7:24 a.m.
Thomas Chang [http://community.jboss.org/people/thomas2008ch] created the discussion
"What is Jboss WS Native?"
To view the discussion, visit: http://community.jboss.org/message/629262#629262
--------------------------------------------------------------
Hi all,
recently I got information that there is a security leak by Jboss WS Native if you use the
DOCTYPE [1]. One of my colleagues had wrote a WS which deployed on Jboss EAP 5.1.0 and
works fine. He told me his WS dosen't use the Jboss WS Native. But after I've
deleted all the Jboss WS Native components such as the jbossws-native-xxx.jar, the
../deploy/jbossws.sar and ../deployer/jbossws.deployer, the WS doesn't work. And I got
"java.lang.ClassNotFoundException: org.jboss.ws.core.jaxws.spi.ProviderImpl"
I wonder how to determine if a WS uses Jboss WS Native or not.
[1] http://securitytracker.com/id/1026058 http://securitytracker.com/id/1026058
Thomas
--------------------------------------------------------------
Reply to this message by going to Community
[http://community.jboss.org/message/629262#629262]
Start a new discussion in JBoss Web Services at Community
[http://community.jboss.org/choose-container!input.jspa?contentType=1&...]
11:51 p.m.
New subject: [JBoss Web Services] - Re: What is Jboss WS Native?
Jim Ma [http://community.jboss.org/people/jim.ma] created the discussion
"Re: What is Jboss WS Native?"
To view the discussion, visit: http://community.jboss.org/message/629472#629472
--------------------------------------------------------------
This security issue has been fixed in EAP 5.1.1
--------------------------------------------------------------
Reply to this message by going to Community
[http://community.jboss.org/message/629472#629472]
Start a new discussion in JBoss Web Services at Community
[http://community.jboss.org/choose-container!input.jspa?contentType=1&...]
3:37 a.m.
New subject: [JBoss Web Services] - Re: What is Jboss WS Native?
Alessio Soldano [http://community.jboss.org/people/asoldano] created the discussion
"Re: What is Jboss WS Native?"
To view the discussion, visit: http://community.jboss.org/message/629501#629501
--------------------------------------------------------------
He told me his WS dosen't use the Jboss WS Native. But after
I've deleted all the Jboss WS Native components such as the jbossws-native-xxx.jar,
the ../deploy/jbossws.sar and ../deployer/jbossws.deployer, the WS doesn't work. And I
got "java.lang.ClassNotFoundException:
org.jboss.ws.core.jaxws.spi.ProviderImpl"
I wonder how to determine if a WS uses Jboss WS Native or not.
If the application server version you're using has the jbossws-native stack
installed, any webservices app you deploy on the application server is using
jbossws-native, unless you properly isolate the application and provides different
webservices libraries in the deployment, so that the app can still work (but this is
neither easy to do nor supported).
As Jim mentioned, the security issue has been dealt with, make sure you're using the
latest available EAP product version. Also consider switching to the JBossWS-CXF stack /
EAP version.
--------------------------------------------------------------
Reply to this message by going to Community
[http://community.jboss.org/message/629501#629501]
Start a new discussion in JBoss Web Services at Community
[http://community.jboss.org/choose-container!input.jspa?contentType=1&...]
2:14 a.m.
New subject: [JBoss Web Services] - Re: What is Jboss WS Native?
Thomas Chang [http://community.jboss.org/people/thomas2008ch] created the discussion
"Re: What is Jboss WS Native?"
To view the discussion, visit: http://community.jboss.org/message/629981#629981
--------------------------------------------------------------
But I see my colleague have deleted the pakage "jbossws.sar" under /deploy/ and
the "jbossws-framework.jar" under /jbossws.deployer. Does this mean enough that
his application doesn't use Jboss-WS-Native?
I think my colleague does use a separated classloader for loading his own jars. But seems
still use some of the jbossws-native-xxx.jar.
Besdies, we use maven for compiling and deploy. One can include all the non-jbossws jars
as dependencies in the WAR. I see there is an advantage to this since the application is
independent from Jboss and one can deploy this to othe app-server auch as WebLogic.
Right?
--------------------------------------------------------------
Reply to this message by going to Community
[http://community.jboss.org/message/629981#629981]
Start a new discussion in JBoss Web Services at Community
[http://community.jboss.org/choose-container!input.jspa?contentType=1&...]
5174
days inactive
5179
days old
3 comments
3 participants
participants (3)
-
Alessio Soldano -
Jim Ma
-
Thomas Chang