[JBoss JIRA] (JBDS-3560) Arbitrary remote code execution with InvokerTransformer (COLLECTIONS-580)
by Alexey Kazakov (JIRA)
[ https://issues.jboss.org/browse/JBDS-3560?page=com.atlassian.jira.plugin.... ]
Alexey Kazakov updated JBDS-3560:
---------------------------------
Fix Version/s: 9.1.0.CR1
(was: 9.1.0.Beta2)
> Arbitrary remote code execution with InvokerTransformer (COLLECTIONS-580)
> -------------------------------------------------------------------------
>
> Key: JBDS-3560
> URL: https://issues.jboss.org/browse/JBDS-3560
> Project: Developer Studio (JBoss Developer Studio)
> Issue Type: Bug
> Components: upstream
> Affects Versions: 8.1.0.GA, 9.0.0.GA, 10.0.0.Alpha1
> Reporter: Nick Boldt
> Assignee: Nick Boldt
> Fix For: 9.1.0.CR1, 10.0.0.Alpha1
>
> Attachments: apache-commons-collections-in-JBDS7,8,9,10.png, apache-commons-collections-in-JBDS7,8,9,10_refs1.png, apache-commons-collections-in-JBDS7,8,9,10_refs10.png, apache-commons-collections-in-JBDS7,8,9,10_refs7.png, apache-commons-collections-in-JBDS7,8,9,10_refs8-IS-fuse.png, apache-commons-collections-in-JBDS7,8,9,10_refs8.png, apache-commons-collections-in-JBDS7,8,9,10_refs9.png, orbit.R20150519210750_vs_I20151117200049.log.txt, orbit.R20150519210750_vs_I20151117200049.log_onlyLatest.txt
>
>
> This is a container issue to wrap & track https://issues.apache.org/jira/browse/COLLECTIONS-580
> Problem is that JBDS 9 (and probably 8 and 10 too) include org.apache.commons.collections 3.2.0.v2013030210310, which is affected by COLLECTIONS-580 - Arbitrary remote code execution with InvokerTransformer
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years, 5 months
[JBoss JIRA] (JBIDE-20536) Several quickstarts fail; jboss-ejb3-2_0.xsd cannot resolve jboss elements
by Rob Stryker (JIRA)
[ https://issues.jboss.org/browse/JBIDE-20536?page=com.atlassian.jira.plugi... ]
Rob Stryker updated JBIDE-20536:
--------------------------------
Fix Version/s: 4.4.0.Alpha1
(was: 4.3.1.Beta2)
> Several quickstarts fail; jboss-ejb3-2_0.xsd cannot resolve jboss elements
> ---------------------------------------------------------------------------
>
> Key: JBIDE-20536
> URL: https://issues.jboss.org/browse/JBIDE-20536
> Project: Tools (JBoss Tools)
> Issue Type: Sub-task
> Components: server, upstream
> Reporter: Rob Stryker
> Labels: xml_validation_quickstarts_eap7, xml_validation_quickstarts_wildfly, xml_validation_schema_error
> Fix For: 4.4.0.Alpha1
>
>
> Several errors fail with the following error message:
> Referenced file contains errors (file:/home/rob/code/fuseide/fuseide/targetplatform/target/org.fusesource.ide.targetplatform.target.repo/../../../../../jbtools/github/jbosstools-server/as/plugins/org.jboss.tools.as.catalog/schema/xsd/jboss-ejb3-2_0.xsd). For more information, right click on the message in the Problems View and select "Show Details..."
> The schema seems to fail to resolve any elements that have 'jboss' in them, for example:
> {code}
> <xs:element name="enterprise-beans" type="javaee:jboss-enterprise-beansType"/>
> {code}
> When looking at the entire xsd space, I see no attempt to reference or import any remote schema or any jboss schema url or namespace.
> The offending schema file is here:
> {code}<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
> targetNamespace="http://www.jboss.com/xml/ns/javaee"
> xmlns="http://www.jboss.com/xml/ns/javaee"
> xmlns:javaee="http://java.sun.com/xml/ns/javaee"
> elementFormDefault="qualified"
> attributeFormDefault="unqualified"
> version="2.0">
> <!-- xs:import namespace="http://java.sun.com/xml/ns/javaee" schemaLocation="ejb-jar_3_1.xsd"/ -->
> <!-- xs:import namespace="http://java.sun.com/xml/ns/javaee" schemaLocation="http://java.sun.com/xml/ns/javaee/ejb-jar_3_1.xsd"/ -->
> <xs:import namespace="http://java.sun.com/xml/ns/javaee"/>
> <xs:element name="ejb" type="javaee:jboss-ejb-beanType"/>
> <xs:element name="ejb-jar" type="javaee:jboss-ejb-jarType"/>
> <xs:element name="enterprise-beans" type="javaee:jboss-enterprise-beansType"/>
> <xs:element name="destination-jndi-name" type="xs:string" />
> <xs:element name="distinct-name" type="xs:string">
> <xs:annotation>
> <xs:documentation>
> The distinct-name for this EJB module.
> </xs:documentation>
> </xs:annotation>
> </xs:element>
> </xs:schema>
> {code}
> Perhaps I'm not understanding xml enough, but I kinda agree with the validator here, in that there's no clear way to resolve any of the jboss-* elements.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years, 5 months
[JBoss JIRA] (JBIDE-21340) Deploy from existing project git constraints are too stringent
by Fred Bricon (JIRA)
[ https://issues.jboss.org/browse/JBIDE-21340?page=com.atlassian.jira.plugi... ]
Fred Bricon edited comment on JBIDE-21340 at 1/20/16 3:35 PM:
--------------------------------------------------------------
Fixed in master / 4.3.x. Now only a warning shows up if no HTTP(S)-based git remote is defined.
Git-dirty projects are now allowed.
Enforcing the Git source property will be implemented later, via JBIDE-21490
was (Author: fbricon):
Fixed in master / 4.3.x. Now only a warning shows up if no HTTP(S)-based git remote is defined.
Git-dirty projects are now allowed
> Deploy from existing project git constraints are too stringent
> --------------------------------------------------------------
>
> Key: JBIDE-21340
> URL: https://issues.jboss.org/browse/JBIDE-21340
> Project: Tools (JBoss Tools)
> Issue Type: Bug
> Components: openshift
> Affects Versions: 4.3.1.Beta1
> Reporter: Fred Bricon
> Assignee: Andre Dietisheim
> Fix For: 4.3.1.Beta2
>
>
> There are currently 2 constraints when deploying ane existing project to OpenShift 3 that are really really annoying:
> - if the project is shared with git but dirty, you can't proceed with project deployment on openshift. This constraint is completely unnecessary and should be lifted
> - if the project was cloned using git/ssh protocol, it can't be deployed directly (http(s) is required). This should actually just be a warning, the user can modify the git url to use http(s) in the next page
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years, 5 months