Bug 57153

Summary: StandardJarScanner only searches WEB_INF/lib & classes rather than full classpath
Product: Tomcat 8 Reporter: vmware.tester42
Component: UtilAssignee: Tomcat Developers Mailing List <dev>
Status: RESOLVED FIXED    
Severity: normal    
Priority: P2    
Version: 8.0.14   
Target Milestone: ----   
Hardware: PC   
OS: Windows NT   

Description vmware.tester42 2014-10-27 17:08:08 UTC
The StandardJarScanner.scan(JarScanType, ServletContext, JarScannerCallback) method only searches the WEB-INF/lib and WEB-INF/classes directories for JARs in the webapp's classloader.  It then moves on to the parent classloaders and searches their full classpaths.

However, there are situations where the classpath may be configured directly on the classloader rather than by putting JARs into the WEB-INF/lib and in these situations we actually want to search the full classpath of the webapp classloader.

For example:
* When pre-compiling JSPs (using JSPC) within a source tree.  JARs containing TLDs can be specified as dependencies and passed in the classpath to JSPC before the WAR (and hence the WEB-INF/lib directory) has been assembled.
* When running a webapp from within Eclipse using the Tomcat plug-in (which uses its own classloader, DevLoader, to set-up the classpath rather than relying on JARs being in the WEB-INF/lib directory).

Suggest that if WEB-INF/lib is empty then StandardJarScanner should scan JARs configured in the webapp's class loader first, before moving up the class loader hierarchy.

Not sure about Tomcat 7, but this is certainly a change from Tomcat 6 where this was all possible.
Comment 1 Mark Thomas 2014-10-29 14:42:14 UTC
Fixed in 8.0.x and will be included in 8.0.15 onwards.