网上很多文章都推荐使用Ant下载编译，但本地实践中屡屡失败，无法下载。

后来参考 https://blog.csdn.net/xiongyouqiang/article/details/78941077 总算把调试环境搭建完成。

以下文章几乎完全copy上述网址，但稍作延展。

下载源码

官网直接下载源码

http://tomcat.apache.org/download-70.cgi 

源码导入到Eclipse中

第1步：Eclipse中新建一个Java Project，例如名称可以是Tomcat-Src

第2步：在工程上点击右键=>Import=>General=>File System，点击Next按钮。

第3步：点击Browser按钮，找到tomcat源码解压路径，勾选java、test、conf和webapps目录（注意不需要勾选examples目录），点击Finish按钮。

 第4步：在java和test目录上点击右键=>Build Path=>Use As Source Folder將这两个目录设为源码目录。同时可以删除工程中原有的src目录了。

第5步：解决导入后工程中出现的编译错误，一般都是由于缺少某些jar导致

主要导入以下几个jar饱

ant.jar

ecj-4.4.2.jar

jaxrpc.jar

wsdl4j-1.5.2.jar 

easymock-3.5.1.jar

在工程中新建一个lib目录，將这些jar包放到该目录下，同时添加到build path中。

apache tomcat采用junit作为单元测试工具，我们需要为工程添加Junit支持，在工程上点击右键=>Properties=>Java build path。

点击Add Library按钮，选择Junit4即可。

此时test包中的TestCookieFilter类会报CookieFilter编译异常，这是因为缺少CookieFilter这个类导致，经过一番查找总算找到了CookieFilter源码如下所示：

/*

* Licensed to the Apache Software Foundation (ASF) under one or more

* contributor license agreements. See the NOTICE file distributed with

* this work for additional information regarding copyright ownership.

* The ASF licenses this file to You under the Apache License, Version 2.0

* (the "License"); you may not use this file except in compliance with

* the License. You may obtain a copy of the License at

*

* http://www.apache.org/licenses/LICENSE-2.0

*

* Unless required by applicable law or agreed to in writing, software

* distributed under the License is distributed on an "AS IS" BASIS,

* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

* See the License for the specific language governing permissions and

* limitations under the License.

*/

package util;

 

import java.util.Locale;

import java.util.StringTokenizer;

 

/**

* Processes a cookie header and attempts to obfuscate any cookie values that

* represent session IDs from other web applications. Since session cookie names

* are configurable, as are session ID lengths, this filter is not expected to

* be 100% effective.

*

* It is required that the examples web application is removed in security

* conscious environments as documented in the Security How-To. This filter is

* intended to reduce the impact of failing to follow that advice. A failure by

* this filter to obfuscate a session ID or similar value is not a security

* vulnerability. In such instances the vulnerability is the failure to remove

* the examples web application.

*/

public class CookieFilter {

 

private static final String OBFUSCATED = "[obfuscated]";

 

private CookieFilter() {

// Hide default constructor

}

 

public static String filter(String cookieHeader, String sessionId) {

 

StringBuilder sb = new StringBuilder(cookieHeader.length());

 

// Cookie name value pairs are ‘;‘ separated.

// Session IDs don‘t use ; in the value so don‘t worry about quoted

// values that contain ;

StringTokenizer st = new StringTokenizer(cookieHeader, ";");

 

boolean first = true;

while (st.hasMoreTokens()) {

if (first) {

first = false;

} else {

sb.append(‘;‘);

}

sb.append(filterNameValuePair(st.nextToken(), sessionId));

}

 

 

return sb.toString();

}

 

private static String filterNameValuePair(String input, String sessionId) {

int i = input.indexOf(‘=‘);

if (i == -1) {

return input;

}

String name = input.substring(0, i);

String value = input.substring(i + 1, input.length());

 

return name + "=" + filter(name, value, sessionId);

}

 

public static String filter(String cookieName, String cookieValue, String sessionId) {

if (cookieName.toLowerCase(Locale.ENGLISH).contains("jsessionid") &&

(sessionId == null || !cookieValue.contains(sessionId))) {

cookieValue = OBFUSCATED;

}

 

return cookieValue;

}

}

此时仍有部分error，但不影响调试

设置Debug Configuration，设定程序入口，开始调试！

————————————————
原文链接：https://blog.csdn.net/xiongyouqiang/article/details/78941077