[JBoss JIRA] (CDI-702) Observers in CDI extensions can see classes they should not be able to
by Martin Kouba (JIRA)
[ https://issues.jboss.org/browse/CDI-702?page=com.atlassian.jira.plugin.sy... ]
Martin Kouba commented on CDI-702:
----------------------------------
For the record: the *Observer resolution* section in the CDI spec does not mention "accessibility" or "observability" at all (unlike dependency injection). An event is delivered to an observer method if it belongs to an enabled bean and an event type is assignable. Also accessibility rules do not help e.g. if there is an extension with a similar observer:
{code:java}
void observe(ProcessAnnotatedType<?> event) {
if (event.getAnnotatedType().isAnnotationPresent(Foo.class)) {
event.veto();
}
}
{code}
It should be able to observe all PAT events for all types in a CDI application (of course, we assume the Weld interpretation of {{@ApplicationScoped}}). That's what CDI spec currently requires.
So this issue is more about defining boundaries for events delivery.
> Observers in CDI extensions can see classes they should not be able to
> ----------------------------------------------------------------------
>
> Key: CDI-702
> URL: https://issues.jboss.org/browse/CDI-702
> Project: CDI Specification Issues
> Issue Type: Clarification
> Components: Portable Extensions
> Affects Versions: 1.2.Final, 1.1.Final, 2.0 .Final
> Reporter: Emily Jiang
> Priority: Critical
>
> We observe a undesired behavior on Weld, which is during CDI bootstrap, all classes from both the EAR lib folder and all WAR lib folders are available to CDI extensions in the EAR lib folder as well as to CDI extensions in all WAR lib folders. Basically, the extension class can see everything in an .ear regardless where the extension class resides. It completely ignores classloading hierarchy.
> This kind of contradicts with the classloading rules, where separate .war archives packaged under the same .ear should not be able to see each other's class by default, unless they both use the same classloader.
> We discussed with Weld dev team (Martin, Thomas, Matej) and Anotine. The feedback is that CDI spec is unclear on the "observer resolution". I would like to relaunch the discussion to make this clarified and fixed. Please comment.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
6 years, 11 months
[JBoss JIRA] (CDI-702) Observers in CDI extensions can see classes they should not be able to
by John Ament (JIRA)
[ https://issues.jboss.org/browse/CDI-702?page=com.atlassian.jira.plugin.sy... ]
John Ament commented on CDI-702:
--------------------------------
The description of this issue is unclear. Are you seeing all events being fired or only certain events? Where in the archive is the extension registered, a JAR within the EAR's lib folder? Within the WAR file? Within a library within the WAR file?
> Observers in CDI extensions can see classes they should not be able to
> ----------------------------------------------------------------------
>
> Key: CDI-702
> URL: https://issues.jboss.org/browse/CDI-702
> Project: CDI Specification Issues
> Issue Type: Clarification
> Components: Portable Extensions
> Affects Versions: 1.2.Final, 1.1.Final, 2.0 .Final
> Reporter: Emily Jiang
> Priority: Critical
>
> We observe a undesired behavior on Weld, which is during CDI bootstrap, all classes from both the EAR lib folder and all WAR lib folders are available to CDI extensions in the EAR lib folder as well as to CDI extensions in all WAR lib folders. Basically, the extension class can see everything in an .ear regardless where the extension class resides. It completely ignores classloading hierarchy.
> This kind of contradicts with the classloading rules, where separate .war archives packaged under the same .ear should not be able to see each other's class by default, unless they both use the same classloader.
> We discussed with Weld dev team (Martin, Thomas, Matej) and Anotine. The feedback is that CDI spec is unclear on the "observer resolution". I would like to relaunch the discussion to make this clarified and fixed. Please comment.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
6 years, 11 months
[JBoss JIRA] (CDI-702) Observers in CDI extensions can see classes they should not be able to
by Emily Jiang (JIRA)
Emily Jiang created CDI-702:
-------------------------------
Summary: Observers in CDI extensions can see classes they should not be able to
Key: CDI-702
URL: https://issues.jboss.org/browse/CDI-702
Project: CDI Specification Issues
Issue Type: Clarification
Components: Portable Extensions
Affects Versions: 2.0 .Final, 1.1.Final, 1.2.Final
Reporter: Emily Jiang
Priority: Critical
We observe a undesired behavior on Weld, which is during CDI bootstrap, all classes from both the EAR lib folder and all WAR lib folders are available to CDI extensions in the EAR lib folder as well as to CDI extensions in all WAR lib folders. Basically, the extension class can see everything in an .ear regardless where the extension class resides. It completely ignores classloading hierarchy.
This kind of contradicts with the classloading rules, where separate .war archives packaged under the same .ear should not be able to see each other's class by default, unless they both use the same classloader.
We discussed with Weld dev team (Martin, Thomas, Matej) and Anotine. The feedback is that CDI spec is unclear on the "observer resolution". I would like to relaunch the discussion to make this clarified and fixed. Please comment.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
6 years, 11 months
Re: [cdi-dev] do you like it or not?
by antoine
Hello friend,
Just take a look at that stuff I've just found on the web, do you like it or not? Check it out http://seaadsa.circlemotel.net
Sincerely yours, antoine
From: cdi-dev [mailto:cdi-dev@lists.jboss.org]
Sent: Sunday, April 30, 2017 10:38 PM
To: antoine(a)sabot-durand.net
Subject: The food
It's a non tariff trade barrier. If foreigners try to import bathroom scales that can't display weight in stones we burn them in The Wicker Man. Come to think of it, it's not really a non tariff trade barrier. It's more like a psychotic country bumpkin thing.
Got to go, we're still burning city types after the solstice. They tried to order beer in pints instead of hemisemidemihemisemidemihemisemidemihogsheads at the local, The Slaughtered Goat.
Sent from Mail for Windows 10
6 years, 12 months
