tomcat-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Mark Thomas <>
Subject Re: Problem with JarScanFilter, maybe a bug?
Date Wed, 01 Jul 2020 10:46:21 GMT
On 30/06/2020 14:19, Vitor Medina Cruz wrote:
>  Hello,
> I am trying to configure Tomcat in a way that it makes SCI scan only in
> jars I explicitly specify to. I followed instructions from
>, in
> both Tomcat 8 and 9, but with no success. I posted a question on
> stackoverflow that explains more in detail what I did:
> And I also found other unanswered questions pointing to the same problem,
> here is one example:
> .
> The thing is that it is looking like an error to me because logs tells that
> scanning is done as configured — if I add a jar for scanning in
> JarScanFilter, the log show it is scanned, if I remove it, the log stop
> reporting it's scanning — but after that, no matter what configuration I
> made with JarScanFilter, the WebappServiceLoader loads servlet annotated
> classes, such as @WebListener.

The JarScanner machinery handles annotation and TLD scanning.

WebappServiceLoader handles SCIs which are handled under the standard
service loader mechanism. SCIs can load classes.

> Any leads? Ideas? Anyone can confirm if that is an error or if I am using
> the functionality wrongly or if I understand it wrongly.

It looks like you aren't preventing the SCIs from being loaded.

The specification isn't as clear as it could be here and there are still
a few gaps. That is being worked on at Eclipse. A useful summary of the
current position can be found at:

The simplest way to block the Servlet 3 pluggability features is:

1. Add metadata-complete="true" to the web-app element in web.xml
   (disables annotation scanning for deploy time annotations -
    Servlet 3.1, 8.1)

2. Add <absolute-ordering></absolute-ordering> to web.xml
   (disables any SCIs - Servlet 3.1, 8.2.2.d)


To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message