[JBoss JIRA] Created: (JBESB-2966) SOAPProxy does not ensure valid SOAP response comes back from proxied endpoint
by Aaron Pestel (JIRA)
SOAPProxy does not ensure valid SOAP response comes back from proxied endpoint
------------------------------------------------------------------------------
Key: JBESB-2966
URL: https://jira.jboss.org/jira/browse/JBESB-2966
Project: JBoss ESB
Issue Type: Bug
Security Level: Public (Everyone can see)
Affects Versions: 4.6
Reporter: Aaron Pestel
SOAPProxy delegates HTTP transport to HttpRouter, however, SOAPProxy does not check to make sure that the response from HttpRouter is valid SOAP. For example, if the wsdl points to an existing JBoss server, but bad URL (http://localhost:8080/a/bad/WS/url), then the message body after the SOAPProxy action will be HTML text basically saying there was a 404 error. If SOAPProxy were just an HTTP proxy, this may make sense, but giving that it's an abstraction layer higher, it seems this should generate an exception in the action. My expectation would be that after the SOAPProxy action finishes successfully, there should be a SOAP response or SOAP fault in the default body of the ESB message. If a non-SOAP response was returned, then I think an exception should be raised in the action chain. Now, I'm not real excited about the overhead of having to parse the response from the endpoint, but maybe we could at least check for HTTP 200 or check that the response starts with this or something:
------------------
<?xml version="1.0"?>
<soap:Envelope
------------------
Basically, I'm trying to setup a demo where webservices are retried (if using JCA listener) or sent to DLQ. But without the SOAPProxy throwing an exception in error conditions, this requires writing an action to follow the SOAPProxy to check if the response was valid and then possibly throw an exception.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 6 months
[JBoss JIRA] Created: (JBESB-2768) Aggregator meta data in properties
by Kevin Conner (JIRA)
Aggregator meta data in properties
----------------------------------
Key: JBESB-2768
URL: https://jira.jboss.org/jira/browse/JBESB-2768
Project: JBoss ESB
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Content Based Routing
Affects Versions: 4.4 CP3
Reporter: Kevin Conner
Fix For: 4.4 CP4
The MessageMulticaster creates an aggregation id and stores this value in message properties. Normally this does not prove to be an issue but when using invm transport it may cause issues.
When the message is sent to multiple services, using pass by reference semantics, then all services will see the *same* properties and may, depending on timing, see the same aggregation id.
The aggregation value should really be in the message context as this section is always duplicated when creating a reference, never shared. The problem we face is that users may already be referencing the property, especially if they are creating a fresh response message, so we need to think about handling this.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 6 months
[JBoss JIRA] Created: (JBESB-3165) war-security does not work for EBWS.
by Daniel Bevenius (JIRA)
war-security does not work for EBWS.
------------------------------------
Key: JBESB-3165
URL: https://jira.jboss.org/jira/browse/JBESB-3165
Project: JBoss ESB
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Rosetta, Security, Web Services
Affects Versions: 4.7
Reporter: Daniel Bevenius
Fix For: 4.7 CP2
In EsbWebServiceDeployer only gateways in jboss-esb.xml are considered and services configured with EBWS are not in the deploy method:
webModel.setAuthDomain(esbMetaData.getModel().getAuthDomain());
webModel.setAuthMethod(esbMetaData.getModel().getAuthMethod());
ModelUtil.updateWebModel(ModelUtil.getListenerGroups(esbMetaData.getModel()), webModel);
The getListenerGroups method only looks for gateways and an EBWS is not considered to be one. So there will be no security constraints for the url to the EBWS.
This is just from a quick look into the code base here and I need to look into this more closely.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 6 months
[JBoss JIRA] Created: (JBESB-2466) SecureFtpImpl is missing logging and is silently hiding exceptions
by Martin Vecera (JIRA)
SecureFtpImpl is missing logging and is silently hiding exceptions
------------------------------------------------------------------
Key: JBESB-2466
URL: https://jira.jboss.org/jira/browse/JBESB-2466
Project: JBoss ESB
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Rosetta, Transports
Affects Versions: 4.4 CP2
Reporter: Martin Vecera
Priority: Minor
We experienced a difficulty with SFTP gateway which did not read any files. No information was present in server log. Due to the following block of code, we were not able to find out, that the server has wrong configuration of it's root path and thus not able to access the files.
catch (SftpException ex)
{
if (ex.id == ChannelSftp.SSH_FX_NO_SUCH_FILE)
{
return null ; <-- this is the problem
}
throw new RemoteFileSystemException(ex);
}
At least DEBUG level log information would be highly appreciated. All in all, I don't like that the class uses logging only at 3 places.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 7 months
[JBoss JIRA] Created: (JBESB-3061) Classloader issue in jBPM integration
by Martin Vecera (JIRA)
Classloader issue in jBPM integration
-------------------------------------
Key: JBESB-3061
URL: https://jira.jboss.org/jira/browse/JBESB-3061
Project: JBoss ESB
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Deployment, Process flow
Affects Versions: 4.7
Reporter: Martin Vecera
There is an issue that causes an exception during the task manipulation in jbpm-console.
The steps to reproduce are little bit complicated. I was not able to find any easier way nor the steps work for 100%.
You will need two quicstarts - bpm_orchestration4 and bpm_orchestration4_jca. The second one can be prepared as follows:
1) copy bpm_orchestration4 to bpm_orchestration4_jca
2) change jboss-esb.xml in bpm_orchestration4_jca to use a JMS JCA provider:
<jms-jca-provider name="JBossMQ" connection-factory="ConnectionFactory" transacted="true">
...
</jms-jca-provider>
Now start the server and follow these steps (please note that whenever you call startProcess, you must fulfill two tasks in the jbpm-console):
1) switch to bpm_orchestration4
2) ant deploy
3) ant deployProcess
4) ant startProcess
5) ant undeploy
6) ant deploy
7) ant startProcess
8) ant undeploy
9) switch to bpm_orchestration4_jca
10) ant deploy
11) delete the process definition in the jbpm-console
12) ant deployProcess
13) ant startProcess
14) ant undeploy
15) ant deploy
16) delete the process definition in the jbpm-console
17) ant deployProcess
18) ant startProcess
19) ant startProcess
20) ant undeploy
21) switch to bpm_orchestration4
22) ant deploy
23) ant startProcess
24) ant undeploy
25) ant deploy
26) ant startProcess
27) delete the process definition in the jbpm-console
28) ant deployProcess
29) ant startProcess
30) see the error during fulfilling the tasks in jbpm-console: Error completing task: An exception of type "org.jbpm.graph.def.DelegationException" was thrown. The message is: BaseClassLoader@3d3154fa{vfsfile:/home/mvecera/work/soa/50B1/jboss-as/server/default/deploy/Quickstart_bpm_orchestration4.esb/} classLoader is not connected to a domain (probably undeployed?) for class sun.reflect.MethodAccessorImpl
Now, in thirty easy steps, you can also get an exception in the log:
15:56:06,990 ERROR [GraphElement] action threw exception: BaseClassLoader@588d8962{vfszip:/home/mvecera/wnb/ESBTest/qa/tests/quickstarts/tests/output/lib/Quickstart_bpm_orchestration4.esb/} classLoader is not connected to a domain (probably undeployed?) for class sun.reflect.MethodAccessorImpl
java.lang.IllegalStateException: BaseClassLoader@588d8962{vfszip:/home/mvecera/wnb/ESBTest/qa/tests/quickstarts/tests/output/lib/Quickstart_bpm_orchestration4.esb/} classLoader is not connected to a domain (probably undeployed?) for class sun.reflect.MethodAccessorImpl
at org.jboss.classloader.spi.base.BaseClassLoader.loadClassFromDomain(BaseClassLoader.java:793)
at org.jboss.classloader.spi.base.BaseClassLoader.loadClass(BaseClassLoader.java:441)
at java.lang.ClassLoader.loadClass(ClassLoader.java:252)
at java.lang.ClassLoader.loadClassInternal(ClassLoader.java:320)
at sun.misc.Unsafe.defineClass(Native Method)
at sun.reflect.ClassDefiner.defineClass(ClassDefiner.java:45)
at sun.reflect.MethodAccessorGenerator$1.run(MethodAccessorGenerator.java:381)
at java.security.AccessController.doPrivileged(Native Method)
at sun.reflect.MethodAccessorGenerator.generate(MethodAccessorGenerator.java:377)
at sun.reflect.MethodAccessorGenerator.generateMethod(MethodAccessorGenerator.java:59)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:28)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.mvel2.PropertyAccessor.set(PropertyAccessor.java:352)
at org.mvel2.PropertyAccessor.set(PropertyAccessor.java:144)
at org.mvel2.MVEL.setProperty(MVEL.java:1183)
at org.jboss.soa.esb.message.mapping.ObjectMapper.setObjectOnMessage(ObjectMapper.java:306)
at org.jboss.soa.esb.services.jbpm.JBpmObjectMapper.setOnEsbMessage(JBpmObjectMapper.java:144)
at org.jboss.soa.esb.services.jbpm.JBpmObjectMapper.mapFromJBpmToEsbMessage(JBpmObjectMapper.java:81)
at org.jboss.soa.esb.services.jbpm.actionhandlers.EsbActionHandler.execute(EsbActionHandler.java:103)
at org.jbpm.graph.def.Action.execute(Action.java:137)
at sun.reflect.GeneratedMethodAccessor770.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.hibernate.proxy.pojo.javassist.JavassistLazyInitializer.invoke(JavassistLazyInitializer.java:197)
at org.jbpm.graph.def.Action_$$_javassist_80.execute(Action_$$_javassist_80.java)
at org.jbpm.graph.def.GraphElement.executeAction(GraphElement.java:280)
at org.jbpm.graph.def.Node.execute(Node.java:395)
at org.jbpm.graph.def.Node.enter(Node.java:375)
at sun.reflect.GeneratedMethodAccessor746.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.hibernate.proxy.pojo.javassist.JavassistLazyInitializer.invoke(JavassistLazyInitializer.java:197)
at org.jbpm.graph.def.Node_$$_javassist_127.enter(Node_$$_javassist_127.java)
at org.jbpm.graph.def.Transition.take(Transition.java:151)
at org.jbpm.graph.def.Node.leave(Node.java:453)
at org.jbpm.graph.node.TaskNode.leave(TaskNode.java:228)
at sun.reflect.GeneratedMethodAccessor772.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.hibernate.proxy.pojo.javassist.JavassistLazyInitializer.invoke(JavassistLazyInitializer.java:197)
at org.jbpm.graph.def.Node_$$_javassist_127.leave(Node_$$_javassist_127.java)
at org.jbpm.graph.exe.Token.signal(Token.java:214)
at org.jbpm.graph.exe.Token.signal(Token.java:143)
at sun.reflect.GeneratedMethodAccessor771.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.hibernate.proxy.pojo.javassist.JavassistLazyInitializer.invoke(JavassistLazyInitializer.java:197)
at org.jbpm.graph.exe.Token_$$_javassist_60.signal(Token_$$_javassist_60.java)
at org.jbpm.taskmgmt.exe.TaskInstance.end(TaskInstance.java:438)
at org.jbpm.taskmgmt.exe.TaskInstance.end(TaskInstance.java:364)
at org.jbpm.jsf.core.action.CompleteTaskActionListener.handleAction(CompleteTaskActionListener.java:47)
at org.jbpm.jsf.core.impl.JbpmActionListenerWrapper.processAction(JbpmActionListenerWrapper.java:82)
at javax.faces.event.ActionEvent.processListener(ActionEvent.java:88)
at javax.faces.component.UIComponentBase.broadcast(UIComponentBase.java:771)
at javax.faces.component.UICommand.broadcast(UICommand.java:372)
at org.jbpm.jsf.taskform.ui.UITaskFormButtonBase.broadcast(UITaskFormButtonBase.java:56)
at javax.faces.component.UIViewRoot.broadcastEvents(UIViewRoot.java:475)
at javax.faces.component.UIViewRoot.processApplication(UIViewRoot.java:756)
at com.sun.faces.lifecycle.InvokeApplicationPhase.execute(InvokeApplicationPhase.java:82)
at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:100)
at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:118)
at javax.faces.webapp.FacesServlet.service(FacesServlet.java:265)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:235)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
at org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:190)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:525)
at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:92)
at org.jboss.web.tomcat.security.SecurityContextEstablishmentValve.process(SecurityContextEstablishmentValve.java:126)
at org.jboss.web.tomcat.security.SecurityContextEstablishmentValve.invoke(SecurityContextEstablishmentValve.java:70)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:158)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:330)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:829)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:598)
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
at java.lang.Thread.run(Thread.java:619)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 7 months