[JBoss JIRA] (WFLY-13059) org.apache.ws.security exports Jasypt
by Jim Ma (Jira)
[ https://issues.redhat.com/browse/WFLY-13059?page=com.atlassian.jira.plugi... ]
Jim Ma edited comment on WFLY-13059 at 3/16/20 6:24 AM:
--------------------------------------------------------
[~pmm] I think this would be good that we provide a dedicated module for Jasypt and still export to ws security module. This will allow the old application with jbossws-cxf-client module dependency added can still access jasypt classes. If other application likes yours doesn't want this jasypt export dependency , it can be excluded with one line exclusion config in jboss-deployment-structure.xml.
was (Author: jim.ma):
[~pmm] I think this would be good if we provide a dedicated module for Jasypt and still export to ws security module. This will allow the application with jbossws-cxf-client module dependency can still access jasypt classes. If other the application likes yours doesn't want this jasypt export dependency , it can be excluded with one line exclusion config in jboss-deployment-structure.xml.
> org.apache.ws.security exports Jasypt
> -------------------------------------
>
> Key: WFLY-13059
> URL: https://issues.redhat.com/browse/WFLY-13059
> Project: WildFly
> Issue Type: Bug
> Components: Web Services
> Reporter: Philippe Marschall
> Assignee: Jim Ma
> Priority: Major
>
> The {{org.apache.ws.security}} module contains the Jasypt JAR and exports it. Jasypt is only used internally by {{org.apache.wss4j.common.crypto.JasyptPasswordEncryptor}} and not used externally.
> Our application has a dependency on {{org.jboss.ws.cxf.jbossws-cxf-client}} which has an exported dependency on {{org.apache.ws.security}} which exports Jasypt. As a consequence the Jasypt from the {{org.apache.ws.security}} module is used instead of the Jasypt from our application.
> We would be willing to work on a patch. We see two possible options:
> # Introduce a dedicated Jasypt module and make {{org.apache.ws.security}} depend on it without exporting it
> # Add a resource filter to the {{org.apache.ws.security}} module like this {code}
> <exports>
> <exclude path="org/jasypt/**"/>
> </exports>
> {code}
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
6 years, 3 months
[JBoss JIRA] (LOGMGR-266) log4j2-jboss-logmanager LevelTranslator NullPointer
by Boris Unckel (Jira)
Boris Unckel created LOGMGR-266:
-----------------------------------
Summary: log4j2-jboss-logmanager LevelTranslator NullPointer
Key: LOGMGR-266
URL: https://issues.redhat.com/browse/LOGMGR-266
Project: JBoss Log Manager
Issue Type: Bug
Reporter: Boris Unckel
We found the following Nullpointer Exception
Caused by: java.lang.NullPointerException
at org.jboss.logmanager.log4j.LevelTranslator.translateLevel(LevelTranslator.java:95)
at org.jboss.logmanager.log4j.JBossLogger.getLevel(JBossLogger.java:156)
....
Reason seems that LevelTranslator is not defensive enough. Suggestion:
java.util.logging.Level translateLevel(final Level level) {
//level null is same as level not translated
if(level == null) {
return org.jboss.logmanager.Level.INFO;
}
final java.util.logging.Level result = log4jToJul.get(level.intLevel());
return result == null ? org.jboss.logmanager.Level.INFO : result;
}
Level translateLevel(final java.util.logging.Level level) {
//level null is same as level not translated
if(level == null) {
return Level.INFO;
}
final Level result = julToLog4j.get(level.intValue());
return result == null ? Level.INFO : result;
}
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
6 years, 3 months
[JBoss JIRA] (WFLY-13059) org.apache.ws.security exports Jasypt
by Jim Ma (Jira)
[ https://issues.redhat.com/browse/WFLY-13059?page=com.atlassian.jira.plugi... ]
Jim Ma edited comment on WFLY-13059 at 3/16/20 6:16 AM:
--------------------------------------------------------
[~pmm] I think this would be good if we provide a dedicated module for Jasypt and still export to ws security module. This will allow the application with jbossws-cxf-client module dependency can still access jasypt classes. If other the application likes yours doesn't want this jasypt export dependency , it can be excluded with one line exclusion config in jboss-deployment-structure.xml.
was (Author: jim.ma):
[~pmm] Sorry for the long delay. Did you try to provide a jboss-deployment-structure.xml to exclude org.apache.ws.security module and add all the jars you need in application ?
> org.apache.ws.security exports Jasypt
> -------------------------------------
>
> Key: WFLY-13059
> URL: https://issues.redhat.com/browse/WFLY-13059
> Project: WildFly
> Issue Type: Bug
> Components: Web Services
> Reporter: Philippe Marschall
> Assignee: Jim Ma
> Priority: Major
>
> The {{org.apache.ws.security}} module contains the Jasypt JAR and exports it. Jasypt is only used internally by {{org.apache.wss4j.common.crypto.JasyptPasswordEncryptor}} and not used externally.
> Our application has a dependency on {{org.jboss.ws.cxf.jbossws-cxf-client}} which has an exported dependency on {{org.apache.ws.security}} which exports Jasypt. As a consequence the Jasypt from the {{org.apache.ws.security}} module is used instead of the Jasypt from our application.
> We would be willing to work on a patch. We see two possible options:
> # Introduce a dedicated Jasypt module and make {{org.apache.ws.security}} depend on it without exporting it
> # Add a resource filter to the {{org.apache.ws.security}} module like this {code}
> <exports>
> <exclude path="org/jasypt/**"/>
> </exports>
> {code}
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
6 years, 3 months