Announcing GWT 1.5.3

[Ray Ryan]

Hi, all.

We have just deprecated GWT 1.5.2, and replaced it with GWT 1.5.3.
This new release has a small handful of patches, mainly aimed at
fixing RPC problems with Android. You can download the update from the
usual location:

http://code.google.com/webtoolkit/download.html

You may find that this pretty page hasn't updated yet in your neck of
the woods. If so, try going straight to the download server:
http://code.google.com/p/google-web-toolkit/downloads/list.

Enjoy,
rjrjr

Release Notes for 1.5.3

Fixed Issues

- RPC requests no longer fail on the embedded Android web browser

- Leaf TreeItems now line up with their non-leaf siblings

- Removing the last child node from a TreeItem no longer creates
extra margins on the left

- HTTPRequest no longer uses POST instead of GET on some IE installs
because of incorrect XHR selection

- Compiler now uses a more reliable check to prevent methods with
local variables from being inlined
getAbsoluteTop()/Left() can no longer return non-integral values

- Time.valueOf() no longer fails to parse "08:00:00" or incorrectly
accepts "0xC:0xB:0xA".

[nicolas.deloof]

Hi,

for maven users, this release will be available via maven central
repository in few hours (after rsync does its job).

Nicolas

[Brian]

I'm seeing a same-origin security restriction exception in 1.5.3 where
I didn't see it in 1.5.2. That is, I can switch my project back and
forth between using 1.5.2 (no exception) and 1.5.3 (exception), with
the same source code.

I'm doing a RequestBuilder to "locahost:8080/url" in order to hit my
server to POST some data.

Means I'll be using 1.5.2 until I can figure out how to hit my local
server from 1.5.3.

Brian

On Oct 20, 11:17 am, "nicolas.deloof" <nicolas.del...@gmail.com>
wrote:

[Brian]

Here's code to demonstrate 1.5.3 causing a same-origin security
restriction exception, which does not occur in 1.5.2. I'm testing in
hosted mode on port 8888, running under windows vista. You don't need
anything to be running on port 8080 for this test (but that's where my
server normally runs).
Running this code on gwt 1.5.2 just exits cleanly. With 1.5.3, the
Widow.alert() in the try/catch handler is executed.

public class Xsstest implements EntryPoint {
public void onModuleLoad() {
RequestBuilder rb = new RequestBuilder(RequestBuilder.POST,
"http://localhost:8080/v1");
rb.setTimeoutMillis(5000);
rb.setHeader("If-Modified-Since", "" + new Date(0));
rb.setHeader("Content-type", "application/x-www-form-
urlencoded");
rb.setHeader("Connection", "close");
try {
rb.sendRequest("test", new RequestCallback(){
public void onResponseReceived(Request request,
Response response) {
}

public void onError(Request request, Throwable
exception) {
}
});
} catch (Exception e) {
// this is hit in 1.5.3, not 1.5.2:
Window.alert(e.getMessage());

[JY]

I'm hitting the same problem with 1.5.3 as well. Now, I'm forced to
use the -noserver mode. I hope that same policy origin check can be
removed from the latest build.

[Alex Rice]

I hope someone can clarify this. I thought Hosted Mode did have the
SOP restriction and I'm pretty sure I did some testing with
RequestBuilder in 1.5.1 or 1.5.2 and saw the SOP restrictions. Being
new to GWT I thought this was just by design. I sure would be
convenient if hosted mode did not obey the SOP!

Alex

[Sumit Chandel]

Hello everyone,

Hosted mode does indeed respect SOP so as to closely reflect what your
application would look like running in a deployed environment as you
debug. You can pass in a -whitelist for specific cross-site URLs that
you want to communicate with, but that should only be used for quick
debug cycles to make sure that SOP problems aren't something that you
forget about and get stuck on at the web mode testing or production
stage.

That said, Brian's code snippet doesn't seem to suggest to be making a
cross-site request, and so should work. I'm trying to reproduce this
now to figure out what's going on.

Thanks,
-Sumit Chandel

[Sumit Chandel]

Hello again,

As it turns out, the SOP warning message that hosted mode issues when trying to make the request to http://localhost:8080/v1 in 1.5.3 is an improvement over 1.5.2.

The embedded Tomcat server in hosted mode is actually running on port 8888, so a request to port 8080 does indeed violate SOP and should not be allowed to go through. In 1.5.2, it seems that hosted mode was still allowing requests on different ports to go through, which is actually incorrect behaviour that looks to now be fixed in 1.5.3.

Hope that helps,

-Sumit Chandel

[Brian]

Yeah, and it was really handy that it did let them through, as IE also
lets the URLs through in web mode (if you've enabled it in IE's
internet options). Great for testing.

I wasn't able to get a -whitelist option to work with 1.5.3 and hosted
mode. Here's what I'm using:
-whitelist "^http[:][/][/]localhost[:]8080[/]"

Any suggestions on the -whitelist to use to get the above posted code
to work in 1.5.3 hosted mode?

Thanks.

On Oct 21, 7:40 pm, "Sumit Chandel" <sumitchan...@google.com> wrote:
> Hello again,
> As it turns out, the SOP warning message that hosted mode issues when trying

> to make the request tohttp://localhost:8080/v1in 1.5.3 is an improvement

> over 1.5.2.
>
> The embedded Tomcat server in hosted mode is actually running on port 8888,
> so a request to port 8080 does indeed violate SOP and should not be allowed
> to go through. In 1.5.2, it seems that hosted mode was still allowing
> requests on different ports to go through, which is actually incorrect
> behaviour that looks to now be fixed in 1.5.3.
>
> Hope that helps,
> -Sumit Chandel
>

[Alex Rice]

Thanks Sumit! That matches what I was seeing. Thank goodness for the -
noserver option.

I discovered a great way to circumvent the SOP rule, on Mac OS X and
I am not really sure why or how it works, but it does:

My GWT project is in ~alexr/Sites/xyz
So when GWT builds, it goes to
http://localhost/~alexr/xyz/www/my.Package.Module/

In Eclipse I edited Module.launch to
<stringAttribute key="org.eclipse.jdt.launching.PROGRAM_ARGUMENTS"
value="-out www -noserver
http://localhost/~alexr/xyz/www/myPackage.Module/hostpage.html?param1=x&param2=y&etc"/>

I setup ModProxy in the Apache web serverthat comes with OS X, and set
it to proxy
localhost/alfresco to my CMS server which is actually on another
hostname and port#
However, localhost/~alexr still gets served from my Sites directory.

I am not sure of the mechanics of how GWT shell and Apache all find
and serve up the correct files, but I can debug in Eclipse and
everything this way.

Well hopefully this is of use for some other Mac users.

Alex

[JY]

Same problem here. I had no luck with the whitelist parameter. Used
the exact same parameters as Brian:- -whitelist "^http[:][/]
[/]localhost[:]8080[/]" . Any suggestions?

This forced me to use the -noserver option, but created yet another
problem for me. In the -noserver mode, my ImageBundles do not work in
hosted. I've started a thread here but no reply so far:-
http://groups.google.com/group/Google-Web-Toolkit/browse_thread/thread/c0c88fbb5dfcdbea/86c69c5b70613c87?lnk=gst&q=imagebundle+noserver#86c69c5b70613c87

On Oct 22, 7:59 am, Brian <hibr...@gmail.com> wrote:
> Yeah, and it was really handy that it did let them through, as IE also
> lets the URLs through in web mode (if you've enabled it in IE's
> internet options).  Great for testing.
>
> I wasn't able to get a -whitelist option to work with 1.5.3 and hosted
> mode. Here's what I'm using:
> -whitelist "^http[:][/][/]localhost[:]8080[/]"
>
> Any suggestions on the -whitelist to use to get the above posted code
> to work in 1.5.3 hosted mode?
>
> Thanks.
>
> On Oct 21, 7:40 pm, "Sumit Chandel" <sumitchan...@google.com> wrote:
>
> > Hello again,
> > As it turns out, the SOP warning message that hosted mode issues when trying

> > to make the request tohttp://localhost:8080/v1in1.5.3 is an improvement

[Brian]

Yeah, I couldn't figure out a -whitelist that would work either, so am
now also doing -noserver.
I also had imagebundle issues, but didn't bother tracking it down, I
just copied everything over to the directory where my server serves
content. Wow -noserver is slow. Not sure if it's because I've copied
everything over, or what. I don't have time yet to track this down.

On Oct 22, 9:52 am, JY <chueny...@gmail.com> wrote:
> Same problem here. I had no luck with the whitelist parameter. Used
> the exact same parameters as Brian:- -whitelist "^http[:][/]
> [/]localhost[:]8080[/]" . Any suggestions?
>
> This forced me to use the -noserver option, but created yet another
> problem for me. In the -noserver mode, my ImageBundles do not work in

> hosted. I've started a thread here but no reply so far:-http://groups.google.com/group/Google-Web-Toolkit/browse_thread/threa...

>
> On Oct 22, 7:59 am, Brian <hibr...@gmail.com> wrote:
>
> > Yeah, and it was really handy that it did let them through, as IE also
> > lets the URLs through in web mode (if you've enabled it in IE's
> > internet options).  Great for testing.
>
> > I wasn't able to get a -whitelist option to work with 1.5.3 and hosted
> > mode. Here's what I'm using:
> > -whitelist "^http[:][/][/]localhost[:]8080[/]"
>
> > Any suggestions on the -whitelist to use to get the above posted code
> > to work in 1.5.3 hosted mode?
>
> > Thanks.
>
> > On Oct 21, 7:40 pm, "Sumit Chandel" <sumitchan...@google.com> wrote:
>
> > > Hello again,
> > > As it turns out, the SOP warning message that hosted mode issues when trying

> > > to make the request tohttp://localhost:8080/v1in1.5.3is an improvement

[Sumit Chandel]

Hey everyone,

I actually misspoke about what the -whitelist argument actually does. Apologies in advance for the confusion.

As it turns out, the -whitelist argument is used to prevent the embedded browser in hosted mode from popping up dialog boxes when you visit a page that matches the specified whitelisted URL. There isn't actually a way around SOP as it is still enforced by the embedded browser.

The way around the problem is to use hosted mode with the -noserver option and to setup your own proxy as you would in production for cross-site communication. The other alternative is to use JSONP for cross-site communication, a technique which is very well described in Dan Morrill's article linked below.

Using GWT for JSON Mashups:

http://code.google.com/docreader/#p=google-web-toolkit-doc-1-5&s=google-web-toolkit-doc-1-5&t=Article_UsingGWTForJSONMashups

Hope that helps,

-Sumit Chandel

[Sumit Chandel]

Hi Brian,

Hosted mode shouldn't be any slower running with the -noserver option as opposed to with the embedded Tomcat server. Is it possible that the server you're using is somehow carrying a larger load than just responding to your GWT application resource and other server-side requests?

About the issues you're having with the ImageBundle, what problems are you experiencing? Are the images not showing up at all, or is hosted mode having a hard time locating the resources? In terms of steps you can follow to get up and running with hosted mode with the -noserver option, check out the FAQ below to make sure you've got everything setup correctly to use hosted mode with -noserver.

Using hosted mode with the -noserver option:

http://code.google.com/docreader/#p=google-web-toolkit-doc-1-5&s=google-web-toolkit-doc-1-5&t=FAQ_HostedModeNoServer

Hope that helps,

-Sumit Chandel

On Wed, Oct 22, 2008 at 7:49 AM, Brian <hib...@gmail.com> wrote:

[Lee Chuen Yang, Jeremy]

I think the SOP check should be made as a warning instead of an error.

Developers want control over their development environment. We don't want to be forced to use the noserver mode if we want to configure our own backend server. I've been using the "SOP hack" since GWT inception in 2006 and have been able to work quite efficiently until the release of 1.5.3.

The noserver mode is less efficient compared to the embedded tomcat mode because:

(a) Any changes to images, including ImageBundle, require copying the resources over.
(b) Any new classes defined in the RPC requires copying the *.rpc over
(c) In effect, any changes to public resources like css, etc. requires copying over.
(d) At times for which I do not need to test with backend RPC, I can simply startup the embedded tomcat hosted mode to work on the client side. This is light weight. In noserve mode, I'm forced to startup the entire backend server. This often includes initializing a whole bunch of resources like Spring, Hibernate, etc. which is heavy weight and unnecessary for pure client side testing.

I hope I've given enough reasons to make SOP check a warning instead of an error. Please give developers who know what they're doing an option to optimize their development environment.

[Brian]

Hi Sumit,

Thanks for the replies. Glad to know that about -whitelist, makes
sense.

Basically, I've just gone back to 1.5.2. I can work quite well with
this, being able to hit other ports while still on localhost (or even
better, modifying my hosts file so it looks like I'm coming from
whatever host I want). I'll probably build against 1.5.3 for a final
build to deploy, but for debugging locally, 1.5.2 is much more
efficient for me.
I haven't looked into the speed issues with -noserver, but I wouldn't
doubt that it's just something on my end causing the slowdown.
I haven't looked into the imagebundle issues, and don't plan to for
the foreseable future -- sorry, just don't have time this month to
debug imagebundles on 1.5.3 with -noserver.

-Brian
P.S. Just as you have a -whitelist option, perhaps consider a '-
sophole host:port' option to allow this type of debugging locally
without having to go to the -noserver route.

On Oct 22, 9:25 pm, "Sumit Chandel" <sumitchan...@google.com> wrote:
> Hi Brian,
> Hosted mode shouldn't be any slower running with the -noserver option as
> opposed to with the embedded Tomcat server. Is it possible that the server
> you're using is somehow carrying a larger load than just responding to your
> GWT application resource and other server-side requests?
>
> About the issues you're having with the ImageBundle, what problems are you
> experiencing? Are the images not showing up at all, or is hosted mode having
> a hard time locating the resources? In terms of steps you can follow to get
> up and running with hosted mode with the -noserver option, check out the FAQ
> below to make sure you've got everything setup correctly to use hosted mode
> with -noserver.
>

> Using hosted mode with the -noserver option:http://code.google.com/docreader/#p=google-web-toolkit-doc-1-5&s=goog...

>
> Hope that helps,
> -Sumit Chandel
>

[vruiz....@gmail.com]

On 20 oct, 17:17, "nicolas.deloof" <nicolas.del...@gmail.com> wrote:
> Hi,
>
> for maven users, this release will be available via maven central
> repository in few hours (after rsync does its job).

Nice. Can you provide/publish also the sources in maven central?

Just using gwt-user.jar as gwt-user-1.5.2-sources.jar and gwt-
servlet-1.5.2-sources.jar works fine (we normally do that in our
repo).

TIA,

Vicente

[jpnet]

I would also like to see a -nosop option. We are developers, not
children, and as such our development environment doesn't need to hold
our hands. Please make this change.

-JP

[Brad LaRonde]

r3731 (merge of r3728) is the culprit:

--- user/src/com/google/gwt/user/client/impl/HTTPRequestImplIE6.java
+++ user/src/com/google/gwt/user/client/impl/HTTPRequestImplIE6.java
@@ -24,6 +24,14 @@

@Override
protected native JavaScriptObject doCreateXmlHTTPRequest() /*-{
- return new ActiveXObject("Microsoft.XMLHTTP");
+ if ($wnd.XMLHttpRequest) {
+ return new XMLHttpRequest();
+ } else {
+ try {
+ return new ActiveXObject('MSXML2.XMLHTTP.3.0');
+ } catch (e) {
+ return new ActiveXObject("Microsoft.XMLHTTP");
+ }
+ }
}-*/;
}

Revert and rebuild gwt-user.jar. Would be cool if there was a way to
do it only for hosted mode.

> > > accepts "0xC:0xB:0xA".- Hide quoted text -
>
> - Show quoted text -

[andrew_lau]

I got this worked out using apache's reverse proxy module.

Workstation --> apache proxy ---> (rpc call?)
(192.168.2.2) |-- yes --> ejb server
|-- no --> workstation port 8888

Basically, you just need to set up mod_proxy like this:

===============
httpd.conf
==============
ProxyRequests Off
<Proxy *>
Order deny,allow
Deny from all
allow from 192.168
</Proxy>

ProxyPass /mywebmodule/gwt-rpc-service http://ejbserver.com/mywebmodule/gwt-rpc-service
ProxyPassReverse /mywebmodule/gwt-rpc-service
http://ejbserver.com/mywebmodule/gwt-rpc-service

ProxyPass /com.mygwtapp.UIModule http://192.168.2.2:8888/com.mygwtapp.UIModule
ProxyPassReverse /com.mygwtapp.UIModule http://192.168.2.2:8888/com.mygwtapp.UIModule

================

Please note that 192.168.2.2 is my workstation where I develop the
code. Thus, when I
start hosted mode in that box, the tomcat instance will listen to port
8888 of my
workstation. Thus, this proxy server will contact the tomcat in my
workstation for
any queries that has /com.mygwtapp.UIModule in its path, and will
contact my real EJB
server, when the hosted mode browser does rpc call.

This way, it is "clean", the proxy server separate the calls for you.

Here is my hosted mode batch file:
@java -Xmx512M -cp
"%~dp0\src;%~dp0\bin;C:/javadev/lib/gwt-windows/gwt-user.jar;N:/
javadev/lib/gwt-maps.jar;C:/javadev/lib/gwt-windows/gwt-dev-
windows.jar"
com.google.gwt.dev.GWTShell -out "%~dp0\www" %*
http://theproxyserver/com.mygwtapp.UIModule/UIModule.html -whitelist
"^http[:][/][/]theproxyserver"