[JBoss JIRA] (WFLY-9620) ServletContext.getResourceAsStream, for deployments which have (Java EE) servlet overlays, serves files which are outside of the deployment
by Stuart Douglas (JIRA)
[ https://issues.jboss.org/browse/WFLY-9620?page=com.atlassian.jira.plugin.... ]
Stuart Douglas updated WFLY-9620:
---------------------------------
Security Sensitive Issue: (was: This issue is security relevant)
> ServletContext.getResourceAsStream, for deployments which have (Java EE) servlet overlays, serves files which are outside of the deployment
> -------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: WFLY-9620
> URL: https://issues.jboss.org/browse/WFLY-9620
> Project: WildFly
> Issue Type: Bug
> Components: Web (Undertow)
> Affects Versions: 9.0.2.Final, 10.1.0.Final, 11.0.0.Final
> Reporter: Laurent ROUSSEL
> Assignee: Yeray Borges
> Priority: Critical
> Fix For: 12.0.0.Beta1, 12.0.0.Final
>
>
> A user has reported in the forums that there appears to be an issue (since 9.0.x till present 11.0.0 WildFly releases) where files like `/etc/passwd` are served by the web container to the clients, when the client requests a crafted URL against a Java EE deployment which has (Java EE) servlet overlays. Please see the referenced forum thread[1] for more details.
> Although, the steps noted in that thread involves Spring framework and gets triggered in a very specific way, the root cause appears to be the call to `ServletContext.getResourceAsInputStream` (which is what the spring framework ends up calling with a path like "/../../../../../../../..//etc/passwd", ends up actually serving the resource even if the path is outside the scope of the deployment to which the servlet context belongs.
> I could reproduce this against the latest WildFly in a simple test case that's here [2]
> [1] https://developer.jboss.org/thread/276826
> [2] https://github.com/jaikiran/wildfly/commit/ed05258aa824ab91a52ef6554e9707...
> P.S: The credit for reporting this issue should go to Laurent Roussel who reported this in the forum thread, but I don't have access to change the "Reporter" field of the JIRA
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 2 months
[JBoss JIRA] (WFLY-9846) Unsatisfied dependencies for CDI Beans in static module's dependency
by Stuart Douglas (JIRA)
[ https://issues.jboss.org/browse/WFLY-9846?page=com.atlassian.jira.plugin.... ]
Stuart Douglas resolved WFLY-9846.
----------------------------------
Fix Version/s: 13.0.0.Beta1
Resolution: Done
> Unsatisfied dependencies for CDI Beans in static module's dependency
> --------------------------------------------------------------------
>
> Key: WFLY-9846
> URL: https://issues.jboss.org/browse/WFLY-9846
> Project: WildFly
> Issue Type: Bug
> Components: CDI / Weld
> Affects Versions: 11.0.0.Final
> Reporter: Brad Maxwell
> Assignee: Matej Novotny
> Fix For: 13.0.0.Beta1
>
>
> WAR CDI bean is failing to inject a CDI bean from a static module's exported dependency. war -> static module X -> static module Y (containing CDI Beans)
> A WAR uses a static module with the slot attribute. This static module is referenced in jboss-deployment-structure.xml:
> {code}
> <jboss-deployment-structure>
> <deployment>
> <dependencies>
> <module name="module2" meta-inf="export" annotations="true" />
> </dependencies>
> </deployment>
> </jboss-deployment-structure>
> {code}
> module2 which the app depends on is depending on module1 and including/exporting META-INF where the beans.xml is located:
> {code}
> <?xml version="1.0"?>
> <module xmlns="urn:jboss:module:1.5" name="module2">
> <dependencies>
> <module name="module1" export="true">
> <imports>
> <include path="META-INF**"/>
> <include path="org**"/>
> </imports>
> <exports>
> <include path="META-INF**"/>
> <include path="org**"/>
> </exports>
> </module>
> </dependencies>
> </module>
> {code}
> module1 contains the jar with the CDI beans and has a META-INF/beans.xml in it:
> {code}
> <?xml version="1.0" encoding="UTF-8"?>
> <module xmlns="urn:jboss:module:1.5" name="module1">
> <resources>
> <resource-root path="cdi-beans.jar"/>
> </resources>
> <dependencies>
> <module name="javax.faces.api" export="true"/>
> <module name="javax.ejb.api"/>
> <module name="javax.enterprise.api"/>
> </dependencies>
> </module>
> {code}
>
> The deploy fails with the next message:
>
> {code}
> 14:04:07,085 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-3) MSC000001: Failed to start service jboss.deployment.unit."test.war".WeldStartService: org.jboss.msc.service.StartException in service jboss.deployment.unit."test.war".WeldStartService: Failed to start service
> ...
> Caused by: org.jboss.weld.exceptions.DeploymentException: WELD-001408: Unsatisfied dependencies for type ExampleCdiBean with qualifiers @Default
> at injection point [BackedAnnotatedField] @Inject private backingbeans.BackingBean.cdiBean
> at backingbeans.BackingBean.cdiBean(BackingBean.java:0)
> {code}
>
> In JBoss EAP 6.4, this scenario, the CDI is working fine.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 2 months
[JBoss JIRA] (WFLY-2680) java:comp/DefaultDataSource doesn't work in persistence.xml
by Stuart Douglas (JIRA)
[ https://issues.jboss.org/browse/WFLY-2680?page=com.atlassian.jira.plugin.... ]
Stuart Douglas resolved WFLY-2680.
----------------------------------
Resolution: Out of Date
This has been fixed for a while
> java:comp/DefaultDataSource doesn't work in persistence.xml
> -----------------------------------------------------------
>
> Key: WFLY-2680
> URL: https://issues.jboss.org/browse/WFLY-2680
> Project: WildFly
> Issue Type: Feature Request
> Components: EE, JPA / Hibernate
> Affects Versions: 8.0.0.CR1
> Reporter: arjan tijms
> Labels: javaee7, jdbc
>
> Having a persistence.xml with the following content fails the deployment on WildFly 8 CR1:
> {code:xml}
> <?xml version="1.0" encoding="UTF-8"?>
> <persistence version="2.1" xmlns="http://xmlns.jcp.org/xml/ns/persistence" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/persistence http://xmlns.jcp.org/xml/ns/persistence/persistence_2_1.xsd">
>
> <persistence-unit name="testPU">
> <jta-data-source>java:comp/DefaultDataSource</jta-data-source>
> </persistence-unit>
> </persistence>
> {code}
> It results in the following error:
> {noformat}
> 13:51:40,367 ERROR [org.jboss.as.controller.management-operation] (DeploymentScanner-threads - 2) JBAS014613: Operation ("deploy") failed - address: ([("deployment" => "dynamic-named-query.war")]) - failure description: {"JBAS014771: Services with missing/unavailable dependencies" => ["jboss.persistenceunit.\"dynamic-named-query.war#testPU\".__FIRST_PHASE__ is missing [jboss.naming.context.java.module.dynamic-named-query.dynamic-named-query.DefaultDataSource]"]}
> {noformat}
> When I proposed the feature for the default data source over at the Java EE JIRA (https://java.net/jira/browse/JAVAEE_SPEC-4) I intended this to work. In the description I hinted that the standard JNDI name would be the standard alternative for {{java:jboss/datasources/ExampleDS}} on JBoss. The latter indeed does work in {{persistence.xml}} using WildFly 8 CR1.
> Omitting the {{jta-data-source}} element altogether *does* work, which is great. However, I foresee a lot of users tripping over this in the future and just giving up the idea of using a default data source, especially since the error message is very cryptic for new developers.
> In GlassFish 4 using {{java:comp/DefaultDataSource}} in {{persistence.xml}} does work.
> See also WFLY-2027 and WFLY-2158
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 2 months