Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (nike.apache.org: domain of jona.aguirre@gmail.com
 designates 209.85.213.45 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type;
        b=FLplDBGHcqK9Fr9n080TSd2BvQtwHEvP8+ZG4BZQ2TQ1sCgBX/dDLVZJlcD6eZ+cCs
         P9U+9q3yNdyhDBrPqiF3h7DMjB5D8ZDnbvZ8al6T3gAaK9mrqAChEvyof8hOpI2PHMiO
         XV5eRV678pr0aNhvUQV9mElA7TM26f2E+ZrYs=
MIME-Version: 1.0
In-Reply-To: <4CF6956C.90506@christopherschultz.net>
References: <AANLkTi=WoPTAEtOx_H29syPS6FBYm1td67izote0LjE-@mail.gmail.com>
	<AANLkTikcbYaPMWTVzBVk9LjSxtJjVc6xXxP9JbTrpoY4@mail.gmail.com>
	<4CF64AAD.80404@apache.org>
	<AANLkTi=s5Qc4VGhxD84s3Qqs66WkD+OGqbGCT7Fxu67s@mail.gmail.com>
	<4CF6956C.90506@christopherschultz.net>
Date: Wed, 1 Dec 2010 20:10:01 -0300
Message-ID: <AANLkTi=yJLm9xbtSVzVJYCwKUe-amMU-Zaz8YbTh-mfV@mail.gmail.com>
Subject: Re: Fwd: Tomcat 7: Compatibility problems
From: Jonatan Aguirre Kobayashi <jona.aguirre@gmail.com>
To: Tomcat Users List <users@tomcat.apache.org>
Content-Type: multipart/alternative; boundary=000e0cd6adac9be60b04966167af

--000e0cd6adac9be60b04966167af
Content-Type: text/plain; charset=ISO-8859-1

Christofer, i used the invoker to prototype applications more faster, if you
put your product to production the invoker has several security problems.

thanks for the answer!

2010/12/1 Christopher Schultz <chris@christopherschultz.net>

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Jonatan,
>
> On 12/1/2010 8:35 AM, Jonatan Aguirre Kobayashi wrote:
> > Can i implement the Servlet Invoker using annotations?
>
> The invoker servlet is completely unnecessary and was only available in
> older versions of the spec for backward-compatibility.
>
> The invoker was an idea that should have never made it into the spec in
> the first place because it introduces security problems and violates the
> principle of least surprise.
>
> The invoker was only ever good for lazy web app designers.
>
> The invoker does /not/ need to be re-build for your project. Instead,
> properly map them in web.xml per the specification and rest assured that
> you are safer for having done so.
>
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkz2lWwACgkQ9CaO5/Lv0PD+9gCbBq0l2u7zpXsvi36+fVVffoEl
> 8AcAn2kCV3LKSQ7oB2U4FWYFHSe3GdRy
> =82nS
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>

--000e0cd6adac9be60b04966167af--