Bug 57153 - StandardJarScanner only searches WEB_INF/lib & classes rather than full classpath
Summary: StandardJarScanner only searches WEB_INF/lib & classes rather than full class...
Alias: None
Product: Tomcat 8
Classification: Unclassified
Component: Util (show other bugs)
Version: 8.0.14
Hardware: PC Windows NT
: P2 normal (vote)
Target Milestone: ----
Assignee: Tomcat Developers Mailing List
Depends on:
Reported: 2014-10-27 17:08 UTC by vmware.tester42
Modified: 2014-10-29 14:42 UTC (History)
0 users


Note You need to log in before you can comment on or make changes to this bug.
Description vmware.tester42 2014-10-27 17:08:08 UTC
The StandardJarScanner.scan(JarScanType, ServletContext, JarScannerCallback) method only searches the WEB-INF/lib and WEB-INF/classes directories for JARs in the webapp's classloader.  It then moves on to the parent classloaders and searches their full classpaths.

However, there are situations where the classpath may be configured directly on the classloader rather than by putting JARs into the WEB-INF/lib and in these situations we actually want to search the full classpath of the webapp classloader.

For example:
* When pre-compiling JSPs (using JSPC) within a source tree.  JARs containing TLDs can be specified as dependencies and passed in the classpath to JSPC before the WAR (and hence the WEB-INF/lib directory) has been assembled.
* When running a webapp from within Eclipse using the Tomcat plug-in (which uses its own classloader, DevLoader, to set-up the classpath rather than relying on JARs being in the WEB-INF/lib directory).

Suggest that if WEB-INF/lib is empty then StandardJarScanner should scan JARs configured in the webapp's class loader first, before moving up the class loader hierarchy.

Not sure about Tomcat 7, but this is certainly a change from Tomcat 6 where this was all possible.
Comment 1 Mark Thomas 2014-10-29 14:42:14 UTC
Fixed in 8.0.x and will be included in 8.0.15 onwards.