[JBoss JIRA] (WFLY-9853) NameNotFoundException due to policyRegistration -- service jboss.naming.context.java.policyRegistration
by RH Bugzilla Integration (JIRA)
[ https://issues.jboss.org/browse/WFLY-9853?page=com.atlassian.jira.plugin.... ]
RH Bugzilla Integration commented on WFLY-9853:
-----------------------------------------------
Jiri Ondrusek <jondruse(a)redhat.com> changed the Status of [bug 1510010|https://bugzilla.redhat.com/show_bug.cgi?id=1510010] from POST to MODIFIED
> NameNotFoundException due to policyRegistration -- service jboss.naming.context.java.policyRegistration
> -------------------------------------------------------------------------------------------------------
>
> Key: WFLY-9853
> URL: https://issues.jboss.org/browse/WFLY-9853
> Project: WildFly
> Issue Type: Bug
> Components: Security
> Reporter: Chao Wang
> Assignee: Stefan Guilhen
>
> "NameNotFoundException due to policyRegistration -- service jboss.naming.context.java.policyRegistration" is recorded in server.log during quickstart example run by changing log level:
> {noformat}
> <logger category="org.jboss.as.security">
> <level name="TRACE"/>
> </logger>
> <logger category="org.jboss.security">
> <level name="TRACE"/>
> </logger>
> {noformat}
> See detailed description in community discussion [#907134|https://developer.jboss.org/message/907134]
> I choose Jira component picketbox since the exception is titled as "PBOX000293: Exception caught: javax.naming.NameNotFoundException"
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 3 months
[JBoss JIRA] (WFCORE-2160) Incorrect JBOSS_HOME warning in vault.sh
by RH Bugzilla Integration (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2160?page=com.atlassian.jira.plugi... ]
RH Bugzilla Integration commented on WFCORE-2160:
-------------------------------------------------
Jiri Ondrusek <jondruse(a)redhat.com> changed the Status of [bug 1410924|https://bugzilla.redhat.com/show_bug.cgi?id=1410924] from POST to MODIFIED
> Incorrect JBOSS_HOME warning in vault.sh
> ----------------------------------------
>
> Key: WFCORE-2160
> URL: https://issues.jboss.org/browse/WFCORE-2160
> Project: WildFly Core
> Issue Type: Bug
> Components: Scripts
> Affects Versions: 3.0.0.Alpha16
> Reporter: Dennis Reed
> Assignee: Romain Pelisse
> Priority: Minor
> Fix For: 3.0.0.Alpha23
>
>
> vault.sh has an incorrect check to make sure JBOSS_HOME is set correctly.
> SANITIZED_JBOSS_HOME=`cd "$JBOSS_HOME/.."; pwd`
> if [ "$RESOLVED_JBOSS" != "$SANITIZED_JBOSS_HOME" ]; then
> The check will always fail because of the incorrect "/..", which should be removed.
> The incorrect value is only used for printing the "WARNING JBOSS_HOME may be pointing to a different installation - unpredictable results may occur." log, and appears to have been around since at least EAP 6.0.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 3 months
[JBoss JIRA] (WFCORE-3747) Enhance credential-store description related to location and type attributes
by Claudio Miranda (JIRA)
Claudio Miranda created WFCORE-3747:
---------------------------------------
Summary: Enhance credential-store description related to location and type attributes
Key: WFCORE-3747
URL: https://issues.jboss.org/browse/WFCORE-3747
Project: WildFly Core
Issue Type: Enhancement
Components: Security
Reporter: Claudio Miranda
Assignee: Darran Lofthouse
The description for "location" and "type" for credential-store resource is displayed below.
Following discussion of WFCORE-3458, the "location" attribute is required only when the "type" is file based, but the description doesn't says that, the description may be improved to reflect this behavior and list the possible file based types.
When the user doesn't set the "type" attribute it defaults to "JCEKS", but there is no "default" value on resource description for "type" attribute.
{code}
"location" => {
"type" => STRING,
"description" => "File name of credential store storage.",
"attribute-group" => "implementation",
"expressions-allowed" => true,
"required" => false,
"nillable" => true,
"min-length" => 1L,
"max-length" => 2147483647L,
"access-type" => "read-write",
"storage" => "configuration",
"restart-required" => "all-services"
},
"type" => {
"type" => STRING,
"description" => "The credential store type, e.g. KeyStoreCredentialStore.",
"attribute-group" => "implementation",
"expressions-allowed" => true,
"required" => false,
"nillable" => true,
"min-length" => 1L,
"max-length" => 2147483647L,
"access-type" => "read-write",
"storage" => "configuration",
"restart-required" => "all-services"
}
{code}
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 3 months
[JBoss JIRA] (WFLY-10101) [Artemis 2.x upgrade] Unexptected crash of server in SOAK test
by Clebert Suconic (JIRA)
[ https://issues.jboss.org/browse/WFLY-10101?page=com.atlassian.jira.plugin... ]
Clebert Suconic edited comment on WFLY-10101 at 4/13/18 2:14 PM:
-----------------------------------------------------------------
The only halt supposed to exist is the critical analyzer.
That’s why I suggested it.
was (Author: clebert.suconic):
The only half supposed to exist is the critical analyzer.
That’s why I suggested it.
> [Artemis 2.x upgrade] Unexptected crash of server in SOAK test
> --------------------------------------------------------------
>
> Key: WFLY-10101
> URL: https://issues.jboss.org/browse/WFLY-10101
> Project: WildFly
> Issue Type: Bug
> Components: JMS
> Reporter: Miroslav Novak
> Assignee: Martyn Taylor
> Priority: Blocker
> Labels: feature-branch-blocker
>
> After ~13 hours there is unexpected crash of one server in SOAK test. There is no error/warning in the logs.
> Test Scenario:
> * Start 2 servers
> * Client sends messages to input queue. Messages then go through:
> * One server to another through MDB reading and sending them from remote container through resource adapter
> * Messages are forwarded from one server to another over JMS bridge and back over Core bridge
> * Messages have JMSReplyTo defined with a temporary queue, that is filled with responses for the client
> * Messages are read from the destination with stateless EJB and sent back to clients
> * Client reads the messages after the pass through all the soak modules.
> Pass Criteria: In the last step receiver consumes all messages sent by producer.
> Actual Result:
> After ~13 hours 1st server suddenly crashes. There is no error/warning in server logs.
> Issue was hit with Artemis 2.5.0 with https://github.com/jmesnil/wildfly/tree/WFLY-9407_upgrade_artemis_2.4.0_w... (commit 51dd8102f103ccb0470a3cfc8713d3f9bdb1b65d)
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 3 months
[JBoss JIRA] (WFLY-10101) [Artemis 2.x upgrade] Unexptected crash of server in SOAK test
by Clebert Suconic (JIRA)
[ https://issues.jboss.org/browse/WFLY-10101?page=com.atlassian.jira.plugin... ]
Clebert Suconic commented on WFLY-10101:
----------------------------------------
Miroslav> do you have the exit code at least?
if it's 70.. it's quite possible it's the Halt from Critical Analyzer for some weird reason.
> [Artemis 2.x upgrade] Unexptected crash of server in SOAK test
> --------------------------------------------------------------
>
> Key: WFLY-10101
> URL: https://issues.jboss.org/browse/WFLY-10101
> Project: WildFly
> Issue Type: Bug
> Components: JMS
> Reporter: Miroslav Novak
> Assignee: Martyn Taylor
> Priority: Blocker
> Labels: feature-branch-blocker
>
> After ~13 hours there is unexpected crash of one server in SOAK test. There is no error/warning in the logs.
> Test Scenario:
> * Start 2 servers
> * Client sends messages to input queue. Messages then go through:
> * One server to another through MDB reading and sending them from remote container through resource adapter
> * Messages are forwarded from one server to another over JMS bridge and back over Core bridge
> * Messages have JMSReplyTo defined with a temporary queue, that is filled with responses for the client
> * Messages are read from the destination with stateless EJB and sent back to clients
> * Client reads the messages after the pass through all the soak modules.
> Pass Criteria: In the last step receiver consumes all messages sent by producer.
> Actual Result:
> After ~13 hours 1st server suddenly crashes. There is no error/warning in server logs.
> Issue was hit with Artemis 2.5.0 with https://github.com/jmesnil/wildfly/tree/WFLY-9407_upgrade_artemis_2.4.0_w... (commit 51dd8102f103ccb0470a3cfc8713d3f9bdb1b65d)
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 3 months
[JBoss JIRA] (WFLY-10239) ServletContext.getResourceAsStream, for deployments which have (Java EE) servlet overlays, serves files which are outside of the deployment
by James Perkins (JIRA)
James Perkins created WFLY-10239:
------------------------------------
Summary: ServletContext.getResourceAsStream, for deployments which have (Java EE) servlet overlays, serves files which are outside of the deployment
Key: WFLY-10239
URL: https://issues.jboss.org/browse/WFLY-10239
Project: WildFly
Issue Type: Bug
Components: Web (Undertow)
Affects Versions: 9.0.2.Final, 10.1.0.Final, 11.0.0.Final
Reporter: Laurent ROUSSEL
Assignee: Yeray Borges
Priority: Critical
Fix For: 12.0.0.Beta1, 12.0.0.Final
A user has reported in the forums that there appears to be an issue (since 9.0.x till present 11.0.0 WildFly releases) where files like `/etc/passwd` are served by the web container to the clients, when the client requests a crafted URL against a Java EE deployment which has (Java EE) servlet overlays. Please see the referenced forum thread[1] for more details.
Although, the steps noted in that thread involves Spring framework and gets triggered in a very specific way, the root cause appears to be the call to `ServletContext.getResourceAsInputStream` (which is what the spring framework ends up calling with a path like "/../../../../../../../..//etc/passwd", ends up actually serving the resource even if the path is outside the scope of the deployment to which the servlet context belongs.
I could reproduce this against the latest WildFly in a simple test case that's here [2]
[1] https://developer.jboss.org/thread/276826
[2] https://github.com/jaikiran/wildfly/commit/ed05258aa824ab91a52ef6554e9707...
P.S: The credit for reporting this issue should go to Laurent Roussel who reported this in the forum thread, but I don't have access to change the "Reporter" field of the JIRA
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 3 months