Jetty is vulnerable to JSP-2.1-Glassfish bug

Jetty uses jsp-2.1-glassfish jar from org.mortbay.jettyto provide JSP support. There is a bug in the glassfish JSP implementation in org.apache.jasper.servlet.JasperLoader.findClass:

185            // If the bytecode preprocessor is not enabled, use super.findClass
186   	       // as usual.
187            if (!PreprocessorUtil.isPreprocessorEnabled()) {
188                return super.findClass(className);
189            }

The thing is, that test for enabled preprocessor returns false in majority of cases and execution never goes to the loading bytecode from the file system. Call to URLClassLoader.findClass simply throws a ClassNotFound exception (resulting in HTTP 500 later on).

Of course most of the time class for JSP either loaded or its bytecode exists in the memory. But still there are cases (for very rarely used page) to hit this path. For that reason there is no solid repro for this bug. The only condition I am aware about, is that any JSP page should not be hit for several weeks.

Lines 185-190 can be safely removed. Or Jetty may use other JSP library.