Move ClassMatcher to core to have a consistent fix for addServerClasses in all environments

jetty-core/jetty-ee/pom.xml

@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>org.eclipse.jetty</groupId>
+    <artifactId>jetty-core</artifactId>
+    <version>12.0.8-SNAPSHOT</version>
+  </parent>
+  <artifactId>jetty-ee</artifactId>
+  <name>Core :: EE Common</name>
+
+  <properties>
+    <bundle-symbolic-name>${project.groupId}.ee</bundle-symbolic-name>
+    <spotbugs.onlyAnalyze>org.eclipse.jetty.ee.*</spotbugs.onlyAnalyze>
+  </properties>
+
+  <dependencies>
+    <dependency>
+      <groupId>org.eclipse.jetty</groupId>
+      <artifactId>jetty-server</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>slf4j-api</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.eclipse.jetty</groupId>
+      <artifactId>jetty-slf4j-impl</artifactId>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.eclipse.jetty.tests</groupId>
+      <artifactId>jetty-test-multipart</artifactId>
+      <version>${project.version}</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.eclipse.jetty.toolchain</groupId>
+      <artifactId>jetty-test-helper</artifactId>
+      <scope>test</scope>
+    </dependency>
+  </dependencies>
+
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.apache.felix</groupId>
+        <artifactId>maven-bundle-plugin</artifactId>
+        <extensions>true</extensions>
+      </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-surefire-plugin</artifactId>
+        <configuration>
+          <argLine>@{argLine} ${jetty.surefire.argLine} --add-reads org.eclipse.jetty.ee=org.eclipse.jetty.logging</argLine>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
+</project>

jetty-core/jetty-ee/src/main/config/etc/jetty-ee-webapp.xml

@@ -0,0 +1,23 @@
+<?xml version="1.0"?>
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_10_0.dtd">
+
+<Configure id="Server" class="org.eclipse.jetty.server.Server">
+  <Call class="org.eclipse.jetty.ee.WebappProtectedClasses" name="addSystemClasses">
+    <Arg><Ref refid="Server"/></Arg>
+    <Arg>
+      <Call class="org.eclipse.jetty.util.StringUtil" name="csvSplit">
+        <Arg><Property name="jetty.server.addSystemClasses"/></Arg>
+      </Call>
+    </Arg>
+  </Call>
+
+  <Call class="org.eclipse.jetty.ee.WebappProtectedClasses" name="addServerClasses">
+    <Arg><Ref refid="Server"/></Arg>
+    <Arg>
+      <Call class="org.eclipse.jetty.util.StringUtil" name="csvSplit">
+        <Arg><Property name="jetty.server.addServerClasses"/></Arg>
+      </Call>
+    </Arg>
+  </Call>
+
+</Configure>

jetty-core/jetty-ee/src/main/config/modules/ee-webapp.mod

@@ -0,0 +1,31 @@
+# DO NOT EDIT THIS FILE - See: https://eclipse.dev/jetty/documentation/
+
+[description]
+# tag::description[]
+This module provide common configuration of Java Servlet web applications over all environments.
+# end::description[]
+
+[xml]
+etc/jetty-ee-webapp.xml
+
+[lib]
+lib/jetty-ee-webapp-${jetty.version}.jar
+
+[ini-template]
+# tag::ini-template[]
+## Add to the server wide default jars and packages protected or hidden from webapps.
+## System classes are protected and cannot be overridden by a webapp.
+## Server classes are hidden and cannot be seen by a webapp
+## Lists of patterns are comma separated and may be either:
+##  + a qualified classname e.g. 'com.acme.Foo' 
+##  + a package name e.g. 'net.example.'
+##  + a jar file e.g. '${jetty.base.uri}/lib/dependency.jar' 
+##  + a directory of jars,resource or classes e.g. '${jetty.base.uri}/resources' 
+##  + A pattern preceded with a '-' is an exclusion, all other patterns are inclusions
+##
+## The +=, operator appends to a CSV list with a comma as needed.
+##
+#jetty.server.addSystemClasses+=,org.example.
+#jetty.server.addServerClasses+=,org.example.
+# end::ini-template[]
+

jetty-core/jetty-ee/src/main/java/module-info.java

@@ -0,0 +1,22 @@
+//
+// ========================================================================
+// Copyright (c) 1995 Mort Bay Consulting Pty Ltd and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// https://www.eclipse.org/legal/epl-2.0, or the Apache License, Version 2.0
+// which is available at https://www.apache.org/licenses/LICENSE-2.0.
+//
+// SPDX-License-Identifier: EPL-2.0 OR Apache-2.0
+// ========================================================================
+//
+
+module org.eclipse.jetty.ee
+{
+    requires org.slf4j;
+
+    requires transitive org.eclipse.jetty.util;
+    requires transitive org.eclipse.jetty.server;
+
+    exports org.eclipse.jetty.ee;
+}

jetty-core/jetty-ee/src/main/java/org/eclipse/jetty/ee/WebappProtectedClasses.java

@@ -0,0 +1,129 @@
+package org.eclipse.jetty.ee;
+
+import org.eclipse.jetty.server.Server;
+import org.eclipse.jetty.util.Attributes;
+import org.eclipse.jetty.util.ClassMatcher;
+import org.eclipse.jetty.util.component.Environment;
+
+public class WebappProtectedClasses
+{
+    public static final String SYSTEM_CLASSES_ATTRIBUTE = "org.eclipse.jetty.webapp.systemClasses";
+    public static final String SERVER_CLASSES_ATTRIBUTE = "org.eclipse.jetty.webapp.serverClasses";
+
+    // System classes are classes that cannot be replaced by
+    // the web application, and they are *always* loaded via
+    // system classloader.
+    public static final ClassMatcher DEFAULT_SYSTEM_CLASSES = new ClassMatcher(
+        "java.",                            // Java SE classes (per servlet spec v2.5 / SRV.9.7.2)
+        "javax.",                           // Java SE classes (per servlet spec v2.5 / SRV.9.7.2)
+        "jakarta.",                         // Jakarta classes (per servlet spec v5.0 / Section 15.2.1)
+        "org.xml.",                         // javax.xml
+        "org.w3c."                          // javax.xml
+    );
+
+    // Server classes are classes that are hidden from being
+    // loaded by the web application using system classloader,
+    // so if web application needs to load any of such classes,
+    // it has to include them in its distribution.
+    public static final ClassMatcher DEFAULT_SERVER_CLASSES = new ClassMatcher(
+        "org.eclipse.jetty."                // hide jetty classes
+    );
+
+    public static ClassMatcher getSystemClasses(Server server)
+    {
+        return getClassMatcher(server, SYSTEM_CLASSES_ATTRIBUTE, null);
+    }
+
+    public static ClassMatcher getSystemClasses(Environment environment)
+    {
+        return getClassMatcher(environment, SYSTEM_CLASSES_ATTRIBUTE, null);
+    }
+
+    /**
+     * Add a System Class pattern to use for all WebAppContexts.
+     * @param patterns the patterns to use
+     */
+    public static void addSystemClasses(String... patterns)
+    {
+        DEFAULT_SYSTEM_CLASSES.add(patterns);
+    }
+
+    /**
+     * Add a System Class pattern to use for all WebAppContexts of a given {@link Server}.
+     * @param server The {@link Server} instance to add classes to
+     * @param patterns the patterns to use
+     */
+    public static void addSystemClasses(Server server, String... patterns)
+    {
+        addClasses(server, SYSTEM_CLASSES_ATTRIBUTE, DEFAULT_SYSTEM_CLASSES, patterns);
+    }
+
+    /**
+     * Add a System Class pattern to use for WebAppContexts of a given environment.
+     * @param environment The {@link Environment} instance to add classes to
+     * @param patterns the patterns to use
+     */
+    public static void addSystemClasses(Environment environment, String... patterns)
+    {
+        addClasses(environment, SYSTEM_CLASSES_ATTRIBUTE, DEFAULT_SYSTEM_CLASSES, patterns);
+    }
+
+    public static ClassMatcher getServerClasses(Server server)
+    {
+        return getClassMatcher(server, SERVER_CLASSES_ATTRIBUTE, DEFAULT_SERVER_CLASSES);
+    }
+
+    public static ClassMatcher getServerClasses(Environment environment)
+    {
+        return getClassMatcher(environment, SERVER_CLASSES_ATTRIBUTE, DEFAULT_SERVER_CLASSES);
+    }
+
+    /**
+     * Add a Server Class pattern to use for all WebAppContexts of a given {@link Server}.
+     * @param patterns the patterns to use
+     */
+    public static void addServerClasses(String... patterns)
+    {
+        DEFAULT_SERVER_CLASSES.add(patterns);
+    }
+
+    /**
+     * Add a Server Class pattern to use for all WebAppContexts of a given {@link Server}.
+     * @param server The {@link Server} instance to add classes to
+     * @param patterns the patterns to use
+     */
+    public static void addServerClasses(Server server, String... patterns)
+    {
+        addClasses(server, SERVER_CLASSES_ATTRIBUTE, DEFAULT_SERVER_CLASSES, patterns);
+    }
+
+    /**
+     * Add a Server Class pattern to use for all ee9 WebAppContexts.
+     * @param environment The {@link Environment} instance to add classes to
+     * @param patterns the patterns to use
+     */
+    public static void addServerClasses(Environment environment, String... patterns)
+    {
+        addClasses(environment, SERVER_CLASSES_ATTRIBUTE, DEFAULT_SERVER_CLASSES, patterns);
+    }
+
+    private static void addClasses(Attributes attributes, String attribute, ClassMatcher defaultPatterns, String... patterns)
+    {
+        ClassMatcher classMatcher = getClassMatcher(attributes, attribute, defaultPatterns);
+        if (patterns != null && patterns.length > 0)
+            classMatcher.add(patterns);
+    }
+
+    private static ClassMatcher getClassMatcher(Attributes attributes, String attribute, ClassMatcher defaultPatterns)
+    {
+        Object existing = attributes.getAttribute(attribute);
+        if (existing instanceof ClassMatcher cm)
+            return cm;
+
+        ClassMatcher classMatcher = (existing instanceof String[] stringArray)
+            ? new ClassMatcher(stringArray) : new ClassMatcher(defaultPatterns);
+        attributes.setAttribute(attribute, classMatcher);
+        return classMatcher;
+    }
+
+}