Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=51473

Fix concatenation of values in SecurityConfig.setSecurityProperty()
when the value provided by JRE is null.

git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1142904 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/java/org/apache/catalina/security/SecurityConfig.java b/java/org/apache/catalina/security/SecurityConfig.java
index 64488d6..8963fbe 100644 (file)
--- a/java/org/apache/catalina/security/SecurityConfig.java
+++ b/java/org/apache/catalina/security/SecurityConfig.java
@@ -39,6 +39,8 @@ public final class SecurityConfig{
                                                 + ",org.apache.coyote."
                                                 + ",org.apache.tomcat.";
     
+    // FIX ME package "javax." was removed to prevent HotSpot
+    // fatal internal errors
     private static final String PACKAGE_DEFINITION= "java.,sun."
                                                 + ",org.apache.catalina." 
                                                 + ",org.apache.coyote."
@@ -117,13 +119,14 @@ public final class SecurityConfig{
         if (System.getSecurityManager() != null){
             String definition = Security.getProperty(properties);
             if( definition != null && definition.length() > 0 ){
-                definition += ",";
+                if (packageList.length() > 0) {
+                    definition = definition + ',' + packageList;
+                }
+            } else {
+                definition = packageList;
             }
 
-            Security.setProperty(properties,
-                // FIX ME package "javax." was removed to prevent HotSpot
-                // fatal internal errors
-                definition + packageList);      
+            Security.setProperty(properties, definition);
         }
     }
     

diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 1f3349a..38c79a7 100644 (file)
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -70,6 +70,10 @@
         listeners and filters are stopped in a separate thread rather than the
         current thread. Patch provided by Felix Schumacher. (markt)  
       </fix>
+      <fix>
+        <bug>51473</bug>: Fix concatenation of values in
+        <code>SecurityConfig.setSecurityProperty()</code>. (kkolinko)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">
@@ -89,7 +93,7 @@
     </changelog>
   </subsection>
 </section>
-<section name="Tomcat 7.0.17 (markt)" rtext="released TBD">
+<section name="Tomcat 7.0.17 (markt)" rtext="not released">
   <subsection name="Catalina">
     <changelog>
       <add>