May 2010 - jboss-jira - Jboss List Archives

[JBoss JIRA] Updated: (JBWEB-141) Servlet Filter against XSS

by Remy Maucherat (JIRA)

[ https://jira.jboss.org/jira/browse/JBWEB-141?page=com.atlassian.jira.plug... ] Remy Maucherat updated JBWEB-141: --------------------------------- Summary: Servlet Filter against XSS (was: Servlet Filter against XSS and CSRF) I ported a CSRF protection filter that has been added in Tomcat. > Servlet Filter against XSS > -------------------------- > > Key: JBWEB-141 > URL: https://jira.jboss.org/jira/browse/JBWEB-141 > Project: JBoss Web > Issue Type: Feature Request > Security Level: Public(Everyone can see) > Reporter: Marc Schoenefeld > Assignee: Remy Maucherat > Priority: Minor > > Cross-Site scripting and cross-site request forgery attacks are common threat to every web application. > So a common solution offered by the http server is helpful to raise the default protection level. > A servlet filter will help to > a) allow/block requests for a set of XSS regex patterns (per default blacklist suspicious parameter patterns, and optionally whitelist valid requests for well-known applications) > b) allow/block requests that fulfil the criteria for being a forged request (failing nonce compare), this will need a javascript helper on the client side, to transparently protect existing applications to provide the shared secret in the session . -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 2 months

1
0
0 / 0

[JBoss JIRA] Created: (JBRULES-2503) Provide more details in documentation on how to convert from XML rules to DRL rules when using XmlPackageReader

by Tihomir Surdilovic (JIRA)

Provide more details in documentation on how to convert from XML rules to DRL rules when using XmlPackageReader --------------------------------------------------------------------------------------------------------------- Key: JBRULES-2503 URL: https://jira.jboss.org/jira/browse/JBRULES-2503 Project: Drools Issue Type: Feature Request Security Level: Public (Everyone can see) Affects Versions: 5.1.0.M1 Reporter: Tihomir Surdilovic Assignee: Mark Proctor Provide more details and an example in documentation on how to convert from XML rules to DRL rules when using XmlPackageReader. For example: System.setProperty("drools.schema.validating", "false"); PackageBuilderConfiguration conf = new PackageBuilderConfiguration(); final XmlPackageReader xmlPackageReader = new XmlPackageReader( conf.getSemanticModules() ); xmlPackageReader.read( new InputStreamReader( ReadXmlRules.class.getResourceAsStream( "/myrule.xml" ) ) ); final PackageDescr pkgOriginal = xmlPackageReader.getPackageDescr(); final XmlDumper dumper = new XmlDumper(); final String result = dumper.dump( pkgOriginal ); final DrlDumper drldumper = new DrlDumper(); String resultdrl = drldumper.dump( pkgOriginal ); System.out.println("**** XML Rule: \n" + result); System.out.println("****************************"); System.out.println("**** DRL Rule: \n " + resultdrl); -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 2 months

1
0
0 / 0

[JBoss JIRA] Created: (SECURITY-507) JBossXACML: anyURI mismatch

by Anil Saldhana (JIRA)

JBossXACML: anyURI mismatch --------------------------- Key: SECURITY-507 URL: https://jira.jboss.org/jira/browse/SECURITY-507 Project: PicketBox (JBoss Security and Identity Management) Issue Type: Bug Security Level: Public (Everyone can see) Components: JBossXACML Affects Versions: jbossxacml_2.0.5.CR2 Reporter: Anil Saldhana Assignee: Anil Saldhana Fix For: jbossxacml_2.0.5.CR3 Check if there are any issues with anyuri -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 2 months

1
2
0 / 0

[JBoss JIRA] Created: (EJBTHREE-2087) Move jboss-ejb3-timerservice-mk2 to it's own group id

by jaikiran pai (JIRA)

Move jboss-ejb3-timerservice-mk2 to it's own group id ----------------------------------------------------- Key: EJBTHREE-2087 URL: https://jira.jboss.org/jira/browse/EJBTHREE-2087 Project: EJB 3.0 Issue Type: Task Components: timerservice-mk2 Reporter: jaikiran pai Assignee: jaikiran pai Move jboss-ejb3-timerservice-mk2 to org.jboss.ejb3.timerservice group id. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 2 months

1
2
0 / 0

[JBoss JIRA] Updated: (JBAS-2407) EJB3 integration

by Dimitris Andreadis (JIRA)

[ https://jira.jboss.org/jira/browse/JBAS-2407?page=com.atlassian.jira.plug... ] Dimitris Andreadis updated JBAS-2407: ------------------------------------- Fix Version/s: Unscheduled (was: No Release) > EJB3 integration > ---------------- > > Key: JBAS-2407 > URL: https://jira.jboss.org/jira/browse/JBAS-2407 > Project: JBoss Application Server > Issue Type: Task > Security Level: Public(Everyone can see) > Components: EJB3 > Affects Versions: JBossAS-4.0.3 Final, JBossAS-4.0.3 SP1 > Reporter: Adrian Brock > Assignee: Carlo de Wolf > Fix For: Unscheduled > > > Need to review EJB3 integartion such that fixes/features don't get lost across EJB2.1/3.0 -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 2 months

1
0
0 / 0

[JBoss JIRA] Created: (JGRP-1204) bind_addr: use keywords to pick special types of addresses

by Bela Ban (JIRA)

bind_addr: use keywords to pick special types of addresses ---------------------------------------------------------- Key: JGRP-1204 URL: https://jira.jboss.org/jira/browse/JGRP-1204 Project: JGroups Issue Type: Feature Request Reporter: Bela Ban Assignee: Bela Ban Fix For: 2.10 In addition to using dotted-decimal IP addresses and symbolic names for bind addresses, the following values can also be used: - GLOBAL: picks a global (public) address - SITE_LOCAL: an address starting with 192.168.x.x or 10.0.x.x - LINK_LOCAL: a link local address, ie. starting with 169.x.x.x or 254.x.x.x - NON_LOOPBACK (default if bind_addr is not defined): picks any non-loopback address The address is picked from any of the interfaces (which are up) on the host. Examples: #1: <UDP bind_addr="GLOBAL"../> // picks a global IP address if available. If not, falls back to picking any non-loopback address #2: -Djgroups.bind_addr=SITE_LOCAL // picks a site local IP address -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 2 months

1
2
0 / 0

[JBoss JIRA] Created: (EJBTHREE-2074) Closing of ENC context should be handled by EjbEncFactory implementations

by jaikiran pai (JIRA)

Closing of ENC context should be handled by EjbEncFactory implementations ------------------------------------------------------------------------- Key: EJBTHREE-2074 URL: https://jira.jboss.org/jira/browse/EJBTHREE-2074 Project: EJB 3.0 Issue Type: Bug Components: core Affects Versions: EJB3_1 1.0.6, Plugin 1.0.19, 1.1.22 Reporter: jaikiran pai Assignee: jaikiran pai The EJBContainer, currently in its destroy lifecycle method explicitly closes the ENC context: InitialContextFactory.close(enc, this.initialContextProperties); This should instead be handled by the implementations of EjbEncFactory. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 2 months

1
1
0 / 0

[JBoss JIRA] Created: (JBPORTAL-2476) Leaks in LDAP connection pooling

by Boleslaw Dawidowicz (JIRA)

Leaks in LDAP connection pooling -------------------------------- Key: JBPORTAL-2476 URL: https://jira.jboss.org/jira/browse/JBPORTAL-2476 Project: JBoss Portal Issue Type: Bug Security Level: Public (Everyone can see) Components: Portal Identity Affects Versions: Identity-1.1 Reporter: Boleslaw Dawidowicz Assignee: Boleslaw Dawidowicz There are leaks in LDAP connection pooling when changing user memberships with following setup: - LDAPUserModuleImpl - LDAPExtRoleModuleImpl - LDAPStaticGroupMembershipModuleImpl -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 2 months

1
1
0 / 0

[JBoss JIRA] Created: (JBJCA-319) make "ResourceAdapterAssociation" code generation optional

by Jeff Zhang (JIRA)

make "ResourceAdapterAssociation" code generation optional ---------------------------------------------------------- Key: JBJCA-319 URL: https://jira.jboss.org/jira/browse/JBJCA-319 Project: JBoss JCA Issue Type: Task Components: Code Generator Reporter: Jeff Zhang Assignee: Jeff Zhang Fix For: 1.0.0.Alpha12 * ResourceAdapterAssociation should be optional "Use ResourceAdapterAssociation: [Yes/No/Y/N]" -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 2 months

1
1
0 / 0

[JBoss JIRA] Deleted: (JBREM-1221) Update jars to match EAP 5.1.0

by Ron Sigal (JIRA)

[ https://jira.jboss.org/jira/browse/JBREM-1221?page=com.atlassian.jira.plu... ] Ron Sigal deleted JBREM-1221: ----------------------------- > Update jars to match EAP 5.1.0 > ------------------------------ > > Key: JBREM-1221 > URL: https://jira.jboss.org/jira/browse/JBREM-1221 > Project: JBoss Remoting > Issue Type: Task > Security Level: Public(Everyone can see) > Reporter: Ron Sigal > Assignee: Ron Sigal > -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 2 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira May 2010