Return-Path: 
 <users-return-220653-apmail-tomcat-users-archive=tomcat.apache.org@tomcat.apache.org>
Delivered-To: apmail-tomcat-users-archive@www.apache.org
Received: (qmail 44969 invoked from network); 6 Jan 2011 21:32:13 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.3)
  by minotaur.apache.org with SMTP; 6 Jan 2011 21:32:13 -0000
Received: (qmail 87715 invoked by uid 500); 6 Jan 2011 21:32:09 -0000
Delivered-To: apmail-tomcat-users-archive@tomcat.apache.org
Received: (qmail 87487 invoked by uid 500); 6 Jan 2011 21:32:09 -0000
Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:users-help@tomcat.apache.org>
List-Unsubscribe: <mailto:users-unsubscribe@tomcat.apache.org>
List-Post: <mailto:users@tomcat.apache.org>
List-Id: <users.tomcat.apache.org>
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Delivered-To: mailing list users@tomcat.apache.org
Received: (qmail 87478 invoked by uid 99); 6 Jan 2011 21:32:09 -0000
Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 06 Jan 2011 21:32:09 +0000
X-ASF-Spam-Status: No, hits=0.7 required=10.0
	tests=RCVD_IN_DNSWL_NONE,SPF_NEUTRAL
X-Spam-Check-By: apache.org
Received-SPF: neutral (nike.apache.org: local policy)
Received: from [76.96.30.17] (HELO qmta10.emeryville.ca.mail.comcast.net)
 (76.96.30.17)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 06 Jan 2011 21:32:00 +0000
Received: from omta08.emeryville.ca.mail.comcast.net ([76.96.30.12])
	by qmta10.emeryville.ca.mail.comcast.net with comcast
	id sMRo1f0060FhH24AAMXeo9; Thu, 06 Jan 2011 21:31:38 +0000
Received: from [192.168.1.201] ([69.143.109.145])
	by omta08.emeryville.ca.mail.comcast.net with comcast
	id sMXZ1f00X38FjT18UMXbMy; Thu, 06 Jan 2011 21:31:36 +0000
Message-ID: <4D2634B4.9090407@christopherschultz.net>
Date: Thu, 06 Jan 2011 16:31:32 -0500
From: Christopher Schultz <chris@christopherschultz.net>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US;
 rv:1.9.2.13) Gecko/20101207 Thunderbird/3.1.7
MIME-Version: 1.0
To: Tomcat Users List <users@tomcat.apache.org>
Subject: Re: Security container behavior toward .js file reference
References: 
 <08382548D50D3049BD5599E1E3146B3411AA434672@exgtmb06.nam.nsroot.net>
In-Reply-To: 
 <08382548D50D3049BD5599E1E3146B3411AA434672@exgtmb06.nam.nsroot.net>
X-Enigmail-Version: 1.1.1
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Virus-Checked: Checked by ClamAV on apache.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Barry,

On 1/6/2011 1:16 PM, Propes, Barry L wrote:
> I'm experiencing (what I think is) a weird problem regarding a
> javascript reference file when accessed across the security
> container.

What do you mean "across the security container"? John Lennon really got
weird toward the end, huh?

> For several years, I've had some manual breadcrumb links written in
> each separate JSP file. So I thought I'd more easily consolidate into
> a .js file and just reference the link in each page that way.

So you went from server-side dynamic breadcrumb-trails to client-side
ones built using Javascript? Yikes! Might I recommend using a JSP include?

> e.g.   <script language="javascript" src="myapp_breadcrumb.js"></script>

Try: <script type="text/javascript" src="myapp_breadcrumb.js"></script>

In HTML4, "language" is deprecated because it never had any well-defined
values. From http://www.w3.org/TR/html4/interact/scripts.html:

"
language = cdata [CI]
    Deprecated. This attribute specifies the scripting language of the
contents of this element. Its value is an identifier for the language,
but since these identifiers are not standard, this attribute has been
deprecated in favor of type.
"

> It now prompts me if I want to save it (in IE) or in Firefox tries to display the javascript contents.

No content type = undefined behavior, though the server should have been
serving .js files as text/javascript. Check with a protocol sniffer to
see if that happened. You probably have comments at the top of the file
which make MSIE do foolish things because it always tries to guess
content-type from content.

> To me this is odd because I already have a .js reference that's been
> in there for several years, and the container never balked at that.

What does that reference look like? The container is unlikely to balk at
it since it never considers is. In these cases, the /clients/ are balking.

> I'm not altogether positive, but perhaps it's the fact that I used
> some document.write methods to write them into the file? Although I
> wouldn't think that would really be any different, but this is puzzling
> behavior to me.

Why are you using document.write to add <script> elements to the file?
Maybe I just don't understand "Web 2.0" :)

> Anyway, if anyone knows why this might be happening, I welcome any feedback.
> 
> If you're thinking this isn't Tomcat-related, it's HTML/JavaScript related, well, it works fine on the non-protected area from the container.

What happens if you use MSIE and actually download the file. What
contents do you get? Do you get an error page in .js clothing?

> It's when logging on that it suddenly gets flagged. Another weird
> issue, to me, is that initially in Firefox it tried to display the
> .js file reference in the browser.

What does it mean to display a .js file reference in the browser?

> But if I just type over the .js file in the web browser and key in
> the intended page, sans URL parameters of any kind, it gets there
> fine and displays the content as intended.

Are you usually using parameters?

- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk0mNLQACgkQ9CaO5/Lv0PAy/ACcDLDzKyKx8Fr4YNpNkY9RnEpL
v+wAnRjHNuVGFrZYsjQcJqOS8fj3Ak0p
=kf2J
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org