[java-sig-commits] [Bug 1548289] New: CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unitended exposure of resources