[JBoss JIRA] (DROOLS-3819) Rule Units 2.0: evaluate 7.x behavior and consider new design
by Edoardo Vacchi (Jira)
[ https://issues.jboss.org/browse/DROOLS-3819?page=com.atlassian.jira.plugi... ]
Edoardo Vacchi updated DROOLS-3819:
-----------------------------------
Description:
I have disabled generation of `unit()` API invocation on DRL compiler in order to make the Unit prototype work quickly. We are now assuming that 1 unit === 1 session, therefore some previous assumptions do not hold anymore. Previous assertions are therefore broken. It is also a good time to re-evaluate some previous considerations on how rule units are supposed to work (e.g. reconsider how guards work etc)
*Deliverable*: PR and (if possible) design document
was:
I have disabled generation of `unit()` API invocation on DRL compiler in order to make the Unit prototype work quickly. We are now assuming that 1 unit === 1 session, therefore some previous assumptions do not hold anymore. Previous assertions are therefore broken. It is also a good time to re-evaluate some previous considerations on how rule units are supposed to work (e.g. reconsider how guards work etc)
*Deliverable*: design document
> Rule Units 2.0: evaluate 7.x behavior and consider new design
> -------------------------------------------------------------
>
> Key: DROOLS-3819
> URL: https://issues.jboss.org/browse/DROOLS-3819
> Project: Drools
> Issue Type: Task
> Reporter: Edoardo Vacchi
> Assignee: Edoardo Vacchi
> Priority: Major
> Labels: drools-core, submarine
> Fix For: 8.0.0.Final
>
>
> I have disabled generation of `unit()` API invocation on DRL compiler in order to make the Unit prototype work quickly. We are now assuming that 1 unit === 1 session, therefore some previous assumptions do not hold anymore. Previous assertions are therefore broken. It is also a good time to re-evaluate some previous considerations on how rule units are supposed to work (e.g. reconsider how guards work etc)
> *Deliverable*: PR and (if possible) design document
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
5 years, 7 months
[JBoss JIRA] (DROOLS-3819) Rule Units 2.0: evaluate 7.x behavior and consider new design
by Edoardo Vacchi (Jira)
[ https://issues.jboss.org/browse/DROOLS-3819?page=com.atlassian.jira.plugi... ]
Edoardo Vacchi updated DROOLS-3819:
-----------------------------------
Issue Type: Task (was: Bug)
Summary: Rule Units 2.0: evaluate 7.x behavior and consider new design (was: Rule Unit Handling: restore older behavior in new prototype)
> Rule Units 2.0: evaluate 7.x behavior and consider new design
> -------------------------------------------------------------
>
> Key: DROOLS-3819
> URL: https://issues.jboss.org/browse/DROOLS-3819
> Project: Drools
> Issue Type: Task
> Reporter: Edoardo Vacchi
> Assignee: Edoardo Vacchi
> Priority: Major
> Labels: drools-core, submarine
> Fix For: 8.0.0.Final
>
>
> I have disabled generation of `unit()` API invocation on DRL compiler in order to make the Unit prototype work quickly. We are now assuming that 1 unit === 1 session, therefore some previous assumptions do not hold anymore. Previous assertions are therefore broken. It is also a good time to re-evaluate some previous considerations on how rule units are supposed to work (e.g. reconsider how guards work etc)
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
5 years, 7 months
[JBoss JIRA] (DROOLS-3819) Rule Units 2.0: evaluate 7.x behavior and consider new design
by Edoardo Vacchi (Jira)
[ https://issues.jboss.org/browse/DROOLS-3819?page=com.atlassian.jira.plugi... ]
Edoardo Vacchi updated DROOLS-3819:
-----------------------------------
Description:
I have disabled generation of `unit()` API invocation on DRL compiler in order to make the Unit prototype work quickly. We are now assuming that 1 unit === 1 session, therefore some previous assumptions do not hold anymore. Previous assertions are therefore broken. It is also a good time to re-evaluate some previous considerations on how rule units are supposed to work (e.g. reconsider how guards work etc)
*Deliverable*: design document
was:I have disabled generation of `unit()` API invocation on DRL compiler in order to make the Unit prototype work quickly. We are now assuming that 1 unit === 1 session, therefore some previous assumptions do not hold anymore. Previous assertions are therefore broken. It is also a good time to re-evaluate some previous considerations on how rule units are supposed to work (e.g. reconsider how guards work etc)
> Rule Units 2.0: evaluate 7.x behavior and consider new design
> -------------------------------------------------------------
>
> Key: DROOLS-3819
> URL: https://issues.jboss.org/browse/DROOLS-3819
> Project: Drools
> Issue Type: Task
> Reporter: Edoardo Vacchi
> Assignee: Edoardo Vacchi
> Priority: Major
> Labels: drools-core, submarine
> Fix For: 8.0.0.Final
>
>
> I have disabled generation of `unit()` API invocation on DRL compiler in order to make the Unit prototype work quickly. We are now assuming that 1 unit === 1 session, therefore some previous assumptions do not hold anymore. Previous assertions are therefore broken. It is also a good time to re-evaluate some previous considerations on how rule units are supposed to work (e.g. reconsider how guards work etc)
> *Deliverable*: design document
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
5 years, 7 months
[JBoss JIRA] (WFLY-12155) Add X-XSS-Protection header to default management config
by Jan Stourac (Jira)
[ https://issues.jboss.org/browse/WFLY-12155?page=com.atlassian.jira.plugin... ]
Jan Stourac updated WFLY-12155:
-------------------------------
Description:
Even though we should probably avoid using non-standardized HTTP headers, since there is already X-FRAME-OPTIONS present in a management WFCORE-1463, I propose to consider to add also [X-XSS-Protection|https://developer.mozilla.org/en-US/docs/Web/HTTP/Header...] header in a default configuration of the management too.
Benefit is slightly improved security for customers using Web Console management.
Viable value variants are one of the following two:
{code}
X-XSS-Protection: 1
X-XSS-Protection: 1; mode=block
{code}
Current header provided:
{code}
curl -v http://localhost:9990/console/index.html
...
< HTTP/1.1 200 OK
< Connection: keep-alive
< Last-Modified: Wed, 29 May 2019 11:09:49 GMT
< X-Frame-Options: SAMEORIGIN
< Content-Length: 1289
< Content-Type: text/html
< Accept-Ranges: bytes
< Date: Mon, 03 Jun 2019 08:05:05 GMT
...
{code}
was:
Even though we should probably avoid using non-standardized HTTP headers, since there is already X-FRAME-OPTIONS present in a management WFCORE-1463, I propose to consider to add also [X-XSS-PROTECTION|https://developer.mozilla.org/en-US/docs/Web/HTTP/Header...] header in a default configuration of the management too.
Benefit is slightly improved security for customers using Web Console management.
Viable value variants are one of the following two:
{code}
X-XSS-Protection: 1
X-XSS-Protection: 1; mode=block
{code}
> Add X-XSS-Protection header to default management config
> --------------------------------------------------------
>
> Key: WFLY-12155
> URL: https://issues.jboss.org/browse/WFLY-12155
> Project: WildFly
> Issue Type: Enhancement
> Components: Management
> Affects Versions: 16.0.0.Final
> Reporter: Jan Stourac
> Assignee: Jeff Mesnil
> Priority: Major
>
> Even though we should probably avoid using non-standardized HTTP headers, since there is already X-FRAME-OPTIONS present in a management WFCORE-1463, I propose to consider to add also [X-XSS-Protection|https://developer.mozilla.org/en-US/docs/Web/HTTP/Header...] header in a default configuration of the management too.
> Benefit is slightly improved security for customers using Web Console management.
> Viable value variants are one of the following two:
> {code}
> X-XSS-Protection: 1
> X-XSS-Protection: 1; mode=block
> {code}
> Current header provided:
> {code}
> curl -v http://localhost:9990/console/index.html
> ...
> < HTTP/1.1 200 OK
> < Connection: keep-alive
> < Last-Modified: Wed, 29 May 2019 11:09:49 GMT
> < X-Frame-Options: SAMEORIGIN
> < Content-Length: 1289
> < Content-Type: text/html
> < Accept-Ranges: bytes
> < Date: Mon, 03 Jun 2019 08:05:05 GMT
> ...
> {code}
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
5 years, 7 months
[JBoss JIRA] (WFLY-12156) Add X-Content-Type-Options header to default management config
by Jan Stourac (Jira)
Jan Stourac created WFLY-12156:
----------------------------------
Summary: Add X-Content-Type-Options header to default management config
Key: WFLY-12156
URL: https://issues.jboss.org/browse/WFLY-12156
Project: WildFly
Issue Type: Enhancement
Components: Management
Affects Versions: 16.0.0.Final
Reporter: Jan Stourac
Assignee: Jeff Mesnil
Even though we should probably avoid using non-standardized HTTP headers, since there is already X-FRAME-OPTIONS present in a management WFCORE-1463, I propose to consider to add also [X-Content-Type-Options|https://developer.mozilla.org/en-US/docs/Web/HTTP/...] header in a default configuration of the management too.
Benefit is slightly improved security for customers using Web Console management.
Current header provided:
{code}
curl -v http://localhost:9990/console/index.html
...
< HTTP/1.1 200 OK
< Connection: keep-alive
< Last-Modified: Wed, 29 May 2019 11:09:49 GMT
< X-Frame-Options: SAMEORIGIN
< Content-Length: 1289
< Content-Type: text/html
< Accept-Ranges: bytes
< Date: Mon, 03 Jun 2019 08:05:05 GMT
...
{code}
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
5 years, 7 months
[JBoss JIRA] (WFLY-12155) Add X-XSS-Protection header to default management config
by Jan Stourac (Jira)
Jan Stourac created WFLY-12155:
----------------------------------
Summary: Add X-XSS-Protection header to default management config
Key: WFLY-12155
URL: https://issues.jboss.org/browse/WFLY-12155
Project: WildFly
Issue Type: Enhancement
Components: Management
Affects Versions: 16.0.0.Final
Reporter: Jan Stourac
Assignee: Jeff Mesnil
Even though we should probably avoid using non-standardized HTTP headers, since there is already X-FRAME-OPTIONS present in a management WFCORE-1463, I propose to consider to add also [X-XSS-PROTECTION|https://developer.mozilla.org/en-US/docs/Web/HTTP/Header...] header in a default configuration of the management too.
Benefit is slightly improved security for customers using Web Console management.
Viable value variants are one of the following two:
{code}
X-XSS-Protection: 1
X-XSS-Protection: 1; mode=block
{code}
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
5 years, 7 months