/TestHttpSessionListener.java | 24 +-
+ .../jetty/server/session/SessionListenerTest.java | 367 +++++++++++++++------
+ 3 files changed, 291 insertions(+), 109 deletions(-)
 
 diff --git a/jetty-server/src/main/java/org/eclipse/jetty/server/session/Session.java b/jetty-server/src/main/java/org/eclipse/jetty/server/session/Session.java
-index a34bc0f..ecaf7c7 100644
+index a34bc0f..d667560 100644
 --- a/jetty-server/src/main/java/org/eclipse/jetty/server/session/Session.java
 +++ b/jetty-server/src/main/java/org/eclipse/jetty/server/session/Session.java
 @@ -506,6 +506,7 @@ public class Session implements SessionHandler.SessionIf
@@ -30,17 +25,17 @@
 // do the invalidation
 _handler.callSessionDestroyedListeners(this);
 }
-+		catch (Exception e)
-+		{
-+		 LOG.warn("Error during Session destroy listener", e);
-+		}
++ catch (Exception e)
++ {
++ LOG.warn("Error during Session destroy listener", e);
++ }
 finally
 {
 // call the attribute removed listeners and finally mark it
 // as invalid
 finishInvalidate();
-+		 // tell id mgr to remove sessions with same id from all contexts
-+		 _handler.getSessionIdManager().invalidateAll(_sessionData.getId());
++ // tell id mgr to remove sessions with same id from all contexts
++ _handler.getSessionIdManager().invalidateAll(_sessionData.getId());
 }
 - // tell id mgr to remove sessions with same id from all contexts
 - _handler.getSessionIdManager().invalidateAll(_sessionData.getId());
@@ -48,16 +43,14 @@
 }
 catch (Exception e)
 diff --git a/tests/test-sessions/test-sessions-common/src/main/java/org/eclipse/jetty/server/session/TestHttpSessionListener.java b/tests/test-sessions/test-sessions-common/src/main/java/org/eclipse/jetty/server/session/TestHttpSessionListener.java
-index 770627b..b736fdf 100644
+index 770627b..dd8982f 100644
 --- a/tests/test-sessions/test-sessions-common/src/main/java/org/eclipse/jetty/server/session/TestHttpSessionListener.java
 +++ b/tests/test-sessions/test-sessions-common/src/main/java/org/eclipse/jetty/server/session/TestHttpSessionListener.java
-@@ -34,17 +34,19 @@ public class TestHttpSessionListener implements HttpSessionListener
- {
+@@ -35,16 +35,18 @@ public class TestHttpSessionListener implements HttpSessionListener
 public List<String> createdSessions = new ArrayList<>();
 public List<String> destroyedSessions = new ArrayList<>();
-- public boolean accessAttribute = false;
+ public boolean accessAttribute = false;
 - public Exception ex = null;
-+ public boolean accessAttribute = false; 
 + public boolean lastAccessTime = false;
 + public Exception attributeException = null;
 + public Exception accessTimeException = null;
@@ -67,7 +60,7 @@
 {
 - accessAttribute = access;
 + this.accessAttribute = accessAttribute;
-+	this.lastAccessTime = lastAccessTime;
++ this.lastAccessTime = lastAccessTime;
 }
 
 public TestHttpSessionListener()
@@ -76,55 +69,182 @@
 }
 
 public void sessionDestroyed(HttpSessionEvent se)
-@@ -58,9 +60,21 @@ public class TestHttpSessionListener implements HttpSessionListener
+@@ -58,7 +60,19 @@ public class TestHttpSessionListener implements HttpSessionListener
 }
 catch (Exception e)
 {
 - ex = e;
 + attributeException = e;
- }
- }
-+
-+	if (lastAccessTime)
-+	{
-+	 try
++ }
++ }
++ 
++ if (lastAccessTime)
++ {
++ try
 + {
-+ se.getSession().getLastAccessedTime();
-+	 }
-+	 catch (Exception e)
++ se.getSession().getLastAccessedTime();
++ }
++ catch (Exception e)
 + {
-+		 accessTimeException = e;
-+	 }
-+	}
++ accessTimeException = e;
+ }
+ }
 }
- 
- public void sessionCreated(HttpSessionEvent se)
 diff --git a/tests/test-sessions/test-sessions-common/src/test/java/org/eclipse/jetty/server/session/SessionListenerTest.java b/tests/test-sessions/test-sessions-common/src/test/java/org/eclipse/jetty/server/session/SessionListenerTest.java
-index ba83986..24ac045 100644
+index ba83986..363d1e3 100644
 --- a/tests/test-sessions/test-sessions-common/src/test/java/org/eclipse/jetty/server/session/SessionListenerTest.java
 +++ b/tests/test-sessions/test-sessions-common/src/test/java/org/eclipse/jetty/server/session/SessionListenerTest.java
-@@ -21,6 +21,7 @@ package org.eclipse.jetty.server.session;
- import static org.hamcrest.MatcherAssert.assertThat;
- import static org.hamcrest.Matchers.isIn;
- import static org.junit.jupiter.api.Assertions.assertEquals;
+@@ -1,6 +1,6 @@
+ //
+ // ========================================================================
+-// Copyright (c) 1995-2019 Mort Bay Consulting Pty. Ltd.
++// Copyright (c) 1995-2021 Mort Bay Consulting Pty Ltd and others.
+ // ------------------------------------------------------------------------
+ // All rights reserved. This program and the accompanying materials
+ // are made available under the terms of the Eclipse Public License v1.0
+@@ -18,19 +18,17 @@
+ 
+ package org.eclipse.jetty.server.session;
+ 
+-import static org.hamcrest.MatcherAssert.assertThat;
+-import static org.hamcrest.Matchers.isIn;
+-import static org.junit.jupiter.api.Assertions.assertEquals;
+-import static org.junit.jupiter.api.Assertions.assertNotEquals;
+-import static org.junit.jupiter.api.Assertions.assertNotNull;
+-import static org.junit.jupiter.api.Assertions.assertNull;
+-import static org.junit.jupiter.api.Assertions.assertTrue;
+-
+ import java.io.IOException;
++import java.io.InputStream;
++import java.io.OutputStream;
+ import java.io.Serializable;
+ import java.net.HttpCookie;
++import java.net.URL;
++import java.net.URLClassLoader;
++import java.nio.file.Files;
++import java.nio.file.Path;
++import java.util.Collection;
+ import java.util.concurrent.TimeUnit;
+-
+ import javax.servlet.ServletException;
+ import javax.servlet.http.HttpServlet;
+ import javax.servlet.http.HttpServletRequest;
+@@ -38,53 +36,140 @@ import javax.servlet.http.HttpServletResponse;
+ import javax.servlet.http.HttpSession;
+ import javax.servlet.http.HttpSessionBindingEvent;
+ import javax.servlet.http.HttpSessionBindingListener;
++import javax.servlet.http.HttpSessionEvent;
++import javax.servlet.http.HttpSessionListener;
+ 
+ import org.eclipse.jetty.client.HttpClient;
+ import org.eclipse.jetty.client.api.ContentResponse;
+ import org.eclipse.jetty.client.api.Request;
++import org.eclipse.jetty.server.Server;
+ import org.eclipse.jetty.servlet.ServletContextHandler;
+ import org.eclipse.jetty.servlet.ServletHolder;
++import org.eclipse.jetty.toolchain.test.IO;
++import org.eclipse.jetty.toolchain.test.jupiter.WorkDir;
++import org.eclipse.jetty.toolchain.test.jupiter.WorkDirExtension;
++import org.eclipse.jetty.util.component.LifeCycle;
++import org.eclipse.jetty.webapp.WebAppContext;
+ import org.junit.jupiter.api.Test;
++import org.junit.jupiter.api.extension.ExtendWith;
++import org.junit.jupiter.api.Disabled;
++
++import static org.hamcrest.MatcherAssert.assertThat;
++import static org.hamcrest.Matchers.greaterThan;
++//import static org.hamcrest.Matchers.in;
++import static org.hamcrest.Matchers.is;
++import static org.junit.jupiter.api.Assertions.assertEquals;
 +import static org.junit.jupiter.api.Assertions.assertFalse;
- import static org.junit.jupiter.api.Assertions.assertNotEquals;
- import static org.junit.jupiter.api.Assertions.assertNotNull;
- import static org.junit.jupiter.api.Assertions.assertNull;
-@@ -74,7 +75,7 @@ public class SessionListenerTest

_service:tar_scm:CVE-2020-27223-pre-2.patch -> _service:tar_scm:CVE-2022-2047.patch Changed

@@ -1,692 +1,326 @@
-From 05072b34dce43064e87ad0d59065f14666c1f34e Mon Sep 17 00:00:00 2001
-From: Greg Wilkins <gregw@webtide.com>
-Date: Wed, 8 May 2019 13:28:16 +0200
-Subject: PATCH Issue #3630 Forwarded-Port
+From: Markus Koschany <apo@debian.org>
+Date: Wed, 17 Aug 2022 12:58:27 +0200
+Subject: CVE-2022-2047
 
-Added support for the X-Forwarded-Port header.
-Reimplemented header scanning using more efficient Trie and MethodHandles
-
-Signed-off-by: Greg Wilkins <gregw@webtide.com>
+Origin: https://github.com/eclipse/jetty.project/pull/8146
 ---
- .../eclipse/jetty/http/HostPortHttpField.java | 13 +
- .../org/eclipse/jetty/http/HttpHeader.java | 1 +
- .../main/config/etc/jetty-http-forwarded.xml | 1 +
- .../main/config/modules/http-forwarded.mod | 1 +
- .../server/ForwardedRequestCustomizer.java | 274 +++++++++++++-----
- .../ForwardedRequestCustomizerTest.java | 27 +-
- .../java/org/eclipse/jetty/util/HostPort.java | 30 +-
- .../org/eclipse/jetty/util/HostPortTest.java | 13 +-
- 8 files changed, 269 insertions(+), 91 deletions(-)
+ .../java/org/eclipse/jetty/client/HttpRequest.java | 8 +-
+ .../eclipse/jetty/client/HttpClientURITest.java | 45 ++++++++++
+ .../main/java/org/eclipse/jetty/http/HttpURI.java | 25 +++++-
+ .../java/org/eclipse/jetty/http/HttpURITest.java | 95 ++++++++++++++++++++++
+ .../org/eclipse/jetty/proxy/ConnectHandler.java | 2 +-
+ .../java/org/eclipse/jetty/server/Request.java | 14 +++-
+ .../eclipse/jetty/server/HttpConnectionTest.java | 12 +--
+ 7 files changed, 187 insertions(+), 14 deletions(-)
 
-diff --git a/jetty-http/src/main/java/org/eclipse/jetty/http/HostPortHttpField.java b/jetty-http/src/main/java/org/eclipse/jetty/http/HostPortHttpField.java
-index 215c353b4b9..dc386665339 100644
---- a/jetty-http/src/main/java/org/eclipse/jetty/http/HostPortHttpField.java
-+++ b/jetty-http/src/main/java/org/eclipse/jetty/http/HostPortHttpField.java
-@@ -49,6 +49,19 @@ protected HostPortHttpField(HttpHeader header, String name, String authority)
- }
+diff --git a/jetty-client/src/main/java/org/eclipse/jetty/client/HttpRequest.java b/jetty-client/src/main/java/org/eclipse/jetty/client/HttpRequest.java
+index f6a453f..2d2afa0 100644
+--- a/jetty-client/src/main/java/org/eclipse/jetty/client/HttpRequest.java
++++ b/jetty-client/src/main/java/org/eclipse/jetty/client/HttpRequest.java
+@@ -177,6 +177,8 @@ public class HttpRequest implements Request
+ String rawPath = uri.getRawPath();
+ if (rawPath == null)
+ rawPath = "";
++ if (!rawPath.startsWith("/"))
++ rawPath = "/" + rawPath;
+ this.path = rawPath;
+ String query = uri.getRawQuery();
+ if (query != null)
+@@ -855,14 +857,14 @@ public class HttpRequest implements Request
+ return result;
 }
 
-+ /* ------------------------------------------------------------ */
-+ public HostPortHttpField(String host, int port)
-+ {
-+ this(new HostPort(host, port));
-+ }
-+
-+ /* ------------------------------------------------------------ */
-+ protected HostPortHttpField(HostPort hostport)
-+ {
-+ super(HttpHeader.HOST,HttpHeader.HOST.asString(),hostport.toString());
-+ _hostPort = hostport;
-+ }
-+
- /* ------------------------------------------------------------ */
- /** Get the host.
- * @return the host
-diff --git a/jetty-http/src/main/java/org/eclipse/jetty/http/HttpHeader.java b/jetty-http/src/main/java/org/eclipse/jetty/http/HttpHeader.java
-index f39c0f7df98..ac6bf2be8da 100644
---- a/jetty-http/src/main/java/org/eclipse/jetty/http/HttpHeader.java
-+++ b/jetty-http/src/main/java/org/eclipse/jetty/http/HttpHeader.java
-@@ -82,6 +82,7 @@
- TE("TE"),
- USER_AGENT("User-Agent"),
- X_FORWARDED_FOR("X-Forwarded-For"),
-+ X_FORWARDED_PORT("X-Forwarded-Port"),
- X_FORWARDED_PROTO("X-Forwarded-Proto"),
- X_FORWARDED_SERVER("X-Forwarded-Server"),
- X_FORWARDED_HOST("X-Forwarded-Host"),
-diff --git a/jetty-server/src/main/config/etc/jetty-http-forwarded.xml b/jetty-server/src/main/config/etc/jetty-http-forwarded.xml
-index 50b80976a2a..648d6c6a94f 100644
---- a/jetty-server/src/main/config/etc/jetty-http-forwarded.xml
-+++ b/jetty-server/src/main/config/etc/jetty-http-forwarded.xml
-@@ -11,6 +11,7 @@
- <Set name="forwardedServerHeader"><Property name="jetty.httpConfig.forwardedServerHeader" default="X-Forwarded-Server"/></Set>
- <Set name="forwardedProtoHeader"><Property name="jetty.httpConfig.forwardedProtoHeader" default="X-Forwarded-Proto"/></Set>
- <Set name="forwardedForHeader"><Property name="jetty.httpConfig.forwardedForHeader" default="X-Forwarded-For"/></Set>
-+ <Set name="forwardedPortHeader"><Property name="jetty.httpConfig.forwardedPortHeader" default="X-Forwarded-Port"/></Set>
- <Set name="forwardedHttpsHeader"><Property name="jetty.httpConfig.forwardedHttpsHeader" default="X-Proxied-Https"/></Set>
- <Set name="forwardedSslSessionIdHeader"><Property name="jetty.httpConfig.forwardedSslSessionIdHeader" default="Proxy-ssl-id" /></Set>
- <Set name="forwardedCipherSuiteHeader"><Property name="jetty.httpConfig.forwardedCipherSuiteHeader" default="Proxy-auth-cert"/></Set>
-diff --git a/jetty-server/src/main/config/modules/http-forwarded.mod b/jetty-server/src/main/config/modules/http-forwarded.mod
-index 34e25642b2c..f67822065a4 100644
---- a/jetty-server/src/main/config/modules/http-forwarded.mod
-+++ b/jetty-server/src/main/config/modules/http-forwarded.mod
-@@ -23,6 +23,7 @@ etc/jetty-http-forwarded.xml
- # jetty.httpConfig.forwardedServerHeader=X-Forwarded-Server
- # jetty.httpConfig.forwardedProtoHeader=X-Forwarded-Proto
- # jetty.httpConfig.forwardedForHeader=X-Forwarded-For
-+# jetty.httpConfig.forwardedPortHeader=X-Forwarded-Port
- # jetty.httpConfig.forwardedHttpsHeader=X-Proxied-Https
- # jetty.httpConfig.forwardedSslSessionIdHeader=Proxy-ssl-id
- # jetty.httpConfig.forwardedCipherSuiteHeader=Proxy-auth-cert
-diff --git a/jetty-server/src/main/java/org/eclipse/jetty/server/ForwardedRequestCustomizer.java b/jetty-server/src/main/java/org/eclipse/jetty/server/ForwardedRequestCustomizer.java
-index f2ffe24fb85..1e64892cbe9 100644
---- a/jetty-server/src/main/java/org/eclipse/jetty/server/ForwardedRequestCustomizer.java
-+++ b/jetty-server/src/main/java/org/eclipse/jetty/server/ForwardedRequestCustomizer.java
-@@ -18,6 +18,9 @@
- 
- package org.eclipse.jetty.server;
- 
-+import java.lang.invoke.MethodHandle;
-+import java.lang.invoke.MethodHandles;
-+import java.lang.invoke.MethodType;
- import java.net.InetSocketAddress;
- 
- import javax.servlet.ServletRequest;
-@@ -29,11 +32,15 @@
- import org.eclipse.jetty.http.HttpScheme;
- import org.eclipse.jetty.http.QuotedCSV;
- import org.eclipse.jetty.server.HttpConfiguration.Customizer;
-+import org.eclipse.jetty.util.ArrayTrie;
- import org.eclipse.jetty.util.HostPort;
- import org.eclipse.jetty.util.StringUtil;
-+import org.eclipse.jetty.util.Trie;
- import org.eclipse.jetty.util.log.Log;
- import org.eclipse.jetty.util.log.Logger;
- 
-+import static java.lang.invoke.MethodType.methodType;
-+
- 
- /* ------------------------------------------------------------ */
- /** Customize Requests for Proxy Forwarding.
-@@ -63,14 +70,21 @@
- private String _forwardedHeader = HttpHeader.FORWARDED.toString();
- private String _forwardedHostHeader = HttpHeader.X_FORWARDED_HOST.toString();
- private String _forwardedServerHeader = HttpHeader.X_FORWARDED_SERVER.toString();
-- private String _forwardedForHeader = HttpHeader.X_FORWARDED_FOR.toString();
- private String _forwardedProtoHeader = HttpHeader.X_FORWARDED_PROTO.toString();
-+ private String _forwardedForHeader = HttpHeader.X_FORWARDED_FOR.toString();
-+ private String _forwardedPortHeader = HttpHeader.X_FORWARDED_PORT.toString();
- private String _forwardedHttpsHeader = "X-Proxied-Https";
- private String _forwardedCipherSuiteHeader = "Proxy-auth-cert";
- private String _forwardedSslSessionIdHeader = "Proxy-ssl-id";
- private boolean _proxyAsAuthority=false;
- private boolean _sslIsSecure=true;
-- 
-+ private Trie <MethodHandle> _handles;
-+
-+ public ForwardedRequestCustomizer()
-+ {
-+ updateHandles();
-+ }
-+
- /**
- * @return true if the proxy address obtained via
- * {@code X-Forwarded-Server} or RFC7239 "by" is used as
-@@ -103,9 +117,9 @@ public void setForwardedOnly(boolean rfc7239only)
- if (_forwardedHeader==null)
- _forwardedHeader=HttpHeader.FORWARDED.toString();
- _forwardedHostHeader=null;
-- _forwardedHostHeader=null;
- _forwardedServerHeader=null;
- _forwardedForHeader=null;
-+ _forwardedPortHeader=null;
- _forwardedProtoHeader=null;
- _forwardedHttpsHeader=null;
- }
-@@ -117,11 +131,15 @@ public void setForwardedOnly(boolean rfc7239only)
- _forwardedServerHeader = HttpHeader.X_FORWARDED_SERVER.toString();
- if (_forwardedForHeader==null)
- _forwardedForHeader = HttpHeader.X_FORWARDED_FOR.toString();
-+ if (_forwardedPortHeader==null)
-+ _forwardedPortHeader = HttpHeader.X_FORWARDED_PORT.toString();
- if (_forwardedProtoHeader==null)
- _forwardedProtoHeader = HttpHeader.X_FORWARDED_PROTO.toString();
- if (_forwardedHttpsHeader==null)
- _forwardedHttpsHeader = "X-Proxied-Https";
- }
-+
-+ updateHandles();
- }
- 
- public String getForcedHost()
-@@ -138,6 +156,7 @@ public String getForcedHost()
- public void setForcedHost(String hostAndPort)
+- private URI newURI(String uri)
++ private URI newURI(String path)
 {
- _forcedHost = new HostPortHttpField(hostAndPort);
-+ updateHandles();
- }
- 
- /**
-@@ -155,6 +174,7 @@ public String getForwardedHeader()

_service:tar_scm:CVE-2020-27223-pre-3.patch -> _service:tar_scm:CVE-2022-2048.patch Changed

@@ -1,518 +1,47 @@
-From 9f3b0223ab7e3159c4794e102f6b5e06dfc8710d Mon Sep 17 00:00:00 2001
-From: Greg Wilkins <gregw@webtide.com>
-Date: Wed, 8 May 2019 14:00:58 +0200
-Subject: PATCH Issue #3630 Forwarded-Port
+From: Markus Koschany <apo@debian.org>
+Date: Wed, 17 Aug 2022 12:59:00 +0200
+Subject: CVE-2022-2048
 
-reformatted code
-Avoid updating handles unless configuration is changed.
-
-Signed-off-by: Greg Wilkins <gregw@webtide.com>
+Origin: https://github.com/eclipse/jetty.project/issues/7935
 ---
- .../server/ForwardedRequestCustomizer.java | 216 ++++++++++--------
- 1 file changed, 117 insertions(+), 99 deletions(-)
+ .../jetty/http2/server/HttpChannelOverHTTP2.java | 12 +-
+ .../org/eclipse/jetty/http2/server/BadURITest.java | 153 +++++++++++++++++++++
+ 2 files changed, 157 insertions(+), 8 deletions(-)
+ create mode 100644 jetty-http2/http2-server/src/test/java/org/eclipse/jetty/http2/server/BadURITest.java
 
-diff --git a/jetty-server/src/main/java/org/eclipse/jetty/server/ForwardedRequestCustomizer.java b/jetty-server/src/main/java/org/eclipse/jetty/server/ForwardedRequestCustomizer.java
-index 1e64892cbe9..be3990794ed 100644
---- a/jetty-server/src/main/java/org/eclipse/jetty/server/ForwardedRequestCustomizer.java
-+++ b/jetty-server/src/main/java/org/eclipse/jetty/server/ForwardedRequestCustomizer.java
-@@ -43,7 +43,9 @@
- 
- 
- /* ------------------------------------------------------------ */
--/** Customize Requests for Proxy Forwarding.
-+
-+/**
-+ * Customize Requests for Proxy Forwarding.
- * 
- * This customizer looks at at HTTP request for headers that indicate
- * it has been forwarded by one or more proxies. Specifically handled are
-@@ -59,7 +61,8 @@
- * so that the proxy is not seen as the other end point of the connection on which
- * the request came
- * Headers can also be defined so that forwarded SSL Session IDs and Cipher
-- * suites may be customised 
-+ * suites may be customised
-+ *
- * @see <a href="http://en.wikipedia.org/wiki/X-Forwarded-For">Wikipedia: X-Forwarded-For</a>
- */
- public class ForwardedRequestCustomizer implements Customizer
-@@ -76,9 +79,9 @@
- private String _forwardedHttpsHeader = "X-Proxied-Https";
- private String _forwardedCipherSuiteHeader = "Proxy-auth-cert";
- private String _forwardedSslSessionIdHeader = "Proxy-ssl-id";
-- private boolean _proxyAsAuthority=false;
-- private boolean _sslIsSecure=true;
-- private Trie <MethodHandle> _handles;
-+ private boolean _proxyAsAuthority = false;
-+ private boolean _sslIsSecure = true;
-+ private Trie<MethodHandle> _handles;
- 
- public ForwardedRequestCustomizer()
- {
-@@ -97,7 +100,7 @@ public boolean getProxyAsAuthority()
- 
- /**
- * @param proxyAsAuthority if true, use the proxy address obtained via
-- * {@code X-Forwarded-Server} or RFC7239 "by" as the request authority.
-+ * {@code X-Forwarded-Server} or RFC7239 "by" as the request authority.
- */
- public void setProxyAsAuthority(boolean proxyAsAuthority)
- {
-@@ -114,49 +117,47 @@ public void setForwardedOnly(boolean rfc7239only)
- {
- if (rfc7239only)
- {
-- if (_forwardedHeader==null)
-- _forwardedHeader=HttpHeader.FORWARDED.toString();
-- _forwardedHostHeader=null;
-- _forwardedServerHeader=null;
-- _forwardedForHeader=null;
-- _forwardedPortHeader=null;
-- _forwardedProtoHeader=null;
-- _forwardedHttpsHeader=null;
-+ if (_forwardedHeader == null)
-+ _forwardedHeader = HttpHeader.FORWARDED.toString();
-+ _forwardedHostHeader = null;
-+ _forwardedServerHeader = null;
-+ _forwardedForHeader = null;
-+ _forwardedPortHeader = null;
-+ _forwardedProtoHeader = null;
-+ _forwardedHttpsHeader = null;
+diff --git a/jetty-http2/http2-server/src/main/java/org/eclipse/jetty/http2/server/HttpChannelOverHTTP2.java b/jetty-http2/http2-server/src/main/java/org/eclipse/jetty/http2/server/HttpChannelOverHTTP2.java
+index 03b082e..3548497 100644
+--- a/jetty-http2/http2-server/src/main/java/org/eclipse/jetty/http2/server/HttpChannelOverHTTP2.java
++++ b/jetty-http2/http2-server/src/main/java/org/eclipse/jetty/http2/server/HttpChannelOverHTTP2.java
+@@ -143,13 +143,11 @@ public class HttpChannelOverHTTP2 extends HttpChannel implements Closeable, Writ
 }
- else
+ catch (BadMessageException x)
 {
-- if (_forwardedHostHeader==null)
-+ if (_forwardedHostHeader == null)
- _forwardedHostHeader = HttpHeader.X_FORWARDED_HOST.toString();
-- if (_forwardedServerHeader==null)
-+ if (_forwardedServerHeader == null)
- _forwardedServerHeader = HttpHeader.X_FORWARDED_SERVER.toString();
-- if (_forwardedForHeader==null)
-+ if (_forwardedForHeader == null)
- _forwardedForHeader = HttpHeader.X_FORWARDED_FOR.toString();
-- if (_forwardedPortHeader==null)
-+ if (_forwardedPortHeader == null)
- _forwardedPortHeader = HttpHeader.X_FORWARDED_PORT.toString();
-- if (_forwardedProtoHeader==null)
-+ if (_forwardedProtoHeader == null)
- _forwardedProtoHeader = HttpHeader.X_FORWARDED_PROTO.toString();
-- if (_forwardedHttpsHeader==null)
-+ if (_forwardedHttpsHeader == null)
- _forwardedHttpsHeader = "X-Proxied-Https";
+- onBadMessage(x);
+- return null;
++ return () -> onBadMessage(x);
 }
- 
- updateHandles();
- }
-- 
-+
- public String getForcedHost()
- {
- return _forcedHost.getValue();
- }
-- 
-+
- /**
- * Set a forced valued for the host header to control what is returned by {@link ServletRequest#getServerName()} and {@link ServletRequest#getServerPort()}.
- *
-- * @param hostAndPort
-- * The value of the host header to force.
-+ * @param hostAndPort The value of the host header to force.
- */
- public void setForcedHost(String hostAndPort)
- {
- _forcedHost = new HostPortHttpField(hostAndPort);
-- updateHandles();
- }
- 
- /**
-@@ -168,13 +169,15 @@ public String getForwardedHeader()
- }
- 
- /**
-- * @param forwardedHeader 
-- * The header name for RFC forwarded (default Forwarded)
-+ * @param forwardedHeader The header name for RFC forwarded (default Forwarded)
- */
- public void setForwardedHeader(String forwardedHeader)
- {
-- _forwardedHeader = forwardedHeader;
-- updateHandles();
-+ if (_forwardedHeader == null || !_forwardedHeader.equals(forwardedHeader))
-+ {
-+ _forwardedHeader = forwardedHeader;
-+ updateHandles();
-+ }
- }
- 
- public String getForwardedHostHeader()
-@@ -183,13 +186,15 @@ public String getForwardedHostHeader()
- }
- 
- /**
-- * @param forwardedHostHeader
-- * The header name for forwarded hosts (default {@code X-Forwarded-Host})
-+ * @param forwardedHostHeader The header name for forwarded hosts (default {@code X-Forwarded-Host})
- */
- public void setForwardedHostHeader(String forwardedHostHeader)
- {
-- _forwardedHostHeader = forwardedHostHeader;
-- updateHandles();
-+ if (_forwardedHostHeader == null || !_forwardedHostHeader.equalsIgnoreCase(forwardedHostHeader))
-+ {
-+ _forwardedHostHeader = forwardedHostHeader;
-+ updateHandles();
-+ }
- }
- 
- /**
-@@ -201,13 +206,15 @@ public String getForwardedServerHeader()
- }
- 
- /**
-- * @param forwardedServerHeader
-- * The header name for forwarded server (default {@code X-Forwarded-Server})
-+ * @param forwardedServerHeader The header name for forwarded server (default {@code X-Forwarded-Server})
- */
- public void setForwardedServerHeader(String forwardedServerHeader)
- {
-- _forwardedServerHeader = forwardedServerHeader;
-- updateHandles();
-+ if (_forwardedServerHeader == null || !_forwardedServerHeader.equalsIgnoreCase(forwardedServerHeader))
-+ {
-+ _forwardedServerHeader = forwardedServerHeader;

_service Changed

_service:tar_scm:jetty-9.4.15.v20190215.tar.gz -> _service:tar_scm:jetty-9.4.16.v20190411.tar.gz Changed