Update embedded tomcat from 9.0.102 to 9.0.113

[mbien]

• https://tomcat.apache.org/tomcat-9.0-doc/changelog.html

last update #8400

[lkishalmi]

Do we need to embed Tomcat at all? Can't we just use the HTTP Server in the JVM?

[mbien]

that would have to wait for the JDK 21 bump which would be NB 30, assuming the JDK internal http server covers all use cases. But in theory I don't see why not.

[mbien]

that would have to wait for the JDK 21 bump which would be NB 30

sorry I looked at the wrong JEP which only added CLI support. The com.sun.net.httpserver.HttpServer was already there before. So there would be no need to wait for NB 30.

[matthiasblaesing]

Only eyeballed this, but tomcat releases are stable to my experience and I'm not aware of reflective access to tomcat apis. So this should be good.

[matthiasblaesing]

Do we need to embed Tomcat at all? Can't we just use the HTTP Server in the JVM?

We need to have a look once Tomcat 9 goes end of life (as the old servlet API (javax.servlet). As far as I remember, the server does two thinks:

1. It exposes resources from inside the VM (see https://github.com/apache/netbeans/blob/master/ide/httpserver/src/org/netbeans/modules/httpserver/WrapperServlet.java)
2. It allows to call servlets deployed inside the IDE from the outside. (I think the XSLT support does that). (see

   netbeans/ide/httpserver/src/org/netbeans/modules/httpserver/HttpServerModule.java

   Lines 256 to 272 in 805323a

   	sw.setServlet(new HttpServlet() {
   	@Override
   	protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
   	String className = classFromPath((HttpServletRequest) request);
   	LOG.log(Level.FINE, "Servlet class name: {0}", className);
   	if (className != null) {
   	try {
   	Class<?> clazz = Class.forName(className, true, ctx.getParentClassLoader());
   	Tomcat.addServlet(ctx, className, (Servlet) clazz.getConstructor().newInstance());
   	ctx.addServletMappingDecoded("/servlet/" + className + "/*", className);
   	request.getRequestDispatcher(request.getRequestURI()).forward(request, response);
   	} catch (ReflectiveOperationException | SecurityException | IllegalArgumentException ex) {
   	LOG.log(Level.WARNING, null, ex);
   	}
   	}
   	}
   	});

   )

Both things should go away. The HTTP Server of the VM can be part of the solution, but the problem set is bigger.

Edit: Added references to the dispatchers

[mbien]

thanks for the review / comments!