Bug 64226 - Tomcat 9 can return HTTP date headers in timzone other than GMT
Summary: Tomcat 9 can return HTTP date headers in timzone other than GMT
Status: RESOLVED FIXED
Alias: None
Product: Tomcat 9
Classification: Unclassified
Component: Util (show other bugs)
Version: 9.0.27
Hardware: PC All
: P2 regression (vote)
Target Milestone: -----
Assignee: Tomcat Developers Mailing List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-03-13 11:55 UTC by Gary Thomas
Modified: 2020-03-20 09:54 UTC (History)
0 users



Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Gary Thomas 2020-03-13 11:55:44 UTC
We have an existing web application deployed within Tomcat. Recently we upgraded Tomcat from 8.0.32 to 9.0.27. The application sets an Expires HTTP header ultimately via Response.setDateHeader. Initially the application correctly returns the Expires header in the GMT timezone but over time (since the last restart) these headers begin to be returned in CET timezone. Different nodes in the cluster will flip to CET at different times.

We can flip a node to CET by sending a request with a CET date in a header e.g.
$ curl -H "If-Modified-Since: Thu, 12 Mar 2020 14:40:22 CET" --verbose localhost:18000/some/url/within/our/application -o /dev/null

After investigation the issue appears to be with the new ConcurrentDateFormat class which uses a ConcurrentLinkedQueue to hold a reusable collection of SimpleDateFormats. The collection is shared between the format and parse methods. When parse is called with a date string containing a timezone that is *not* GMT (e.g. "Thu, 12 Mar 2020 14:40:22 CET") then the timezone within the SimpleDateFormat used is changed to the timezone in the string (e.g. CET). This SimpleDateFormat is then placed back in the queue where it will be used by calls to format which will then return date strings in the wrong timezone.
Comment 1 Gary Thomas 2020-03-13 12:12:33 UTC
Added pull request https://github.com/apache/tomcat/pull/262 containing test and fix for this issue.
Comment 2 Christopher Schultz 2020-03-13 19:36:30 UTC
Yet another wonderful feature of SimpleDateFormat. I had no idea that parsing a date string could poison the time zone of a SimpleDateFormat object.
Comment 3 Remy Maucherat 2020-03-20 09:54:11 UTC
I thought it would be simpler to reset the timezone after parsing a date. Will change it if it's not a good idea. Thanks for the patch.
The fix will be in 10.0.0-M4, 9.0.34, 8.5.54 and 7.0.104.