PI97612: UNSET DEPLOYMENT DESCRIPTOR ATTRIBUTES BECOME SET DURING DEPLOYMENT WITH web.xml using Servlet 2.5 schema

8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
9.0.0.9: WebSphere Application Server traditional V9.0 Fix Pack 9
9.0.0.10: WebSphere Application Server traditional V9.0 Fix Pack 10
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
9.0.0.11: WebSphere Application Server traditional V9.0 Fix Pack 11
9.0.5.0: WebSphere Application Server traditional Version 9.0.5 Refresh Pack
9.0.5.1: WebSphere Application Server traditional Version 9.0.5 Fix Pack 1
9.0.5.2: WebSphere Application Server traditional Version 9.0.5 Fix Pack 2
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
9.0.5.3: WebSphere Application Server traditional Version 9.0.5 Fix Pack 3
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• Title: Unset deployment descriptor attributes become set during
  deployment.
  
  Abstract: Deployment processing, when writing deployment
  descriptor files, might incorrectly write a value for an
  attribute in cases where the attribute was not specified in the
  original deployment descriptor.
  
  Description: Application deployment processing might write
  deployment descriptor files, for example, the web-module
  deployment descriptor "web.xml" is written as "web_merged.xml",
  with values added which were obtained by annotations processing.
  
  The write of the merged descriptor should not write attributes
  with assigned values when those attributes are not specified in
  the original descriptor, because a change to a set value can
  change the meaning of the attribute.  For example, the
  web-module deployment descriptor "web.xml" has an optional
  "session-config" element, and this has optional
  "session-timout" and "tracking-mode" elements.  Whether the
  "session-timeout" value is set (whether it appears in the
  deployment descriptor is significant): when absent, a value is
  provided by the web container; when set the configured value is
  used.
  
  <session-config>
  <session-timeout>120</session-timeout>
  <tracking-mode>COOKIE</tracking-mode>
  </session-config>
  
  The problem of this APAR is that an initial "session-config"
  which has just a "tracking-mode" element is written with both
  "session-timeout" and "tracking-mode":
  
  This original element:
  
  <session-config>
  <tracking-mode>COOKIE</tracking-mode>
  </session-config>
  
  Is written as:
  
  <session-config>
  <session-timeout>0</session-timeout>
  <tracking-mode>COOKIE</tracking-mode>
  </session-config>
  
  This problem also occurs in other locations, for example:
  Within "data-source" elements:
  "initial-pool-size"
  "isolation-level"
  "login-timeout"
  "max-idle-time"
  "max-pool-size"
  "max-statements"
  "min-pool-size"
  "port-number"
  
  This update addresses the problem for both both "session-config"
  "session-timeout" elements and for the listed "data-source"
  elements.
  
  WebSphere Application Server v9.0
  Distributed operating systems
  

Local fix

• As a work-around, changing to use the Servlet 3.0 schema should
  resolve the problem, rather than for the servlet 2.5 schema,
  where issue occurs.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server with web applications not            *
  *                  specifying session-timeout attribute for    *
  *                  session-config element in web.xml.          *
  ****************************************************************
  * PROBLEM DESCRIPTION: Unspecified session-timeout             *
  *                      attribute in session-config element     *
  *                      of web.xml becomes specified with       *
  *                      value 0 after deployment.               *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  This problem is the same as APAR PI20040.  However, PI20040
  only addressed the problem for servlet 3.1 applications.
  PI97612 addresses the problem for servlet 2.5 applications.
  A web application containing a web.xml wherein a
  session-timeout attribute is not present on a session-config
  element in a web.xml becomes present and set to zero during
  deployment.
  For example, before deployment, web.xml contains:
  <session-config>
  <tracking-mode>COOKIE</tracking-mode>
  </session-config>
  After deployment a web_merged.xml contains:
  <session-config>
  <session-timeout>0</session-timeout>
  <tracking-mode>COOKIE</tracking-mode>
  </session-config>
  The session-timeout attribute should not be added during
  deployment, instead it should remain unspecified and a default
  value should be provided by the web container.
  

Problem conclusion

• The code is updated.  The session-timeout attribute remains
  unset after deployment.
  
  The fix for this APAR is currently targeted for inclusion in
  fix packs 8.5.5.14 and 9.0.0.9.  Please refer to the
  Recommended Updates page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R850 PSY

     UP

• R900 PSY

     UP