Bug 190228

Catalina

fix	 Fix custom UTF-8 decoder so that a byte of value 0xC1 is always rejected immediately as it is never valid in a UTF-8 byte sequence. Update UTF-8 decoder tests to account for UTF-8 decoding improvements in Java 8. The custom UTF-8 decoder is still required due to bugs in the UTF-8 decoder provided by Java. Java 8's decoder is better than Java 7's but it is still buggy. (markt)
fix	56027: Add more options for managing FIPS mode in the AprLifecycleListener. (schultz/kkolinko)
fix	56321: When a WAR is modified, undeploy the web application before deleting any expanded directory as the undeploy process may refer to classes that need to be loaded from the expanded directory. If the expanded directory is deleted first, any attempt to load a new class during undeploy will fail. (markt)
fix	56339: Avoid an infinite loop if an application calls session.invalidate() from the session destroyed event for that session. (markt)
update	56365: Simplify file name pattern matching code in StandardJarScanner. Ignore leading and trailing whitespace and empty strings when configuring patterns. Improve documentation. (kkolinko)
fix	56369: Ensure that removing an MBean notification listener reverts all the operations performed when adding an MBean notification listener. (markt)
add	56382: Information about finished deployment and its execution time is added to the log files. Patch is provided by Danila Galimov. (violetagg)
add	56383: Properties for disabling server information and error report are added to the org.apache.catalina.valves.ErrorReportValve. Based on the patch provided by Nick Bunn. (violetagg/kkolinko)
fix	 Only create XML parsing objects if required and fix associated potential memory leak in the default Servlet. (markt)
fix	 Modify generic exception handling so that StackOverflowError is not treated as a fatal error and can handled and/or logged as required. (markt)
fix	56409: Avoid StackOverflowError on non-Windows systems if a file named \ is encountered when scanning for TLDs. (markt)
add	56430: Extend checks for suspicious URL patterns to include patterns of the form *.a.b which are not valid patterns for extension mappings. (markt)
add	 Extend XML factory, parser etc. memory leak protection to cover some additional locations where, theoretically, a memory leak could occur. (markt)
fix	 Ensure that a TLD parser obtained from the cache has the correct value of blockExternal. (markt)
fix	56441: Raise the visibility of exceptions thrown when a problem is encountered calling a getter or setter on a component attribute. The logging level is raised from debug to warning. (markt)
fix	56451: Make resources accessed via a context alias accessible via JNDI in the same way standard resources are available. (markt)
add	56463: Property for disabling server information is added to the DefaultServlet. Server information is presented in the response sent to the client when directory listings is enabled. (violetagg)
add	 Add the org.apache.naming package to the packages requiring code to have the defineClassInPackage permission when running under a security manager. (markt)
add	 Add the org.apache.naming.resources package to the packages requiring code to have the accessClassInPackage permission when running under a security manager. (markt)
fix	 Make the naming context tokens for containers more robust. Require RuntimePermission when introducing a new token. (markt/kkolinko)
fix	56472: Allow NamingContextListener to clean up on stop if its start failed. (kkolinko)
add	56492: Avoid eclipse debugger pausing on uncaught exceptions when tomcat renews its threads. (slaurent)
fix	 Minor fixes to ThreadLocalLeakPreventionListener. Do not trigger threads renewal for failed contexts. Do not ignore threadRenewalDelay setting. Improve documentation. (kkolinko)
fix	 Correct regression introduced in r797162 that broke authentication of users when using the JAASMemoryLoginModule. (markt)
fix	56501: HttpServletRequest.getContextPath() should return the undecoded context path used by the user agent. (markt)
fix	56523: When using SPNEGO authentication, log the exceptions associated with failed user logins at debug level rather than error level. (markt)
fix	56536: Ensure that HttpSessionBindingListener.valueUnbound() uses the correct class loader when the SingleSignOn valve is used. (markt)

Coyote
add	56399: Assert that both Coyote and Catalina request objects have been properly recycled. (kkolinko)
fix	56416: Correct documentation for default value of socket linger for the AJP and HTTP connectors. (markt)

Fix: Patch attached with submission follows: