How to hide Tomcat version from error messages when using embedded servers in Java - security

I have a java application where i'm using embedded Tomcat servers,
which looks like this
Tomcat tomcat = new Tomcat()
I'm creating an embedded tomcat server here.
Problem statement
whenever there's an error it displays information on which tomcat version i'm using,
how to hide this in java?
i have a little idea that i need to override ServerInfo.properties, but how do i do this?

I'm not sure how we can do this in java, but if you are using any build scripts like ant / gradle for distribution purpose, we can write a task to override / harden the jar file, and replace the ServerInfo.properties file with the customized value whatever we need.
the code for ant build scripts would look like
<target name="override.tomcat">
<jar destfile="path/to/tomcat-embed-core-9.0.62.jar" update="true">
<fileset dir="src/"> <!-- folder where you keep the directory/file to raplace-->
<include name="org/apache/catalina/util/ServerInfo.properties"/> <!-- file to replace within directory path in side the jar-->
</fileset>
</jar>
</target>
and in gradle
task overRideTomcat(type: Jar) {
from(zipTree(file("path/to/tomcat-embed-core-9.0.62.jar"))) {
exclude '**/org/apache/catalina/util/ServerInfo.properties'
}
from('src/') {
include('/org/apache/catalina/util/ServerInfo.properties')
}
archiveName "tomcat-embed-core-9.0.62.jar"
}
make sure you have the modified ServerInfo.properties file under src directory in the same path as you have mentioned in the include statement.

Related

Could not read log4j.properties

We are having a module which contains log4j.properties and other files in it. And there is a separate module which is dependent on the 1st module(Realign). So we had made the 1st module as a jar file and placed it in the WEB-INF/lib folder of the second module(Reasign). We are running the modules in Liberty server. But still we are getting the File Not found exception as below,
log4j:ERROR Could not read configuration file
[file:/metlife/runtime/installed/wlp/usr/servers/bobr/apps/expanded/bobr.ear/BOBReassignmentWeb.war/WEB-INF/lib/Realignment.jar!/r_resources/log4j.properties].
[9/12/18 8:28:51:591 EDT] 000002de SystemErr R java.io.FileNotFoundException:
file:/metlife/runtime/installed/wlp/usr/servers/bobr/apps/expanded/bobr.ear/BOBReassignmentWeb.war/WEB-INF/lib/Realignment.jar!/r_resources/log4j.properties (No such file or directory)
It looks like your PropertiesConfigurator class is taking a file path (as a String). If you used a URL instead, I think that would work - that way, you would get a JAR URL which includes the path to the JAR (or WAR, EAR, etc.) archive and the path inside the JAR. If you have control over the PropertiesConfigurator code, then I would recommend changing it so that it loads the file via URL.
If that is not an option, then you could extract the properties files and put them on the file system directly. For example, you could create a directory in your server directory (for an example, we'll call it log4jProps). Then you could create a shared library in your server config (server.xml) like this:
<library id="log4j.props">
<fileset dir="${server.config.dir}/log4jProps" includes="r_resources/*properties"/>
</library>
then update your application configuration to use this library as a common shared library:
<application id="myApp" name="myApp" location="myApp.war"...>
<classloader commonLibraryRef ="log4j.props" />
</application>
For good measure, you should probably remove the properties file from your application archives - that way they won't be loaded from there, and then throw off the PropertiesConfigurator like it is now.
Hope this helps,
Andy

Groovy task in ant file without explicit taskdef?

Disclaimer: Ant Noob!
I'm trying to get the groovy task running in ant. Works so far:
<project>
<taskdef name="groovy"
classname="org.codehaus.groovy.ant.Groovy"
classpath="C:/Local/groovy-2.4.5/lib/groovy-ant-2.4.5.jar;C:/Local/groovy-2.4.5/lib/groovy-2.4.5.jar"/>
<echo message="Hello!"/>
<groovy>
println "Hello from Groovy!"
</groovy>
</project>
What I can't get behind (even reading this and related entries) is what I need to do to my Ant installation (Windows) to make the script run like so, without the taskdef or any other reference in my project specific build file:
<project>
<echo message="Hello!"/>
<groovy> <!-- Would be nice if I could treat this like a built-in -->
println "Hello from Groovy!"
</groovy>
</project>
You'll need to put all Groovy dependencies (groovy-ant.jar, groovy.jar, etc) on the classpath that is read by Ant. The easiest way is to store them under ANT_HOME/lib. Or you can pass them using the -lib option on the command line.
Then you would still have to tell Ant about the path of the antlib. You can use the antlib namespace mechanism described in the documentation page. You specify the package that contains the antlib.xml in the namespace URI, in this case org.codehaus.groovy:
<project xmlns:groovy="antlib:org.codehaus.groovy">
<echo message="Hello!"/>
<groovy:groovy>
println "Hello from Groovy!"
</groovy:groovy>
</project>
Note that you can still use taskdef without referencing the Jar file if it is placed (with its dependencies) in ANT_HOME/lib. You just reference the path of the antlib resource in the Jar. In this case you can do without the namespace URI:
<project>
<taskdef resource="org/codehaus/groovy/antlib.xml"/>
<echo message="Hello!"/>
<groovy>
println "Hello from Groovy!"
</groovy>
</project>

Ant Tomcat: Failed to create task or type "list"

I am using Spring official docs to understand the Spring Basic Application and Environment set up on Linux using Ant.
Softwares and system configurations:
OS: Linux/Ubuntu
JRE: 1.8.0_51-b16
Ant Version: 1.9.3
IDE: Luna Service Release 1 (4.4.1)
Project directory structure:
Everything goes fine till end of Section 1.3 where I can start the tomcat server and execute ant, ant deploy successfully and I have the desired output as follows:
But when I am trying to execute ant list - the build fails.
Buildfile: /home/sandeep/MyDocs/workspace/springapp/build.xml
list:
BUILD FAILED
/home/sandeep/MyDocs/workspace/springapp/build.xml:113: Problem: failed to create task or type list
Cause: The name is undefined.
Action: Check the spelling.
Action: Check that any custom tasks/types have been declared.
Action: Check that any / declarations have taken place.
Here is the list target in my build.xml:
<target name="list" description="List Tomcat applications">
<list url="${tomcat.manager.url}"
username="${tomcat.manager.username}"
password="${tomcat.manager.password}"/>
</target>
What am I doing wrong here? Here is a link to my entire build.xml.
In the article you linked to, it shows how to add the <list> task:
<taskdef name="list" classname="org.apache.catalina.ant.ListTask">
<classpath refid="catalina-ant-classpath"/>
</taskdef>
Add the above line to your build.xml.
I think task list is unknown to ant. There is no task named list defined by ant. To start tomcat I did something like --
<exec executable="${tomcat.home}/bin/tomcat5.exe" >
<arg value="start"/>
<env key="JAVA_OPTS"
value="-Xint -Xdebug -Xrunjdwp:transport=dt_socket,address=${hotswap.port},server=y,suspend=n"/>
</exec>
</target>

Transform external config in a web role

Can slowcheetah transform an external config file in an azure web role? e.g. I have logging info in log4net.config. But the transformed version does not get created when packaged.
I did not manage to get slowCheetah working in my Azure solution.
One alternative you can use is to create complete config files for each environment - e.g. :
log4net.debug.config
log4net.release.config
and copy the contents of these into the log4net.config at buildtime depending on the build configuration chosen.
This is done by adding a build target to your csproj file like so:
<Target Name="BeforeBuild">
<Delete Files="$(ProjectDir)log4net.config" />
<Copy SourceFiles="$(ProjectDir)log4net.$(Configuration).config"
DestinationFiles="$(ProjectDir)log4net.config" />
</Target>
(you may have to modify the paths in the script depending on where in the solution your config files are)
You can find more information on MSBuild and manipulating your .csproj file here and here

CruiseControl.NET post-build actions

We have CC.NET setup on our ASP.NET app. When we build the project, the ASP.NET app is pre-compiled and copied to a network share, from which a server runs the application.
The server is a bit different from development box'es, and the next server in our staging environment differs even more. The difference is specific config files and so on - so I want to exclude some files - or delete them before the pre-compiled app is copied to a network share.
My config file looks like this:
<project name="Assembly.Web.project">
<triggers>
<intervalTrigger seconds="3600" />
</triggers>
<sourcecontrol type="svn">
<trunkUrl>svn://svn-server/MyApp/Web/Trunk</trunkUrl>
<workingDirectory>C:\build-server\Assembly\Web\TEST-HL</workingDirectory>
<executable>C:\Program Files (x86)\SVN 1.5 bin\svn.exe</executable>
<username>uid</username>
<password>pwd</password>
</sourcecontrol>
<tasks>
<msbuild>
<executable>C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe</executable>
<workingDirectory>C:\build-server\Assembly\Web\TEST-HL</workingDirectory>
<projectFile>C:\build-server\Assembly\Web\TEST-HL\Web\Web.sln</projectFile>
<buildArgs>/noconsolelogger /p:Configuration=Debug /v:diag</buildArgs>
<targets>Build</targets>
<timeout>900</timeout>
<logger>C:\Program Files\CruiseControl.NET\server\ThoughtWorks.CruiseControl.MsBuild.dll</logger>
</msbuild>
</tasks>
<publishers>
<buildpublisher>
<sourceDir>C:\build-server\Assembly\Web\PrecompiledWeb</sourceDir>
<publishDir>\\test-web01\Web</publishDir>
<useLabelSubDirectory>false</useLabelSubDirectory>
<alwaysPublish>false</alwaysPublish>
</buildpublisher>
</publishers>
</project>
As you can see, I use a buildPublisher to copy the pre-compiled files to the network share. What I want to do here, is either 1) delete certain files before they are copied or 2) replace those files after they have been copied.
I DO NOT want to have some app running watching specific files for change, and then after that replace the files with other ones. I want something to be either done by CC.NET, or triggered by CC.NET.
Can you launch a .bat file with CC.NET?
I use a NAnt task for all publishing, deploying, cleaning and so on.
Take a look at MSDEPLOY or Web Deployment Projects. There is a question that will provide more detail here
You have to use NAnt for those kind of stuff.
Here is the Task Reference of Nant..
Of course CruiseControl.NET can run a batch file, simply use the exec task. However, an easier answer might just be to have MSBuild do the task for you. It should be simple to add a few steps in the postcompile target.

Resources