[JBoss JIRA] Created: (SECURITY-255) IdentityLoginModule Incomplete password-stacking useFirstPass implementation
by Darran Lofthouse (JIRA)
IdentityLoginModule Incomplete password-stacking useFirstPass implementation
----------------------------------------------------------------------------
Key: SECURITY-255
URL: http://jira.jboss.com/jira/browse/SECURITY-255
Project: JBoss Security and Identity Management
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: JBossSX
Affects Versions: 2.0.2.CR6
Reporter: Darran Lofthouse
Assigned To: Darran Lofthouse
Fix For: 2.0.3.Beta2
The IdentityLoginModule has got an incomplete useFirstPass implementation.
The login() method does start with: -
if( super.login() == true )
return true;
To skip login if useFirstPass is set and authentication has already occurred.
However at the end of login() setting the principal in the shared state map should only happen if useFirstPass was set.
Also for this to work a credential also needs to be stored in the sharedStateMap otherwise other modules will assume authentication has not occurred.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 2 months
[JBoss JIRA] Created: (JBRULES-1471) Accumulate should not call getResult() more then necessary
by Geoffrey De Smet (JIRA)
Accumulate should not call getResult() more then necessary
----------------------------------------------------------
Key: JBRULES-1471
URL: http://jira.jboss.com/jira/browse/JBRULES-1471
Project: JBoss Drools
Issue Type: Task
Security Level: Public (Everyone can see)
Components: Reteoo
Reporter: Geoffrey De Smet
Assigned To: Edson Tirelli
Fix For: 5.0.0-M1
For this rule:
rule "roomCapacityTooSmall" // TODO it takes 50-90% of the performance of drools-solver
when
$period : Period();
$room : Room($capacity : capacity);
$totalStudentSize : Number(intValue > $capacity) from accumulate(
Exam(period == $period, room == $room, $studentSize : topicStudentSize),
sum($studentSize)
);
...
end
Outside drl, I update 2 out of 700 Exam objects and call fireAllRulesAndCalculateDecisionScore.
The drl never changes an Exam. Period and Room never change.
That results into this log:
Breakpoint reached at org.drools.solver.core.evaluation.EvaluationHandler.fireAllRulesAndCalculateDecisionScore(EvaluationHandler.java:90)
Breakpoint reached at org.drools.base.accumulators.SumAccumulateFunction.reverse(SumAccumulateFunction.java:62)
Breakpoint reached at org.drools.base.accumulators.SumAccumulateFunction.getResult(SumAccumulateFunction.java:70)
Breakpoint reached at org.drools.base.accumulators.SumAccumulateFunction.accumulate(SumAccumulateFunction.java:53)
Breakpoint reached at org.drools.base.accumulators.SumAccumulateFunction.getResult(SumAccumulateFunction.java:70)
Breakpoint reached at org.drools.base.accumulators.SumAccumulateFunction.reverse(SumAccumulateFunction.java:62)
Breakpoint reached at org.drools.base.accumulators.SumAccumulateFunction.getResult(SumAccumulateFunction.java:70)
Breakpoint reached at org.drools.base.accumulators.SumAccumulateFunction.accumulate(SumAccumulateFunction.java:53)
Breakpoint reached at org.drools.base.accumulators.SumAccumulateFunction.getResult(SumAccumulateFunction.java:70)
Breakpoint reached at org.drools.base.accumulators.SumAccumulateFunction.reverse(SumAccumulateFunction.java:62)
Breakpoint reached at org.drools.base.accumulators.SumAccumulateFunction.getResult(SumAccumulateFunction.java:70)
Breakpoint reached at org.drools.base.accumulators.SumAccumulateFunction.accumulate(SumAccumulateFunction.java:53)
Breakpoint reached at org.drools.base.accumulators.SumAccumulateFunction.getResult(SumAccumulateFunction.java:70)
Breakpoint reached at org.drools.base.accumulators.SumAccumulateFunction.reverse(SumAccumulateFunction.java:62)
Breakpoint reached at org.drools.base.accumulators.SumAccumulateFunction.getResult(SumAccumulateFunction.java:70)
Breakpoint reached at org.drools.base.accumulators.SumAccumulateFunction.accumulate(SumAccumulateFunction.java:53)
Breakpoint reached at org.drools.base.accumulators.SumAccumulateFunction.getResult(SumAccumulateFunction.java:70)
There are 4 accumulate calls and 4 reverse calls. That might be accurate.
There are 8 getResult calls, that should only be 1.
Also, the getResult method creates a new Double instance each time:
return new Double( data.total );
It might be better to do
return Double.valueOf(data.total);
to allow the JVM to hot spot optimize it.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 2 months
[JBoss JIRA] Created: (JBRULES-946) RuleBase serialization fails with StackOverflowError
by Alexandre Gattiker (JIRA)
RuleBase serialization fails with StackOverflowError
----------------------------------------------------
Key: JBRULES-946
URL: http://jira.jboss.com/jira/browse/JBRULES-946
Project: JBoss Rules
Issue Type: Bug
Security Level: Public (Everyone can see)
Affects Versions: 4.0.0.MR2
Reporter: Alexandre Gattiker
Assigned To: Mark Proctor
I created 920 rules, all in this format, with different values in the string literals.
rule "Rule_1"
when
$g:Parent()
$c:Child(parent==$g,code=="yyy1")
Item(parentObject==$c,name=="xxx1", value == "1")
Item(parentObject==$c,name=="xxx2",value == "1")
Item(parentObject==$g,name=="xxx3",value == "200")
then
System.out.println("2");
end
With the following code, I create a RuleBase that I serialize.
RuleBase ruleBase = RuleBaseFactory.newRuleBase();
PackageBuilderConfiguration conf = new PackageBuilderConfiguration();
conf.setCompiler(PackageBuilderConfiguration.JANINO);
Reader source = new InputStreamReader(PolicyServiceImpl.class.getResourceAsStream(fileName));
PackageBuilder builder = new PackageBuilder(conf);
builder.addPackageFromDrl(source);
Package pkg = builder.getPackage();
ruleBase.addPackage(pkg);
//serialize RuleBase
File outFile = new File(f.getPath() + ".tmp");
FileOutputStream fout = new FileOutputStream(outFile);
ObjectOutputStream oos = new ObjectOutputStream(fout);
oos.writeObject(ruleBase);
oos.close();
The serialization fails with the following exception. Otherwise the RuleBase is perfectly fine and working.
java.lang.StackOverflowError
at java.io.ByteArrayOutputStream.write(ByteArrayOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream$BlockDataOutputStream.write(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.defaultWriteObject(ObjectOutputStream.java(Compiled Code))
at java.util.ArrayList.writeObject(ArrayList.java(Compiled Code))
at sun.reflect.GeneratedMethodAccessor16.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java(Compiled Code))
at java.lang.reflect.Method.invoke(Method.java(Compiled Code))
at java.io.ObjectStreamClass.invokeWriteObject(ObjectStreamClass.java(Compiled Code))
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java(Inlined Compiled Code))
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java(Inlined Compiled Code))
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java(Inlined Compiled Code))
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java(Inlined Compiled Code))
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java(Inlined Compiled Code))
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeObject(ObjectOutputStream.java(Inlined Compiled Code))
at java.util.ArrayList.writeObject(ArrayList.java(Compiled Code))
at sun.reflect.GeneratedMethodAccessor16.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java(Compiled Code))
at java.lang.reflect.Method.invoke(Method.java(Compiled Code))
at java.io.ObjectStreamClass.invokeWriteObject(ObjectStreamClass.java(Compiled Code))
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java(Inlined Compiled Code))
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java(Inlined Compiled Code))
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java(Inlined Compiled Code))
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java(Inlined Compiled Code))
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java(Inlined Compiled Code))
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeObject(ObjectOutputStream.java(Inlined Compiled Code))
at java.util.ArrayList.writeObject(ArrayList.java(Compiled Code))
at sun.reflect.GeneratedMethodAccessor16.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java(Compiled Code))
at java.lang.reflect.Method.invoke(Method.java(Compiled Code))
at java.io.ObjectStreamClass.invokeWriteObject(ObjectStreamClass.java(Compiled Code))
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java(Compiled Code))
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java(Inlined Compiled Code))
(last four lines repeated over 1000 times)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 2 months