apache-tomcat-8.5.40-src环境搭建

apache-tomcat-8.5.40-src环境搭建
开发环境： IDEA，Maven, JDK1.8

一、准备好 pom.xml

    4.0.0
    org.apache.tomcat
    Tomcat8.5
    Tomcat8.5
    8.5
    
        Tomcat8.0
        
        java
        test
        
            
                java
            
        
        
            
                test
            
        
        
            
                org.apache.maven.plugins
                maven-compiler-plugin
                2.3
                
                    UTF-8
                    
                    1.8
                    1.8
                
            
        
    
    
    
        
            junit
            junit
            4.12
            test
        
        
            ant
            ant
            1.7.0
        
        
            wsdl4j
            wsdl4j
            1.6.2
        
        
            javax.xml
            jaxrpc
            1.1
        
        
            org.easymock
            easymock
            3.3
        
        
            org.eclipse.jdt.core.compiler
            ecj
            4.6.1
        
    

二、在util包下新建 CookieFilter class

/*
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package util;

import java.util.Locale;
import java.util.StringTokenizer;

/**
 * Processes a cookie header and attempts to obfuscate any cookie values that
 * represent session IDs from other web applications. Since session cookie names
 * are configurable, as are session ID lengths, this filter is not expected to
 * be 100% effective.
 *
 * It is required that the examples web application is removed in security
 * conscious environments as documented in the Security How-To. This filter is
 * intended to reduce the impact of failing to follow that advice. A failure by
 * this filter to obfuscate a session ID or similar value is not a security
 * vulnerability. In such instances the vulnerability is the failure to remove
 * the examples web application.
 */
public class CookieFilter {

    private static final String OBFUSCATED = "[obfuscated]";

    private CookieFilter() {
        // Hide default constructor
    }

    public static String filter(String cookieHeader, String sessionId) {

        StringBuilder sb = new StringBuilder(cookieHeader.length());

        // Cookie name value pairs are ';' separated.
        // Session IDs don't use ; in the value so don't worry about quoted
        // values that contain ;
        StringTokenizer st = new StringTokenizer(cookieHeader, ";");

        boolean first = true;
        while (st.hasMoreTokens()) {
            if (first) {
                first = false;
            } else {
                sb.append(';');
            }
            sb.append(filterNameValuePair(st.nextToken(), sessionId));
        }


        return sb.toString();
    }

    private static String filterNameValuePair(String input, String sessionId) {
        int i = input.indexOf('=');
        if (i == -1) {
            return input;
        }
        String name = input.substring(0, i);
        String value = input.substring(i + 1, input.length());

        return name + "=" + filter(name, value, sessionId);
    }

    public static String filter(String cookieName, String cookieValue, String sessionId) {
        if (cookieName.toLowerCase(Locale.ENGLISH).contains("jsessionid") &&
                (sessionId == null || !cookieValue.contains(sessionId))) {
            cookieValue = OBFUSCATED;
        }

        return cookieValue;
    }
}

三、手动初始化JSP解析器
原因是我们直接启动org.apache.catalina.startup.Bootstrap的时候没有加载org.apache.jasper.servlet.JasperInitializer，从而无法编译JSP。解决办法是在tomcat的源码org.apache.catalina.startup.ContextConfig中手动将JSP解析器初始化。

插入位置： ContextConfig.java 的 configureStart() 方法中， webConfig();函数调用之后
context.addServletContainerInitializer(new JasperInitializer(), null);
参考来源：（https://blog.csdn.net/yekong1225/article/details/81000446 ）

报错信息举例：
threw exception [Unable to compile class for JSP] with root cause java.lang.NullPointerException

四、运行测试工程
在server.xml中的 节点下，增加

五、启动工程设置

六、在浏览器中输入： http://localhost:8080/my/ 显示如下界面：