[JBoss JIRA] Created: (JBMICROCONT-149) VFS is missing privileged blocks
by Scott M Stark (JIRA)
VFS is missing privileged blocks
--------------------------------
Key: JBMICROCONT-149
URL: http://jira.jboss.com/jira/browse/JBMICROCONT-149
Project: JBoss MicroContainer
Issue Type: Bug
Components: VFS
Reporter: Scott M Stark
Assigned To: Scott M Stark
Fix For: JBossMC_2_0_0 Beta3
Run ant tests-security-manager in jbossas:
http://cruisecontrol.jboss.com/cc/artifacts/jboss-head-testsuite-sun-1.5/...
16:35:49,790 DEBUG [MainDeployerImpl] Add deployment context:
vfsfile:/services/cruisecontrol/checkout/jboss-head-testsuite-sun-1.5/build/output/jboss-5.0.0.Beta2/server/default/conf/jboss-service.xml
16:35:49,799 WARN [DeclaredStructure] Error determining structure:jboss-service.xml
java.security.AccessControlException: access denied (java.io.FilePermission/services/cruisecontrol/checkout/jboss-head-testsuite-sun-1.5/build/output/jboss-5.0.0.Beta2/server/default/conf/jboss-service.xml read)
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:264)
at java.security.AccessController.checkPermission(AccessController.java:427)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
at java.lang.SecurityManager.checkRead(SecurityManager.java:871)
at java.io.File.isFile(File.java:745)
at org.jboss.virtual.plugins.context.file.FileHandler.isLeaf(FileHandler.java:133)
at org.jboss.virtual.VirtualFile.isLeaf(VirtualFile.java:182)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
17 years, 9 months
[JBoss JIRA] Created: (JBMICROCONT-157) Leak due to VirtualFileURLConnection.class.urlCache()
by Scott M Stark (JIRA)
Leak due to VirtualFileURLConnection.class.urlCache()
-----------------------------------------------------
Key: JBMICROCONT-157
URL: http://jira.jboss.com/jira/browse/JBMICROCONT-157
Project: JBoss MicroContainer
Issue Type: Bug
Components: VFS
Affects Versions: JBossMC_2_0_0 Beta3
Reporter: Scott M Stark
Assigned To: Scott M Stark
Fix For: JBossMC_2_0_0_CR1
> I think I got another one.
> There is a static ref to the VFS in VirtualFileURLConnection. In the end
> the VirtualFile is kept in memory. See left bottom on the picture. If
> these are the things to look for, then I got a bundle more.
> Note that the VirtualFile is actually a reference to an EJB3 deployment,
> so it's probably EJB3 code not cleaning up properly. But this shouldn't
> lock down a ref in VFS.
There is definately a memory leak in
VirtualFileURLConnection.class.urlCache(). It grows without bounds.
After an incomplete JBossWS test run 53 megs of heap is tied to this
cache.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
17 years, 9 months
[JBoss JIRA] Created: (JBAS-4071) Provide information about non-XA resource participating in multibranch transactions
by Mauricio Seeberger (JIRA)
Provide information about non-XA resource participating in multibranch transactions
-----------------------------------------------------------------------------------
Key: JBAS-4071
URL: http://jira.jboss.com/jira/browse/JBAS-4071
Project: JBoss Application Server
Issue Type: Patch
Security Level: Public (Everyone can see)
Components: Other, Transaction Manager
Affects Versions: JBossAS-5.0.0.Beta1, JBossAS-4.0.5.GA
Environment: Linux 2.6.9 RHEL4 on AMD64 and jdk 1.5.0_09-amd64.
Reporter: Mauricio Seeberger
When you have more than one non-XA resource participating in a multibranch transaction, then you have a problem in your code and sooner or later it will result in inconsistent data. But JBoss (TxConnectionManager) just logs just once a generic message:
Prepare called on a local tx. Use of local transactions on a jta transaction with more than one branch may result in inconsistent data in some cases of failure.
We need more information about the resource and a stack trace for identifying the malicious code.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
17 years, 9 months
[JBoss JIRA] Created: (JBWEB-66) basic-auth broken
by Mark Stewart (JIRA)
basic-auth broken
-----------------
Key: JBWEB-66
URL: http://jira.jboss.com/jira/browse/JBWEB-66
Project: JBoss Web
Issue Type: Bug
Security Level: Public (Everyone can see)
Affects Versions: JBoss Web Server 1.0.0 GA
Environment: Linux
Reporter: Mark Stewart
Assigned To: Mladen Turk
Assuming that Jboss Web is configured identically to the web container in AS, it seems that basic-auth support is broken. That is, the server doesn't send a 401 for protected urls.
Here's the post I made three weeks ago on the Jboss Web Server forum:
"I have a webapp I usually run in JBoss AS that I'm trying to get running under JBossWeb. I've added the same entry to login-module.xml in the default/conf/ directory and a jboss-web.xml file whose <security-domain> tag points at the entry in default/deploy/<my-web-app.war>/WEB-INF. JBossWeb doesn't block the access to the protected pages, however."
This is tested by the J2EE CTS so I guess JBossWeb wasn't tested against it (or the failure was ignored) prior to the GA release.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
17 years, 9 months