java/org/apache/tomcat/util/descriptor/web/WebXml.java (32 lines):
	- line 263: // TODO: Ignored elements:
	- line 267: // display-name - TODO should support multiple with language
	- line 291: // TODO: description (multiple with language) is ignored
	- line 299: // TODO: Should support multiple description elements with language
	- line 300: // TODO: Should support multiple display-name elements with language
	- line 301: // TODO: Should support multiple icon elements
	- line 302: // TODO: Description for init-param is ignored
	- line 326: // TODO: description (multiple with language) is ignored
	- line 327: // TODO: display-name (multiple with language) is ignored
	- line 328: // TODO: icon (multiple) is ignored
	- line 336: // TODO: description (multiple with language) is ignored
	- line 337: // TODO: display-name (multiple with language) is ignored
	- line 338: // TODO: icon (multiple) is ignored
	- line 339: // TODO: init-param/description (multiple with language) is ignored
	- line 340: // TODO: security-role-ref/description (multiple with language) is ignored
	- line 450: // TODO: Should support multiple display-name elements with language
	- line 451: // TODO: Should support multiple description elements with language
	- line 471: // TODO: description (multiple with language) is ignored
	- line 479: // TODO: Should support multiple description elements with language
	- line 493: // TODO: Should support multiple description elements with language
	- line 501: // TODO: Should support multiple description elements with language
	- line 511: // TODO: Should support multiple description elements with language
	- line 512: // TODO: Should support multiple display-names elements with language
	- line 513: // TODO: Should support multiple icon elements ???
	- line 521: // TODO: Should support multiple description elements with language
	- line 537: // TODO: Should support multiple description elements with language
	- line 553: // TODO: Should support multiple description elements with language
	- line 574: // TODO: Should support multiple description elements with language
	- line 575: // TODO: Should support multiple display-names elements with language
	- line 576: // TODO: Should support multiple icon elements ???
	- line 725: // TODO - Various, icon, description etc elements are skipped - mainly
	- line 1296: // TODO handler-chains


java/org/apache/catalina/valves/rewrite/ResolverImpl.java (8 lines):
	- line 129: // FIXME session resumption state, not available anywhere
	- line 131: // FIXME available from SSLHostConfig
	- line 133: // FIXME available from SSLHostConfig
	- line 135: // FIXME from handshake SNI processing
	- line 174: // FIXME OID from resolveAlternateName
	- line 176: // FIXME return certificate[0] format CertificateExactAssertion in RFC4523
	- line 178: // FIXME return verification state, not available anywhere
	- line 191: // FIXME OID from resolveAlternateName


java/jakarta/servlet/ServletContext.java (8 lines):
	- line 647: * TODO SERVLET3 - Add comments
	- line 676: * @since Servlet 3.0 TODO SERVLET3 - Add comments
	- line 691: * @since Servlet 3.0 TODO SERVLET3 - Add comments
	- line 738: * TODO SERVLET3 - Add comments
	- line 755: * TODO SERVLET3 - Add comments
	- line 773: * TODO SERVLET3 - Add comments
	- line 790: * TODO SERVLET3 - Add comments
	- line 813: * @since Servlet 3.0 TODO SERVLET3 - Add comments


java/org/apache/catalina/ha/session/DeltaManager.java (7 lines):
	- line 543: * FIXME replace currently sessions with same id without notification.
	- line 545: * FIXME SSO handling is not really correct with the session replacement!
	- line 574: // FIXME How inform other session id cache like SingleSignOn
	- line 577: // FIXME better is to grap this sessions again !
	- line 689: // FIXME This send call block the deploy thread, when sender waitForAck is enabled
	- line 699: // FIXME At sender ack mode this method check only the state
	- line 710: // FIXME handle EVT_GET_ALL_SESSIONS later


java/jakarta/servlet/ServletRequest.java (6 lines):
	- line 446: * @since Servlet 3.0 TODO SERVLET3 - Add comments
	- line 455: * @since Servlet 3.0 TODO SERVLET3 - Add comments
	- line 467: * @since Servlet 3.0 TODO SERVLET3 - Add comments
	- line 475: * @since Servlet 3.0 TODO SERVLET3 - Add comments
	- line 482: * @since Servlet 3.0 TODO SERVLET3 - Add comments
	- line 501: * @since Servlet 3.0 TODO SERVLET3 - Add comments


java/org/apache/catalina/startup/Tomcat.java (5 lines):
	- line 81: // TODO: lazy init for the temp dir - only when a JSP is compiled or
	- line 85: // TODO: allow contexts without a base dir - i.e.
	- line 177: * TODO: disable work dir if not needed ( no jsp, etc ).
	- line 296: * TODO: add the rest
	- line 995: * TODO: Align the MIME mappings with conf/web.xml - possibly via a common file.


java/org/apache/catalina/storeconfig/StandardContextSF.java (5 lines):
	- line 228: // @TODO is this case possible?
	- line 301: * TODO relative watched resources
	- line 303: * TODO absolute handling configFile
	- line 305: * TODO Filename case handling for Windows?
	- line 307: * TODO digester variable substitution $catalina.base, $catalina.home


java/org/apache/coyote/http2/HpackEncoder.java (4 lines):
	- line 55: return value.length() > 5; // TODO: figure out a good value for this
	- line 60: return header.length() > 5; // TODO: figure out a good value for this
	- line 79: private final Map<String,List<TableEntry>> dynamicTable = new HashMap<>(); // TODO: use a custom data structure to
	- line 136: // FIXME: Review lowercase policy


java/org/apache/catalina/ssi/ByteArrayServletOutputStream.java (4 lines):
	- line 66: * TODO SERVLET 3.1
	- line 70: // TODO Auto-generated method stub
	- line 76: * TODO SERVLET 3.1
	- line 80: // TODO Auto-generated method stub


java/org/apache/tomcat/dbcp/pool2/impl/DefaultPooledObject.java (3 lines):
	- line 82: // TODO Allocate anyway and ignore eviction test
	- line 85: // TODO if validating and testOnBorrow == true then pre-allocate for
	- line 330: // TODO add other attributes


modules/jdbc-pool/src/main/java/org/apache/tomcat/jdbc/pool/ConnectionPool.java (3 lines):
	- line 88: * TODO - this shouldn't be a blocking queue, simply a list to hold our objects
	- line 339: //TODO possible optimization, keep track if this connection was returned properly, and don't generate a new facade
	- line 1228: * TODO investigate if we simply should store {@link java.lang.Thread#getStackTrace()} elements


java/org/apache/catalina/core/ApplicationContext.java (3 lines):
	- line 674: // TODO Spec breaking enhancement to ignore this restriction
	- line 787: // TODO Spec breaking enhancement to ignore this restriction
	- line 1038: // TODO Spec breaking enhancement to ignore this restriction


java/org/apache/tomcat/util/modeler/BaseModelMBean.java (3 lines):
	- line 68: *  TODO:
	- line 132: // TODO: move to ManagedBean
	- line 557: // FIXME - currently this removes *all* notifications for this listener


java/org/apache/catalina/storeconfig/StoreContextAppender.java (3 lines):
	- line 155: * TODO read and interpret the default context.xml and context.xml.default
	- line 157: * TODO Cache a Default StandardContext ( with reloading strategy)
	- line 159: * TODO remove really all elements, but detection is hard... To Listener or Valve from same class?


java/org/apache/catalina/tribes/tipis/ReplicatedMap.java (2 lines):
	- line 51: * TODO implement periodic sync/transfer thread<br>
	- line 52: * TODO memberDisappeared, should do nothing except change map membership by default it relocates the primary objects


java/jakarta/servlet/ServletRequestWrapper.java (2 lines):
	- line 403: * TODO SERVLET3 - Add comments
	- line 423: * TODO SERVLET3 - Add comments


java/org/apache/jasper/compiler/TagLibraryInfoImpl.java (2 lines):
	- line 206: // TODO Move this validation to the parsing stage
	- line 244: // TODO: this matches the current implementation but the URL logic looks fishy


java/org/apache/jasper/servlet/JspCServletContext.java (2 lines):
	- line 209: // TODO - enabling this means initializing the classloader first in JspC
	- line 211: // TODO - configure filter rules from Ant rather then system properties


java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java (2 lines):
	- line 654: // TODO Figure out why this is necessary and if a simpler / better
	- line 1312: // FIXME (if possible): Not available in the OpenSSL API


java/org/apache/coyote/http2/Constants.java (2 lines):
	- line 25: // TODO: Is 1k the optimal value?
	- line 27: // TODO: Is 64 too big? Just the status header with compression


java/org/apache/catalina/ha/deploy/FarmWarDeployer.java (2 lines):
	- line 212: // TODO correct second try after app is in service!
	- line 457: // TODO Handle remove also work dir content !


java/org/apache/catalina/filters/ExpiresFilter.java (2 lines):
	- line 981: * TODO SERVLET 3.1
	- line 989: * TODO SERVLET 3.1


java/org/apache/tomcat/util/http/Rfc6265CookieProcessor.java (2 lines):
	- line 86: // TODO: Review this in light of HTTP/2
	- line 113: * TODO: Name validation takes place in Cookie and cannot be configured per Context. Moving it to here would


java/org/apache/tomcat/dbcp/pool2/impl/PooledSoftReference.java (2 lines):
	- line 93: // TODO add other attributes
	- line 94: // TODO encapsulate state and other attribute display in parent


java/jakarta/servlet/ServletResponseWrapper.java (2 lines):
	- line 224: * TODO SERVLET3 - Add comments
	- line 244: * TODO SERVLET3 - Add comments


java/org/apache/tomcat/util/modeler/ManagedBean.java (2 lines):
	- line 529: // FIXME - should we use the signature from opInfo?
	- line 537: // FIXME - Accessible methods in superinterfaces?


java/org/apache/catalina/valves/rewrite/RewriteValve.java (2 lines):
	- line 679: // FIXME: https://httpd.apache.org/docs/2.4/rewrite/rewritemap.html#dbm
	- line 682: // FIXME: https://httpd.apache.org/docs/2.4/rewrite/rewritemap.html#dbd


java/org/apache/tomcat/util/Diagnostics.java (2 lines):
	- line 18: // XXX TODO: Source code line length
	- line 19: // XXX TODO: More JavaDoc


java/org/apache/catalina/servlets/CGIServlet.java (2 lines):
	- line 185: * <h3>TODO:</h3>
	- line 198: * <li>[add more to this TODO list]


java/jakarta/servlet/http/PushBuilder.java (1 line):
	- line 164: * Obtain a value for the given HTTP header. TODO Servlet 4.0 Clarify the behaviour of this method


modules/jdbc-pool/src/main/java/org/apache/tomcat/jdbc/pool/PoolConfiguration.java (1 line):
	- line 787: * @param jndiDS -the JNDI string @TODO specify the rules here.


java/org/apache/catalina/ha/tcp/ReplicationValve.java (1 line):
	- line 380: // FIXME we have a lot of sends, but the trouble with one node stops the correct replication to other nodes!


java/org/apache/catalina/storeconfig/StoreFileMover.java (1 line):
	- line 32: * TODO Get Encoding from Registry


java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java (1 line):
	- line 99: * TODO: Despite the complications it creates, it would be worth exploring the possibility of processing a received


java/org/apache/tomcat/websocket/WsFrameBase.java (1 line):
	- line 938: // TODO Masking should move to this method


java/org/apache/catalina/tribes/io/XByteBuffer.java (1 line):
	- line 84: * TODO use a pool of byte[] for performance


java/org/apache/catalina/tribes/tipis/LazyReplicatedMap.java (1 line):
	- line 63: * TODO implement periodic sync/transfer thread


java/org/apache/tomcat/util/bcel/classfile/ElementValue.java (1 line):
	- line 110: // TODO isRuntimeVisible


java/org/apache/catalina/webresources/StandardRoot.java (1 line):
	- line 354: // TODO: Should the createWebResourceSet() methods be removed to some


java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerBase.java (1 line):
	- line 59: // TODO: The method should already be accessible here but the following


java/org/apache/catalina/valves/LoadBalancerDrainingValve.java (1 line):
	- line 199: // TODO: Consider implications of SSO cookies


java/org/apache/el/util/ReflectionUtil.java (1 line):
	- line 428: // TODO: This isn't pretty but it works. Significant refactoring would be required to avoid the exception.


java/org/apache/catalina/authenticator/FormAuthenticator.java (1 line):
	- line 362: // TODO: This is similar to the FormAuthenticator.matchRequest() logic


java/org/apache/coyote/AbstractProtocol.java (1 line):
	- line 865: // TODO:


java/org/apache/catalina/manager/util/SessionUtils.java (1 line):
	- line 109: // TODO: Tapestry 4+


java/org/apache/catalina/authenticator/SSLAuthenticator.java (1 line):
	- line 70: // TODO make this a configurable attribute (in SingleSignOn??)


java/org/apache/jasper/compiler/Compiler.java (1 line):
	- line 185: * been set. TODO There are some possible optimisations of this process.


java/org/apache/tomcat/dbcp/pool2/PooledObjectState.java (1 line):
	- line 46: * TODO: Consider allocating object and ignoring the result of the eviction test.


java/org/apache/tomcat/util/net/SocketWrapperBase.java (1 line):
	- line 320: *       TODO: Modify {@link #registerWriteInterest()} so the above


java/org/apache/catalina/tribes/transport/nio/NioSender.java (1 line):
	- line 373: // TODO use ByteBuffer.wrap to avoid copying the data.


java/org/apache/coyote/ajp/AjpProcessor.java (1 line):
	- line 981: // TODO Validate the assertion above


java/org/apache/tomcat/dbcp/pool2/impl/GenericObjectPool.java (1 line):
	- line 763: // TODO - May need to add code here once additional


java/org/apache/tomcat/dbcp/pool2/impl/LinkedBlockingDeque.java (1 line):
	- line 1128: * TODO: Add support for more efficient bulk operations.


java/org/apache/jasper/runtime/JspRuntimeLibrary.java (1 line):
	- line 892: // FIXME - It is tempting to use request.getRequestDispatcher() to


java/org/apache/catalina/ant/jmx/JMXAccessorEqualsCondition.java (1 line):
	- line 73: // FIXME check url or host/parameter


java/org/apache/catalina/webresources/AbstractArchiveResource.java (1 line):
	- line 231: // TODO - get content first


java/org/apache/jasper/compiler/JspDocumentParser.java (1 line):
	- line 237: // TODO URLs returned by the Jar abstraction may be of the form jar:jar:


java/org/apache/tomcat/dbcp/pool2/impl/GenericKeyedObjectPool.java (1 line):
	- line 1089: // TODO - May need to add code here once additional


java/org/apache/coyote/http2/Stream.java (1 line):
	- line 595: // TODO: Is there benefit in refactoring this? Is MimeHeaders too


java/org/apache/catalina/tribes/membership/McastServiceImpl.java (1 line):
	- line 508: // TODO this operation is not thread safe


modules/jdbc-pool/src/main/java/org/apache/tomcat/jdbc/pool/PooledConnection.java (1 line):
	- line 221: //TODO lookup JNDI name


java/org/apache/catalina/ant/jmx/JMXAccessorTask.java (1 line):
	- line 489: * Convert string to datatype FIXME How we can transfer values from ant project reference store (ref)?


java/org/apache/coyote/http11/Http11Processor.java (1 line):
	- line 418: response.setHeader("Connection", "close"); // TODO: Remove


java/jakarta/el/ListELResolver.java (1 line):
	- line 28: // TODO - Handle the Lists created by List.of(). Multiple package private


java/jakarta/servlet/jsp/tagext/BodyContent.java (1 line):
	- line 75: // TODO -- clean this one up.


java/org/apache/jasper/compiler/Generator.java (1 line):
	- line 3888: * FIXME: should probably be checking for things like pageContext, bodyContent, and parent here -akv


java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java (1 line):
	- line 621: // TODO: switch to AbstractQueuedLongSynchronizer and move


java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java (1 line):
	- line 1551: // FIXME (if possible): Not available in the OpenSSL API


java/org/apache/catalina/tribes/transport/nio/NioReplicationTask.java (1 line):
	- line 326: // TODO check optimization, one channel per thread?


java/org/apache/catalina/startup/HostConfig.java (1 line):
	- line 1239: // FIXME: Feature idea. Add support for patterns (ex: WEB-INF/*,


java/org/apache/coyote/AbstractProcessor.java (1 line):
	- line 924: * Processing the dispatches requires (TODO confirm applies without APR) that the socket has been added


java/org/apache/tomcat/dbcp/dbcp2/DelegatingStatement.java (1 line):
	- line 138: // FIXME The PreparedStatement we're wrapping should handle this for us.


java/org/apache/tomcat/dbcp/dbcp2/DelegatingPreparedStatement.java (1 line):
	- line 176: // FIXME The PreparedStatement we're wrapping should handle this for us.


webapps/manager/WEB-INF/jsp/sessionDetail.jsp (1 line):
	- line 140: TODO: set Max Inactive Interval on sessions


java/org/apache/catalina/session/PersistentManagerBase.java (1 line):
	- line 793: // FIXME: Smarter algorithm (LRU)


modules/jdbc-pool/src/main/java/org/apache/tomcat/jdbc/pool/interceptor/SlowQueryReport.java (1 line):
	- line 177: //however TODO we need to improve the eviction


java/org/apache/jasper/JspC.java (1 line):
	- line 1548: // TODO: should we use the Ant Project's log?


java/org/apache/tomcat/dbcp/dbcp2/cpdsadapter/DriverAdapterCPDS.java (1 line):
	- line 799: // TODO What if the connection string contains a 'user' or 'password' query parameter but that connection string


java/org/apache/catalina/authenticator/SpnegoAuthenticator.java (1 line):
	- line 201: // TODO: Confirm this assumption


java/jakarta/el/Util.java (1 line):
	- line 406: * TODO: This isn't pretty but it works. Significant refactoring would be required to avoid the exception. See


java/org/apache/tomcat/util/net/AbstractEndpoint.java (1 line):
	- line 88: // TODO Add a new state to the AsyncStateMachine and remove


java/jakarta/el/OptionalELResolver.java (1 line):
	- line 183: * TODO: This isn't pretty but it works. Significant refactoring would be required to avoid the


java/org/apache/catalina/tribes/transport/AbstractSender.java (1 line):
	- line 91: disconnect = true; // always disconnect UDP, TODO optimize the keepalive handling


modules/jdbc-pool/src/main/java/org/apache/tomcat/jdbc/pool/PoolProperties.java (1 line):
	- line 1032: // TODO Auto-generated method stub


java/org/apache/tomcat/dbcp/pool2/impl/BaseObjectPoolConfig.java (1 line):
	- line 289: // TODO Consider changing this to a single property for 3.x


java/org/apache/tomcat/util/buf/Asn1Parser.java (1 line):
	- line 30: * TODO: Consider extending/re-writing this parser and refactoring the SpnegoTokenFixer to use it.


java/org/apache/el/parser/AstFunction.java (1 line):
	- line 92: // TODO: Do we need to think about precedence of the various ways


java/org/apache/catalina/authenticator/DigestAuthenticator.java (1 line):
	- line 277: // TODO make this a configurable attribute (in SingleSignOn??)


java/org/apache/catalina/storeconfig/StandardEngineSF.java (1 line):
	- line 52: // TODO is this case possible? (see it a old Server 5.0 impl)


java/org/apache/tomcat/dbcp/pool2/impl/PoolImplUtils.java (1 line):
	- line 198: // TODO when using Java >= 9: Use TimeUnit.toChronoUnit().


java/org/apache/jasper/servlet/JspServletWrapper.java (1 line):
	- line 224: // TODO Are there inefficiencies between reload and the


java/org/apache/tomcat/util/http/fileupload/FileUploadBase.java (1 line):
	- line 314: // ignored TODO perhaps add to tracker delete failure list somehow?