[JBoss JIRA] (JBIDE-20976) Create and use Neon M3 target platform (was: Versions of 3rd party plugins in JBDS 10 are LESS than in JBDS 9)
by Nick Boldt (JIRA)
[ https://issues.jboss.org/browse/JBIDE-20976?page=com.atlassian.jira.plugi... ]
Nick Boldt commented on JBIDE-20976:
------------------------------------
My PR applied in 4.60.x branch. Building 4.60.0.Alpha1-SNAPSHOT:
https://jenkins.mw.lab.eng.bos.redhat.com/hudson/job/jbosstoolstargetplat... >=472
> Create and use Neon M3 target platform (was: Versions of 3rd party plugins in JBDS 10 are LESS than in JBDS 9)
> --------------------------------------------------------------------------------------------------------------
>
> Key: JBIDE-20976
> URL: https://issues.jboss.org/browse/JBIDE-20976
> Project: Tools (JBoss Tools)
> Issue Type: Bug
> Components: target-platform, upstream
> Affects Versions: 4.4.0.Alpha1
> Reporter: Nick Boldt
> Assignee: Nick Boldt
> Priority: Critical
> Fix For: 4.4.0.Alpha1
>
> Attachments: features_Mars.0-vs.1.vs.NeonM2.png.png, JBIDE20976_NeonM2.png, JBIDE20976_NeonM2_sapphire.png, p2diff-all.txt, p2diff-summary.txt, p2diff.central.summary.txt, p2diff.central.txt, p2diff.ea.summary.txt, p2diff.ea.txt, p2diff.jbdevstudio_v2.txt, p2diff.jbosstools.txt, plugins_Mars.0-vs.1.vs.NeonM2.png, versionwatch-features.png, versionwatch-plugins.png
>
>
> Opened in JBIDE (not JBDS) because the TPs are essentially the same, so this affects both JBT and JBDS.
> Could be a problem w/ the .target files, or a problem upstream w/ Eclipse projects in Neon not being updated from Mars.0 to their Mars.1 version (or newer).
> Details in these logs:
> http://download.jboss.org/jbosstools/10.0/snapshots/builds/devstudio.vers...
> http://download.jboss.org/jbosstools/10.0/snapshots/builds/devstudio.vers...
> Affected IUs (now sorted alphabetically):
> {code}
> org.eclipse.core.runtime 3.11.1.v20150903-1804
> org.eclipse.egit 4.0.2.201509141540-r
> org.eclipse.egit.core 4.0.2.201509141540-r
> org.eclipse.egit.doc 4.0.2.201509141540-r
> org.eclipse.egit.ui 4.0.2.201509141540-r
> org.eclipse.equinox.p2.rcp.feature 1.2.101.v20150826-1318
> org.eclipse.equinox.p2.user.ui 2.2.101.v20150826-1318
> org.eclipse.jdt 3.11.1.v20150904-0015
> org.eclipse.jdt.doc.user 3.11.1.v20150819-1130
> org.eclipse.jetty.webapp 9.2.13.v20150730
> org.eclipse.jetty.xml 9.2.13.v20150730
> org.eclipse.jgit 4.0.2.201509141540-r
> org.eclipse.jgit.archive 4.0.2.201509141540-r
> org.eclipse.jst.common.frameworks 1.1.701.v201509021802
> org.eclipse.jst.server.tomcat.core 1.1.701.v201508232356
> org.eclipse.jst.web_core.feature 3.7.1.v201509021802
> org.eclipse.jst.web_ui.feature 3.7.1.v201509021802
> org.eclipse.jst.webpageeditor.feature 2.7.1.v201508270443
> org.eclipse.pde 3.11.1.v20150904-0345
> org.eclipse.pde.doc.user 3.11.1.v20150903-1352
> org.eclipse.platform 4.5.1.v20150904-0015
> org.eclipse.platform.doc.user 4.5.1.v20150819-1130
> org.eclipse.rcp 4.5.1.v20150904-0015
> org.eclipse.sapphire 9.0.1.201509151939
> org.eclipse.sapphire.java 9.0.1.201509151939
> org.eclipse.sapphire.java.jdt 9.0.1.201509151939
> org.eclipse.sapphire.java.jdt.ui 9.0.1.201509151939
> org.eclipse.sapphire.modeling 9.0.1.201509151939
> org.eclipse.sapphire.modeling.xml 9.0.1.201509151939
> org.eclipse.sapphire.osgi 9.0.1.201509151939
> org.eclipse.sapphire.osgi.fragment 9.0.1.201509151939
> org.eclipse.sapphire.platform 9.0.1.201509151939
> org.eclipse.sapphire.ui 9.0.1.201509151939
> org.eclipse.sapphire.ui.swt.gef 9.0.1.201509151939
> org.eclipse.sapphire.ui.swt.xml.editor 9.0.1.201509151939
> org.eclipse.sapphire.workspace 9.0.1.201509151939
> org.eclipse.sapphire.workspace.ui 9.0.1.201509151939
> org.eclipse.swt 3.104.1.v20150825-0743
> org.eclipse.wst.common_core.feature 3.7.1.v201508262220
> org.eclipse.wst.common_ui.feature 3.7.1.v201508262220
> org.eclipse.wst.jsdt.feature 1.6.201.v201508262249
> org.eclipse.wst.server.core 1.7.0.v201508271522
> org.eclipse.wst.server.discovery 1.1.0.v201508271522
> org.eclipse.wst.server.ui 1.5.201.v201509022125
> org.eclipse.wst.server_core.feature 3.3.600.v201508271522
> org.eclipse.wst.server_ui.feature 3.3.600.v201509022125
> org.eclipse.wst.validation 1.2.700.v201508251749
> org.eclipse.wst.web_core.feature 3.7.1.v201508271605
> org.eclipse.wst.web_ui.feature 3.7.1.v201509022125
> org.eclipse.wst.ws_ui.feature 3.7.1.v201508271926
> org.eclipse.wst.xml_ui.feature 3.7.1.v201508271605
> {code}
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years, 4 months
[JBoss JIRA] (JBDS-3560) Arbitrary remote code execution with InvokerTransformer (COLLECTIONS-580)
by Nick Boldt (JIRA)
[ https://issues.jboss.org/browse/JBDS-3560?page=com.atlassian.jira.plugin.... ]
Nick Boldt commented on JBDS-3560:
----------------------------------
Applied in both 4.50.x and 4.51.x, and the 4.60.x branches.
Building 3 target platforms :
4.50.1.CR1-SNAPSHOT
4.51.1.CR1-SNAPSHOT
4.60.0.Alpha1-SNAPSHOT
https://jenkins.mw.lab.eng.bos.redhat.com/hudson/job/jbosstoolstargetplat... >=472
> Arbitrary remote code execution with InvokerTransformer (COLLECTIONS-580)
> -------------------------------------------------------------------------
>
> Key: JBDS-3560
> URL: https://issues.jboss.org/browse/JBDS-3560
> Project: Developer Studio (JBoss Developer Studio)
> Issue Type: Bug
> Components: upstream
> Affects Versions: 8.1.0.GA, 9.0.0.GA, 10.0.0.Alpha1
> Reporter: Nick Boldt
> Assignee: Max Rydahl Andersen
> Fix For: 9.1.0.Beta1, 10.0.0.Alpha1
>
> Attachments: apache-commons-collections-in-JBDS7,8,9,10.png, apache-commons-collections-in-JBDS7,8,9,10_refs1.png, apache-commons-collections-in-JBDS7,8,9,10_refs10.png, apache-commons-collections-in-JBDS7,8,9,10_refs7.png, apache-commons-collections-in-JBDS7,8,9,10_refs8-IS-fuse.png, apache-commons-collections-in-JBDS7,8,9,10_refs8.png, apache-commons-collections-in-JBDS7,8,9,10_refs9.png, orbit.R20150519210750_vs_I20151117200049.log.txt, orbit.R20150519210750_vs_I20151117200049.log_onlyLatest.txt
>
>
> This is a container issue to wrap & track https://issues.apache.org/jira/browse/COLLECTIONS-580
> Problem is that JBDS 9 (and probably 8 and 10 too) include org.apache.commons.collections 3.2.0.v2013030210310, which is affected by COLLECTIONS-580 - Arbitrary remote code execution with InvokerTransformer
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years, 4 months
[JBoss JIRA] (JBIDE-21105) Remove BIRT?
by Nick Boldt (JIRA)
[ https://issues.jboss.org/browse/JBIDE-21105?page=com.atlassian.jira.plugi... ]
Nick Boldt commented on JBIDE-21105:
------------------------------------
"So, currently Birt is not included in eclipse-javaee neon package" Birt has never been included in the JavaEE package.
https://www.eclipse.org/downloads/packages/eclipse-ide-java-ee-developers... (dtp, but no birt)
https://www.eclipse.org/downloads/packages/eclipse-ide-java-ee-developers... (dtp, but no birt)
If you want a bundle which includes Birt, you need this one:
https://www.eclipse.org/downloads/packages/eclipse-ide-java-and-report-de...
However, even that EPP bundle does not include the Birt-WTP or Birt-charting stuff that we use in JBT.
This is also true of the Mars/Neon simrel update sites... they don't include the wtp/charting stuff. That's why we mirror Birt's update site separately [1] from Neon/Mars [2], [3] and include these features in our TP:
{code}./features/org.eclipse.birt.chart_4.5.0.v201510231925
./features/org.eclipse.birt.chart.integration.wtp_4.5.0.v201510231925
./features/org.eclipse.birt.integration.wtp_4.5.0.v201510231925
./features/org.eclipse.birt.report.designer.editor.xml.wtp_4.5.0.v201510231925{code}
[1] http://download.jboss.org/jbosstools/updates/requirements/birt/
[2] http://download.jboss.org/jbosstools/updates/requirements/neon/
[3] http://download.jboss.org/jbosstools/updates/requirements/mars/
"I would remove it from JBDS 10 (JBT 4.4) TP too"
Birt is only in JBT; it's never been added to JBDS.
That said, if you want me to
* remove the *org.eclipse.birt* stuff from the *JBT TP*, and
* remove the *org.jboss.tools.birt* stuff from *JBT*
... I can. We may end up adding it back in in a few months anyway, but for now we can remove it and stop building the jbosstools-birt project entirely.
Please confirm that's what you want me to do.
> Remove BIRT?
> ------------
>
> Key: JBIDE-21105
> URL: https://issues.jboss.org/browse/JBIDE-21105
> Project: Tools (JBoss Tools)
> Issue Type: Sub-task
> Components: birt, target-platform
> Affects Versions: 4.4.0.Alpha1
> Reporter: Nick Boldt
> Assignee: Nick Boldt
> Fix For: 4.4.0.Alpha1
>
> Attachments: birt-4.5-vs-mars-interim.txt, birt-4.5-vs-mars-interim_summary.txt, birt-depends-on-jetty-deploy-929.png, birt-depends-on-jetty-osgi-boot-929.png, birt-wizard-new-library.png, birt-wizard-new-library__NEON.png, birt-wizards.png, birt-wizards__NEON.png, eclipse-after-birt.png, install-jboss-birt-sites.png, install-jboss-birt-sites__NEON.png, install-jboss-birt.png, install-jboss-birt__NEON.png
>
>
> {quote}
> (2015-11-17 11:42:50) kmarmaliykov: nickboldt: I look into neon M3 and see that there is no jetty 9.2.9 there
> (2015-11-17 11:43:18) nickboldt: kmarmaliykov: yes, 9.2.9 is from Birt site
> (2015-11-17 11:43:21) nickboldt: because Birt needs it
> (2015-11-17 11:43:33) nickboldt: but there's no Birt for Neon yet so we have to include the Birt for Mars
> (2015-11-17 11:43:37) maxandersen: nickboldt: akazakov: are you talking about having birt in Neon ?
> (2015-11-17 11:43:44) maxandersen: afaik birt is dead.
> (2015-11-17 11:43:53) maxandersen: won't participate in neon release afaik.
> (2015-11-17 11:43:56) nickboldt: maxandersen: so we should remove birt from JBT 4.4?
> (2015-11-17 11:44:24) maxandersen: well, check first if birt is actually in neon. if it is not the decision is very easy.
> (2015-11-17 11:44:38) akazakov: +1
> (2015-11-17 11:45:36) maxandersen: if it is in, then lets talk options. but if birt requires us to jump through too many hoops its not worth keeping it in.
> (2015-11-17 11:45:55) nickboldt: birt 4.5.0.v201506092134 is in Neon from 201511131000 (M3) - http://download.eclipse.org/releases/neon/201511131000/
> (2015-11-17 11:47:08) nickboldt: and there's a newer birt 4.5.0.v201510231925 (same major.minor.service, newer datestamp) in http://download.eclipse.org/birt/update-site/mars-interim/
> {quote}
> So, yesterday as part of updates for JBIDE-20976, I pulled a new BIRT mirror here:
> http://download.jboss.org/jbosstools/updates/requirements/birt/4.5.0.v201...
> But we could also just use the old one from Mars.0:
> http://download.jboss.org/jbosstools/updates/requirements/birt/4.5.0.v201...
> Or we could remove support for BIRT and its webtools / charting integration entirely from JBT 4.4.0.Alpha1, since as Max says BIRT is at EOL.
> *DISCUSS*.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years, 4 months
[JBoss JIRA] (JBDS-3560) Arbitrary remote code execution with InvokerTransformer (COLLECTIONS-580)
by Nick Boldt (JIRA)
[ https://issues.jboss.org/browse/JBDS-3560?page=com.atlassian.jira.plugin.... ]
Nick Boldt commented on JBDS-3560:
----------------------------------
I have applied my PRs in 4.50.x, 4.51.x and 4.60.x branches.
I can throw a new one upstream at jpt.jpa later, and we can include the PLUGINS from that feature instead of the feature, which would avoid including the wrong version.
> Arbitrary remote code execution with InvokerTransformer (COLLECTIONS-580)
> -------------------------------------------------------------------------
>
> Key: JBDS-3560
> URL: https://issues.jboss.org/browse/JBDS-3560
> Project: Developer Studio (JBoss Developer Studio)
> Issue Type: Bug
> Components: upstream
> Affects Versions: 8.1.0.GA, 9.0.0.GA, 10.0.0.Alpha1
> Reporter: Nick Boldt
> Assignee: Max Rydahl Andersen
> Fix For: 9.1.0.Beta1, 10.0.0.Alpha1
>
> Attachments: apache-commons-collections-in-JBDS7,8,9,10.png, apache-commons-collections-in-JBDS7,8,9,10_refs1.png, apache-commons-collections-in-JBDS7,8,9,10_refs10.png, apache-commons-collections-in-JBDS7,8,9,10_refs7.png, apache-commons-collections-in-JBDS7,8,9,10_refs8-IS-fuse.png, apache-commons-collections-in-JBDS7,8,9,10_refs8.png, apache-commons-collections-in-JBDS7,8,9,10_refs9.png, orbit.R20150519210750_vs_I20151117200049.log.txt, orbit.R20150519210750_vs_I20151117200049.log_onlyLatest.txt
>
>
> This is a container issue to wrap & track https://issues.apache.org/jira/browse/COLLECTIONS-580
> Problem is that JBDS 9 (and probably 8 and 10 too) include org.apache.commons.collections 3.2.0.v2013030210310, which is affected by COLLECTIONS-580 - Arbitrary remote code execution with InvokerTransformer
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years, 4 months
[JBoss JIRA] (JBIDE-21105) Remove BIRT?
by Konstantin Marmalyukov (JIRA)
[ https://issues.jboss.org/browse/JBIDE-21105?page=com.atlassian.jira.plugi... ]
Konstantin Marmalyukov commented on JBIDE-21105:
------------------------------------------------
I take a look into bundles which [~nickboldt] points above. They requires tons of other jetty bundles. I don't check are all required bundles available in Eclipse javaEE package, my biggest interest was in declared version range. I was not surprised seeing
{quote}[9.2, 10){quote}
It means that it will be possible that birt may have problems with Neon M3. I haven't seen Birt before yesterday, but after quick look I found that they use smth like Help for their tutorials(web server is used for hosting webpages with tutorials). Smoke test passes fine, but I'm not sure that's the only place where they use Jetty.
There is quite a good chance that it will work cause they don't strict jetty bundles version and reuses bundles shipped by Eclipse. But anyway using different version of jetty bundles is incorrect.
This problem will not do any harm to our component, but I can try to contribute fix to them.
> Remove BIRT?
> ------------
>
> Key: JBIDE-21105
> URL: https://issues.jboss.org/browse/JBIDE-21105
> Project: Tools (JBoss Tools)
> Issue Type: Sub-task
> Components: birt, target-platform
> Affects Versions: 4.4.0.Alpha1
> Reporter: Nick Boldt
> Assignee: Nick Boldt
> Fix For: 4.4.0.Alpha1
>
> Attachments: birt-4.5-vs-mars-interim.txt, birt-4.5-vs-mars-interim_summary.txt, birt-depends-on-jetty-deploy-929.png, birt-depends-on-jetty-osgi-boot-929.png, birt-wizard-new-library.png, birt-wizard-new-library__NEON.png, birt-wizards.png, birt-wizards__NEON.png, eclipse-after-birt.png, install-jboss-birt-sites.png, install-jboss-birt-sites__NEON.png, install-jboss-birt.png, install-jboss-birt__NEON.png
>
>
> {quote}
> (2015-11-17 11:42:50) kmarmaliykov: nickboldt: I look into neon M3 and see that there is no jetty 9.2.9 there
> (2015-11-17 11:43:18) nickboldt: kmarmaliykov: yes, 9.2.9 is from Birt site
> (2015-11-17 11:43:21) nickboldt: because Birt needs it
> (2015-11-17 11:43:33) nickboldt: but there's no Birt for Neon yet so we have to include the Birt for Mars
> (2015-11-17 11:43:37) maxandersen: nickboldt: akazakov: are you talking about having birt in Neon ?
> (2015-11-17 11:43:44) maxandersen: afaik birt is dead.
> (2015-11-17 11:43:53) maxandersen: won't participate in neon release afaik.
> (2015-11-17 11:43:56) nickboldt: maxandersen: so we should remove birt from JBT 4.4?
> (2015-11-17 11:44:24) maxandersen: well, check first if birt is actually in neon. if it is not the decision is very easy.
> (2015-11-17 11:44:38) akazakov: +1
> (2015-11-17 11:45:36) maxandersen: if it is in, then lets talk options. but if birt requires us to jump through too many hoops its not worth keeping it in.
> (2015-11-17 11:45:55) nickboldt: birt 4.5.0.v201506092134 is in Neon from 201511131000 (M3) - http://download.eclipse.org/releases/neon/201511131000/
> (2015-11-17 11:47:08) nickboldt: and there's a newer birt 4.5.0.v201510231925 (same major.minor.service, newer datestamp) in http://download.eclipse.org/birt/update-site/mars-interim/
> {quote}
> So, yesterday as part of updates for JBIDE-20976, I pulled a new BIRT mirror here:
> http://download.jboss.org/jbosstools/updates/requirements/birt/4.5.0.v201...
> But we could also just use the old one from Mars.0:
> http://download.jboss.org/jbosstools/updates/requirements/birt/4.5.0.v201...
> Or we could remove support for BIRT and its webtools / charting integration entirely from JBT 4.4.0.Alpha1, since as Max says BIRT is at EOL.
> *DISCUSS*.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years, 4 months