deleted file mode 100644

@@ -1,253 +0,0 @@

-+++ b/java/org/apache/catalina/filters/CorsFilter.java.new	2018/05/16 14:54:09	1831728

-@@ -267,17 +267,14 @@

- 

-         // Section 6.1.3

-         // Add a single Access-Control-Allow-Origin header.

--        if (anyOriginAllowed && !supportsCredentials) {

--            // If resource doesn't support credentials and if any origin is

--            // allowed

--            // to make CORS request, return header with '*'.

-+        if (anyOriginAllowed) {

-+            // If any origin is allowed, return header with '*'.

-             response.addHeader(

-                     CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,

-                     "*");

-         } else {

--            // If the resource supports credentials add a single

--            // Access-Control-Allow-Origin header, with the value of the Origin

--            // header as value.

-+            // Add a single Access-Control-Allow-Origin header, with the value

-+            // of the Origin header as value.

-             response.addHeader(

-                     CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,

-                     origin);

-@@ -781,6 +778,10 @@

-         // For any value other then 'true' this will be false.

-         this.supportsCredentials = Boolean.parseBoolean(supportsCredentials);

- 

-+        if (this.supportsCredentials && this.anyOriginAllowed) {

-+            throw new ServletException(sm.getString("corsFilter.invalidSupportsCredentials"));

-+        }

-+

-         try {

-             if (!preflightMaxAge.isEmpty()) {

-                 this.preflightMaxAge = Long.parseLong(preflightMaxAge);

-@@ -1090,7 +1091,7 @@

-     /**

-      * By default, all origins are allowed to make requests.

-      */

--    public static final String DEFAULT_ALLOWED_ORIGINS = "*";

-+    public static final String DEFAULT_ALLOWED_ORIGINS = "";

- 

-     /**

-      * By default, following methods are supported: GET, POST, HEAD and OPTIONS.

-@@ -1106,7 +1107,7 @@

-     /**

-      * By default, support credentials is turned on.

-      */

--    public static final String DEFAULT_SUPPORTS_CREDENTIALS = "true";

-+    public static final String DEFAULT_SUPPORTS_CREDENTIALS = "false";

- 

-     /**

-      * By default, following headers are supported:

-

-+++ b/java/org/apache/catalina/filters/LocalStrings.properties.new	2018/05/16 14:54:09	1831728

-@@ -14,6 +14,8 @@

- # limitations under the License.

- 

- addDefaultCharset.unsupportedCharset=Specified character set [{0}] is not supported

-+

-+corsFilter.invalidSupportsCredentials=It is not allowed to configure supportsCredentials=[true] when allowedOrigins=[*]

- corsFilter.invalidPreflightMaxAge=Unable to parse preflightMaxAge

- corsFilter.nullRequest=HttpServletRequest object is null

- corsFilter.nullRequestType=CORSRequestType object is null

-

-+++ b/test/org/apache/catalina/filters/TestCorsFilter.java.new	2018/05/16 14:54:09	1831728

-@@ -55,8 +55,7 @@

-         corsFilter.doFilter(request, response, filterChain);

- 

-         Assert.assertTrue(response.getHeader(

--                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(

--                "https://www.apache.org"));

-+                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals("*"));

-         Assert.assertTrue(((Boolean) request.getAttribute(

-                 CorsFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST)).booleanValue());

-         Assert.assertTrue(request.getAttribute(

-@@ -88,8 +87,7 @@

-         corsFilter.doFilter(request, response, filterChain);

- 

-         Assert.assertTrue(response.getHeader(

--                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(

--                "https://www.apache.org"));

-+                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals("*"));

-         Assert.assertTrue(((Boolean) request.getAttribute(

-                 CorsFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST)).booleanValue());

-         Assert.assertTrue(request.getAttribute(

-@@ -120,8 +118,7 @@

-         corsFilter.doFilter(request, response, filterChain);

- 

-         Assert.assertTrue(response.getHeader(

--                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(

--                "https://www.apache.org"));

-+                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals("*"));

-         Assert.assertTrue(((Boolean) request.getAttribute(

-                 CorsFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST)).booleanValue());

-         Assert.assertTrue(request.getAttribute(

-@@ -166,41 +163,15 @@

-     }

- 

-     /*

--     * Tests the presence of the origin (and not '*') in the response, when

--     * supports credentials is enabled alongwith any origin, '*'.

-+     * Tests the that supports credentials may not be enabled with any origin,

-+     * '*'.

-      *

--     * @throws IOException

-      * @throws ServletException

-      */

--    @Test

--    public void testDoFilterSimpleAnyOriginAndSupportsCredentials()

--            throws IOException, ServletException {

--        TesterHttpServletRequest request = new TesterHttpServletRequest();

--        request.setHeader(CorsFilter.REQUEST_HEADER_ORIGIN,

--                TesterFilterConfigs.HTTPS_WWW_APACHE_ORG);

--        request.setMethod("GET");

--        TesterHttpServletResponse response = new TesterHttpServletResponse();

--

-+    @Test(expected=ServletException.class)

-+    public void testDoFilterSimpleAnyOriginAndSupportsCredentials() throws ServletException {

-         CorsFilter corsFilter = new CorsFilter();

--        corsFilter.init(TesterFilterConfigs

--                .getFilterConfigAnyOriginAndSupportsCredentials());

--        corsFilter.doFilter(request, response, filterChain);

--

--        Assert.assertTrue(response.getHeader(

--                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(

--                TesterFilterConfigs.HTTPS_WWW_APACHE_ORG));

--        Assert.assertTrue(response.getHeader(

--                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS)

--                .equals(

--                        "true"));

--        Assert.assertTrue(((Boolean) request.getAttribute(

--                CorsFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST)).booleanValue());

--        Assert.assertTrue(request.getAttribute(

--                CorsFilter.HTTP_REQUEST_ATTRIBUTE_ORIGIN).equals(

--                TesterFilterConfigs.HTTPS_WWW_APACHE_ORG));

--        Assert.assertTrue(request.getAttribute(

--                CorsFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE).equals(

--                CorsFilter.CORSRequestType.SIMPLE.name().toLowerCase(Locale.ENGLISH)));

-+        corsFilter.init(TesterFilterConfigs.getFilterConfigAnyOriginAndSupportsCredentials());

-     }

- 

-     /*

-@@ -261,8 +232,7 @@

-         corsFilter.doFilter(request, response, filterChain);

- 

-         Assert.assertTrue(response.getHeader(

--                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(

--                "https://www.apache.org"));

-+                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals("*"));

-         Assert.assertTrue(response.getHeader(

-                 CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_EXPOSE_HEADERS)

-                 .equals(TesterFilterConfigs.EXPOSED_HEADERS));

-@@ -727,9 +697,8 @@

-         });

-         corsFilter.doFilter(request, response, filterChain);

- 

--        Assert.assertTrue(response.getHeader(

--                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(

--                "https://www.apache.org"));

-+        Assert.assertNull(response.getHeader(

-+                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN));

-         Assert.assertTrue(((Boolean) request.getAttribute(

-                 CorsFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST)).booleanValue());

-         Assert.assertTrue(request.getAttribute(

-@@ -1412,7 +1381,7 @@

-         Assert.assertTrue(corsFilter.getAllowedOrigins().size() == 0);

-         Assert.assertTrue(corsFilter.isAnyOriginAllowed());

-         Assert.assertTrue(corsFilter.getExposedHeaders().size() == 0);

--        Assert.assertTrue(corsFilter.isSupportsCredentials());

-+        Assert.assertFalse(corsFilter.isSupportsCredentials());

-         Assert.assertTrue(corsFilter.getPreflightMaxAge() == 1800);

-     }

- 

-@@ -1448,9 +1417,9 @@

-         Assert.assertTrue(corsFilter.getAllowedHttpHeaders().size() == 6);

-         Assert.assertTrue(corsFilter.getAllowedHttpMethods().size() == 4);

-         Assert.assertTrue(corsFilter.getAllowedOrigins().size() == 0);

--        Assert.assertTrue(corsFilter.isAnyOriginAllowed());

-+        Assert.assertFalse(corsFilter.isAnyOriginAllowed());

-         Assert.assertTrue(corsFilter.getExposedHeaders().size() == 0);

--        Assert.assertTrue(corsFilter.isSupportsCredentials());

-+        Assert.assertFalse(corsFilter.isSupportsCredentials());

-         Assert.assertTrue(corsFilter.getPreflightMaxAge() == 1800);

-     }

- 

-@@ -1554,8 +1523,7 @@

-         corsFilter.doFilter(request, response, filterChain);

- 

-         Assert.assertTrue(response.getHeader(

--                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(

--                "https://www.apache.org"));

-+                CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals("*"));

-         Assert.assertNull(request

-                 .getAttribute(CorsFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST));

-         Assert.assertNull(request

-

-+++ b/test/org/apache/catalina/filters/TesterFilterConfigs.java.new	2018/05/16 14:54:09	1831728

-@@ -36,12 +36,13 @@

-     public static final TesterServletContext mockServletContext =

-             new TesterServletContext();

- 

-+    // Default config for the test is to allow any origin

-     public static FilterConfig getDefaultFilterConfig() {

-         final String allowedHttpHeaders =

-                 CorsFilter.DEFAULT_ALLOWED_HTTP_HEADERS;

-         final String allowedHttpMethods =

-                 CorsFilter.DEFAULT_ALLOWED_HTTP_METHODS;

--        final String allowedOrigins = CorsFilter.DEFAULT_ALLOWED_ORIGINS;

-+        final String allowedOrigins = ANY_ORIGIN;

-         final String exposedHeaders = CorsFilter.DEFAULT_EXPOSED_HEADERS;

-         final String supportCredentials =

-                 CorsFilter.DEFAULT_SUPPORTS_CREDENTIALS;

-@@ -59,7 +60,7 @@

-                 CorsFilter.DEFAULT_ALLOWED_HTTP_HEADERS;

-         final String allowedHttpMethods =

-                 CorsFilter.DEFAULT_ALLOWED_HTTP_METHODS + ",PUT";

--        final String allowedOrigins = CorsFilter.DEFAULT_ALLOWED_ORIGINS;

-+        final String allowedOrigins = ANY_ORIGIN;

-         final String exposedHeaders = CorsFilter.DEFAULT_EXPOSED_HEADERS;

-         final String supportCredentials = "true";

-         final String preflightMaxAge =

-@@ -77,7 +78,7 @@

-                 CorsFilter.DEFAULT_ALLOWED_HTTP_HEADERS;

-         final String allowedHttpMethods =

-                 CorsFilter.DEFAULT_ALLOWED_HTTP_METHODS + ",PUT";

--        final String allowedOrigins = CorsFilter.DEFAULT_ALLOWED_ORIGINS;

-+        final String allowedOrigins = ANY_ORIGIN;

-         final String exposedHeaders = CorsFilter.DEFAULT_EXPOSED_HEADERS;

-         final String supportCredentials = "false";

-         final String preflightMaxAge =

-@@ -131,7 +132,7 @@

-                 CorsFilter.DEFAULT_ALLOWED_HTTP_HEADERS;

-         final String allowedHttpMethods =

-                 CorsFilter.DEFAULT_ALLOWED_HTTP_METHODS;

--        final String allowedOrigins = CorsFilter.DEFAULT_ALLOWED_ORIGINS;

-+        final String allowedOrigins = ANY_ORIGIN;

-         final String exposedHeaders = EXPOSED_HEADERS;

-         final String supportCredentials =

-                 CorsFilter.DEFAULT_SUPPORTS_CREDENTIALS;

-@@ -240,7 +241,7 @@

-                 CorsFilter.DEFAULT_ALLOWED_HTTP_HEADERS;

-         final String allowedHttpMethods =

-                 CorsFilter.DEFAULT_ALLOWED_HTTP_METHODS;

--        final String allowedOrigins = CorsFilter.DEFAULT_ALLOWED_ORIGINS;

-+        final String allowedOrigins = ANY_ORIGIN;

-         final String exposedHeaders = CorsFilter.DEFAULT_EXPOSED_HEADERS;

-         final String supportCredentials =

-                 CorsFilter.DEFAULT_SUPPORTS_CREDENTIALS;

-

@@ -1,8 +1,8 @@

 --- a/java/org/apache/tomcat/util/net/jsse/JSSEUtil.java

-+++ b/java/org/apache/tomcat/util/net/jsse/JSSEUtil.java.new

-@@ -241,13 +241,7 @@ public class JSSEUtil extends SSLUtilBase {

-             Key k = ks.getKey(keyAlias, keyPassArray);

-             if (k != null && "PKCS#8".equalsIgnoreCase(k.getFormat())) {

+@@ -266,13 +266,7 @@ public class JSSEUtil extends SSLUtilBas

+             if (k != null && !"DKS".equalsIgnoreCase(certificate.getCertificateKeystoreType()) &&

+                     "PKCS#8".equalsIgnoreCase(k.getFormat())) {

                  // Switch to in-memory key store

 -                String provider = certificate.getCertificateKeystoreProvider();

 -                if (provider == null) {

@@ -15,4 +15,3 @@

                  ksUsed.load(null,  null);

                  ksUsed.setKeyEntry(keyAlias, k, keyPassArray, ks.getCertificateChain(keyAlias));

              }

-

@@ -1,20 +1,19 @@

 Summary:        Apache Tomcat

 Name:           apache-tomcat

-Version:        8.5.31

-Release:        3%{?dist}

+Version:        8.5.35

+Release:        1%{?dist}

 License:        Apache

 URL:            http://tomcat.apache.org

 Group:          Applications/System

 Vendor:         VMware, Inc.

 Distribution:   Photon

 BuildArch:      noarch

-Source0:        http://mirrors.koehn.com/apache/tomcat/tomcat-8/v%{version}/src/%{name}-%{version}-src.tar.gz

-%define sha1    apache-tomcat=c364d8814f06d1911e3dedf599fb07ab6c020c1d

+Source0:        https://archive.apache.org/dist/tomcat/tomcat-8/v%{version}/src/%{name}-%{version}-src.tar.gz

+%define sha1    apache-tomcat=c1c68f8cfeb816be2f9210903cbdd9eb4759a52f

 # base-for-apache-tomcat is a cached -Dbase.path folder

 Source1:        base-for-%{name}-%{version}.tar.gz

-%define sha1    base=9c954df61d7c72f6d5e7319d25351e178a84cab4

+%define sha1    base=68897a45e160a2b09ac5132a34ff6d5e30771365

 Patch0:         apache-tomcat-use-jks-as-inmem-keystore.patch

-Patch1:         apache-tomcat-fix-cve-2018-8014.patch

 BuildRequires:  openjre8

 BuildRequires:  openjdk8

 BuildRequires:  apache-ant

@@ -39,7 +38,6 @@ find . -type f \( -name "*.bat" -o -name "*.class" -o -name Thumbs.db -o -name "

    -name "*.jar" -o -name "*.war" -o -name "*.zip" \) -delete

 %setup -D -b 1 -n %{name}-%{version}-src

 %patch0 -p1

-%patch1 -p1

 %build

 ant -Dbase.path="../base-for-%{name}-%{version}" deploy dist-prepare dist-source

@@ -103,6 +101,8 @@ rm -rf %{buildroot}/*

 %{_logsdir}/catalina.out

 %changelog

+*   Sat Dec 08 2018 Dweep Advani <dadvani@vmware.com> 8.5.35-1

+-   Upgraded to version 8.5.35

 *   Mon Jun 25 2018 Srinidhi Rao <srinidhir@vmware.com> 8.5.31-3

 -   Fix for CVE-2018-8014

 *   Thu May 17 2018 Xiaolin Li <xiaolinl@vmware.com> 8.5.31-2