November 2019 - jboss-jira - Jboss List Archives

[JBoss JIRA] (WFLY-12808) Upgrade Weld from 3.1.2.Final to 3.1.3.Final

by Chao Wang (Jira)

Chao Wang created WFLY-12808: -------------------------------- Summary: Upgrade Weld from 3.1.2.Final to 3.1.3.Final Key: WFLY-12808 URL: https://issues.jboss.org/browse/WFLY-12808 Project: WildFly Issue Type: Component Upgrade Components: CDI / Weld Reporter: Chao Wang Assignee: manovotn Fix For: 18.0.0.Beta1, 18.0.0.Final Upgrade Weld to 3.1.2.Final and Weld API to 3.1.SP1. More details on updates are here - http://weld.cdi-spec.org/news/2019/08/06/weld-312Final/ -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFLY-12808) Upgrade Weld from 3.1.2.Final to 3.1.3.Final

by Chao Wang (Jira)

[ https://issues.jboss.org/browse/WFLY-12808?page=com.atlassian.jira.plugin... ] Chao Wang updated WFLY-12808: ----------------------------- Description: Upgrade Weld to 3.1.3.Final (was: Upgrade Weld to 3.1.2.Final and Weld API to 3.1.SP1. More details on updates are here - http://weld.cdi-spec.org/news/2019/08/06/weld-312Final/) > Upgrade Weld from 3.1.2.Final to 3.1.3.Final > -------------------------------------------- > > Key: WFLY-12808 > URL: https://issues.jboss.org/browse/WFLY-12808 > Project: WildFly > Issue Type: Component Upgrade > Components: CDI / Weld > Reporter: Chao Wang > Assignee: manovotn > Priority: Major > Fix For: 18.0.0.Beta1, 18.0.0.Final > > > Upgrade Weld to 3.1.3.Final -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFWIP-270) Configured headers can override headers added by the corresponding endpoint

by Darran Lofthouse (Jira)

[ https://issues.jboss.org/browse/WFWIP-270?page=com.atlassian.jira.plugin.... ] Darran Lofthouse commented on WFWIP-270: ---------------------------------------- TBH no I don't believe it is an important use case, however as I have mentioned it in the analysis testing has been performed. The primary use case for this RFE is to set headers we don't presently set at all. In the analysis and community docs I think I will add that call out to say the override is not guaranteed / unspecified - when I added the line in the analysis I was more trying to cover the scenario that we can not prevent the endpoint overriding the header rather than offering a guarantee. The only two headers for now that are confirmed problematic are "Connection" and "Date" so I will just restrict those. > Configured headers can override headers added by the corresponding endpoint > --------------------------------------------------------------------------- > > Key: WFWIP-270 > URL: https://issues.jboss.org/browse/WFWIP-270 > Project: WildFly WIP > Issue Type: Bug > Components: Security > Reporter: Tomas Terem > Assignee: Darran Lofthouse > Priority: Blocker > Labels: management > > [Analysis document|https://github.com/wildfly/wildfly-proposals/pull/263] says that > 'Configured headers will not override any headers added by the corresponding endpoint.' > However, I was able to override Connection and Date headers on /management endpoint. -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFLY-12574) Documentation for SSH authentication for Git persistence

by Ashley Abdel-Sayed (Jira)

[ https://issues.jboss.org/browse/WFLY-12574?page=com.atlassian.jira.plugin... ] Ashley Abdel-Sayed updated WFLY-12574: -------------------------------------- Git Pull Request: https://github.com/wildfly/wildfly/pull/12791 > Documentation for SSH authentication for Git persistence > -------------------------------------------------------- > > Key: WFLY-12574 > URL: https://issues.jboss.org/browse/WFLY-12574 > Project: WildFly > Issue Type: Feature Request > Components: Management, Security > Reporter: Ashley Abdel-Sayed > Assignee: Ashley Abdel-Sayed > Priority: Major > Fix For: 11.0.0.Beta1 > > > Currently Elytron only supports authentication for HTTP(s) URLS so there is no way to connect to a SSH git server to pull/push configuration history -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-4484) Support SSH authentication for Git persistence

by Ashley Abdel-Sayed (Jira)

[ https://issues.jboss.org/browse/WFCORE-4484?page=com.atlassian.jira.plugi... ] Ashley Abdel-Sayed updated WFCORE-4484: --------------------------------------- Git Pull Request: https://github.com/wildfly/wildfly-core/pull/4006 > Support SSH authentication for Git persistence > ---------------------------------------------- > > Key: WFCORE-4484 > URL: https://issues.jboss.org/browse/WFCORE-4484 > Project: WildFly Core > Issue Type: Feature Request > Components: Management, Security > Reporter: Farah Juma > Assignee: Ashley Abdel-Sayed > Priority: Major > Labels: EAP-CD19 > Fix For: 11.0.0.Beta3 > > > Currently Elytron only supports authentication for HTTP(s) URLS so there is no way to connect to a SSH git server to pull/push configuration history -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFWIP-270) Configured headers can override headers added by the corresponding endpoint

by Brian Stansberry (Jira)

[ https://issues.jboss.org/browse/WFWIP-270?page=com.atlassian.jira.plugin.... ] Brian Stansberry commented on WFWIP-270: ---------------------------------------- [~dlofthouse]+1 to your last paragraph in your long comment. Is the user attempting to specify a header that the endpoint already sets an important use case? On an analysis comment you mention: "A number of headers that we already set are known to be problematic" Do you mean the values we set may not be what the user wants from a security POV, i.e. our current behavior is a problem? Or is 'problematic' just referring to this issue of not having clear control over override behavior? I suggest going further than saying non-override behavior is 'not guaranteed' and go all the way to 'unspecified', e.g. "If a constant-header is configured whose name is the same as one the endpoint provides without that configuration, whether the configured value will be used is unspecified and may change from release to release. Overriding the endpoint's headers is not encouraged." Validation to reject ones we know shouldn't be set sounds good. > Configured headers can override headers added by the corresponding endpoint > --------------------------------------------------------------------------- > > Key: WFWIP-270 > URL: https://issues.jboss.org/browse/WFWIP-270 > Project: WildFly WIP > Issue Type: Bug > Components: Security > Reporter: Tomas Terem > Assignee: Darran Lofthouse > Priority: Blocker > Labels: management > > [Analysis document|https://github.com/wildfly/wildfly-proposals/pull/263] says that > 'Configured headers will not override any headers added by the corresponding endpoint.' > However, I was able to override Connection and Date headers on /management endpoint. -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFWIP-270) Configured headers can override headers added by the corresponding endpoint

by Darran Lofthouse (Jira)

[ https://issues.jboss.org/browse/WFWIP-270?page=com.atlassian.jira.plugin.... ] Darran Lofthouse commented on WFWIP-270: ---------------------------------------- [~jmesnil] / [~brian.stansberry] ^^ I think you have both commented on header overrides - does my previous comment make sense to you? We reach a point where there is a limit to how much we can actually do as there are numerous interactions in the handler chain. > Configured headers can override headers added by the corresponding endpoint > --------------------------------------------------------------------------- > > Key: WFWIP-270 > URL: https://issues.jboss.org/browse/WFWIP-270 > Project: WildFly WIP > Issue Type: Bug > Components: Security > Reporter: Tomas Terem > Assignee: Darran Lofthouse > Priority: Blocker > Labels: management > > [Analysis document|https://github.com/wildfly/wildfly-proposals/pull/263] says that > 'Configured headers will not override any headers added by the corresponding endpoint.' > However, I was able to override Connection and Date headers on /management endpoint. -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFWIP-270) Configured headers can override headers added by the corresponding endpoint

by Darran Lofthouse (Jira)

[ https://issues.jboss.org/browse/WFWIP-270?page=com.atlassian.jira.plugin.... ] Darran Lofthouse commented on WFWIP-270: ---------------------------------------- We may change the definition slightly in the analysis. If we want we can identify some headers which we will prevent from being defined, 'Connection' and 'Date' are two candidates for this list. The implementation of path based headers relies on being early in the handler chain, as a request is received we get in there immediately and set the configured headers. The headers are the first thing written in any HTTP response, once the request is processed by it's target handler there is always the possibility it will cause the response to start to be written (headers first) - if this happens we loose the opportunity to retrospectively set any headers so we can not set our headers after processing is complete as that can be too late. A further complication is how individual handlers are implemented, if after our handler is called the target handler just calls put with a header the value set by the handler will replace the value we previously set. Undertow does not provide us a way to protect against that. However some handlers will check if a header has already been set before setting one itself, that is the case for the two examples here which is why the configuration is overriding. It is impossible for us to come up with a complete list of headers that will only be set if not already set as the deployed contexts are dynamic so we don't know how the other contexts could implement their header handling, additionally it will be very hard to prevent subsequent changes to those handlers. I think if we add some validation that prevents 'Connection' and 'Date' being set it would leave us with something that can be expanded in the future. In other cases we will just make sure it is clear that this non-override statement is not guaranteed as it will depend on the individual endpoint. > Configured headers can override headers added by the corresponding endpoint > --------------------------------------------------------------------------- > > Key: WFWIP-270 > URL: https://issues.jboss.org/browse/WFWIP-270 > Project: WildFly WIP > Issue Type: Bug > Components: Security > Reporter: Tomas Terem > Assignee: Darran Lofthouse > Priority: Blocker > Labels: management > > [Analysis document|https://github.com/wildfly/wildfly-proposals/pull/263] says that > 'Configured headers will not override any headers added by the corresponding endpoint.' > However, I was able to override Connection and Date headers on /management endpoint. -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFWIP-272) Specifying header name containing '\'n in constant-headers causes fatal error

by Darran Lofthouse (Jira)

[ https://issues.jboss.org/browse/WFWIP-272?page=com.atlassian.jira.plugin.... ] Darran Lofthouse resolved WFWIP-272. ------------------------------------ Resolution: Done https://github.com/darranl/wildfly-core/commit/134d0ec26641efce676c877468... > Specifying header name containing '\'n in constant-headers causes fatal error > ----------------------------------------------------------------------------- > > Key: WFWIP-272 > URL: https://issues.jboss.org/browse/WFWIP-272 > Project: WildFly WIP > Issue Type: Bug > Components: Security > Reporter: Tomas Terem > Assignee: Darran Lofthouse > Priority: Blocker > Labels: management > > Specifying header name containing '\'n in constant-headers causes fatal error: > {code:java} > 10:02:36,853 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-1) MSC000001: Failed to start service org.wildfly.management.http.extensible: org.jboss.msc.service.StartException in service org.wildfly.management.http.extensible: WFLYSRV0083: Failed to start the http-interface service > at org.jboss.as.server.mgmt.UndertowHttpManagementService.start(UndertowHttpManagementService.java:393) > at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1739) > at org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1701) > at org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1559) > at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) > at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982) > at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486) > at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377) > at java.lang.Thread.run(Thread.java:748) > Caused by: java.lang.IllegalArgumentException: UT000149: HttpString is not allowed to contain newlines. value: A > B > at io.undertow.util.HttpString.checkForNewlines(HttpString.java:126) > at io.undertow.util.HttpString.<init>(HttpString.java:120) > at io.undertow.util.HttpString.<init>(HttpString.java:103) > at org.jboss.as.domain.http.server.StaticHeadersHandler$HeaderConstant.<init>(StaticHeadersHandler.java:70) > at org.jboss.as.domain.http.server.StaticHeadersHandler.addHeader(StaticHeadersHandler.java:61) > at org.jboss.as.domain.http.server.ManagementHttpServer.setupOpenListener(ManagementHttpServer.java:369) > at org.jboss.as.domain.http.server.ManagementHttpServer.create(ManagementHttpServer.java:279) > at org.jboss.as.domain.http.server.ManagementHttpServer.access$2600(ManagementHttpServer.java:111) > at org.jboss.as.domain.http.server.ManagementHttpServer$Builder.build(ManagementHttpServer.java:666) > at org.jboss.as.server.mgmt.UndertowHttpManagementService.start(UndertowHttpManagementService.java:351) > ... 8 more > 10:02:36,856 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([ > ("core-service" => "management"), > ("management-interface" => "http-interface") > ]) - failure description: {"WFLYCTL0080: Failed services" => {"org.wildfly.management.http.extensible" => "WFLYSRV0083: Failed to start the http-interface service > Caused by: java.lang.IllegalArgumentException: UT000149: HttpString is not allowed to contain newlines. value: A > B"}} > 10:02:36,856 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([ > ("core-service" => "management"), > ("management-interface" => "http-interface") > ]) - failure description: {"WFLYCTL0080: Failed services" => {"org.wildfly.management.http.extensible" => "WFLYSRV0083: Failed to start the http-interface service > Caused by: java.lang.IllegalArgumentException: UT000149: HttpString is not allowed to contain newlines. value: A > B"}} > 10:02:36,868 FATAL [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0056: Server boot has failed in an unrecoverable manner; exiting. See previous messages for details. > 10:02:36,875 INFO [org.jboss.as] (MSC service thread 1-5) WFLYSRV0050: WildFly Core 11.0.0.Beta3-SNAPSHOT stopped in 3ms > {code} -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFWIP-271) Header name must not contain space

by Darran Lofthouse (Jira)

[ https://issues.jboss.org/browse/WFWIP-271?page=com.atlassian.jira.plugin.... ] Darran Lofthouse resolved WFWIP-271. ------------------------------------ Resolution: Done https://github.com/darranl/wildfly-core/commit/134d0ec26641efce676c877468... > Header name must not contain space > ---------------------------------- > > Key: WFWIP-271 > URL: https://issues.jboss.org/browse/WFWIP-271 > Project: WildFly WIP > Issue Type: Bug > Components: Security > Reporter: Tomas Terem > Assignee: Darran Lofthouse > Priority: Blocker > Labels: management > > Constant-headers allows to configure header name containing space, which shouldn't be possible according to > https://tools.ietf.org/html/rfc5322#section-2.2 > A field name MUST be composed of printable US-ASCII characters (i.e.,characters that have values between 33 and 126, inclusive), except colon. -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years, 8 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira November 2019