January 2009 - jbpm-issues - Jboss List Archives

[JBoss JIRA] Created: (JBPM-1958) Security issue allows arbitrary java code to be deployed and executed

by Thomas Diesler (JIRA)

Security issue allows arbitrary java code to be deployed and executed --------------------------------------------------------------------- Key: JBPM-1958 URL: https://jira.jboss.org/jira/browse/JBPM-1958 Project: JBoss jBPM Issue Type: Bug Security Level: Public (Everyone can see) Components: Console Reporter: Thomas Diesler Assignee: Koen Aers Priority: Critical Fix For: jBPM 3.3.2 GA -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 3 months

3
14
0 / 0

[JBoss JIRA] Created: (JBPM-1178) Script conditions in transitions are evaluated as expressions by the decision node

by Romain Lamarche (JIRA)

Script conditions in transitions are evaluated as expressions by the decision node ---------------------------------------------------------------------------------- Key: JBPM-1178 URL: http://jira.jboss.com/jira/browse/JBPM-1178 Project: JBoss jBPM Issue Type: Bug Components: Core Engine Affects Versions: jBPM jPDL 3.2.2 Environment: Windows XP, JBoss AS 4.2.2GA, MS SQL EXPRESS 2005, Jdk5 Reporter: Romain Lamarche Assigned To: Tom Baeyens The decision node does not evaluate scripts in conditional transitions. Indeed, the execute method of node type decision does not check what type of condition it is. Listing of the wrong code : (file Decision.java lines 120-135 in Jbpm Jpdl 3.2.2) } else { // new mode based on conditions in the transition itself Iterator iter = leavingTransitions.iterator(); while (iter.hasNext() && (transition==null)) { Transition candidate = (Transition) iter.next(); String conditionExpression = candidate.getCondition(); if (conditionExpression!=null) { Object result = JbpmExpressionEvaluator.evaluate(conditionExpression, executionContext); if (Boolean.TRUE.equals(result)) { transition = candidate; } } } } The problem is the "JbpmExpressionEvaluator". -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 3 months

5
7
0 / 0

[JBoss JIRA] Created: (JBPM-1883) Provide an initial implementation of a AS4 deployer

by Thomas Diesler (JIRA)

Provide an initial implementation of a AS4 deployer --------------------------------------------------- Key: JBPM-1883 URL: https://jira.jboss.org/jira/browse/JBPM-1883 Project: JBoss jBPM Issue Type: Task Security Level: Public (Everyone can see) Components: Productization Reporter: Thomas Diesler Assignee: Thomas Diesler Fix For: jBPM 3.3.1 GA -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 4 months

2
4
0 / 0

[JBoss JIRA] Created: (JBPM-1987) create optimistic locking test

by Tom Baeyens (JIRA)

create optimistic locking test ------------------------------ Key: JBPM-1987 URL: https://jira.jboss.org/jira/browse/JBPM-1987 Project: JBoss jBPM Issue Type: Task Security Level: Public (Everyone can see) Reporter: Tom Baeyens Assignee: Tom Baeyens Fix For: jBPM 4.0.0.Beta1 create a test that produces an optimistic locking failure. this will 1) verify that the db isolation works correctly 2) allow us to see how this gets logged. (in jbpm 3, a lot of people complained because there were still SOSEs in the logs) -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 4 months

2
9
0 / 0

[JBoss JIRA] Created: (JBPM-1914) Problem in retrieving variables of Serializable objects

by Mauro Molinari (JIRA)

Problem in retrieving variables of Serializable objects ------------------------------------------------------- Key: JBPM-1914 URL: https://jira.jboss.org/jira/browse/JBPM-1914 Project: JBoss jBPM Issue Type: Bug Security Level: Public (Everyone can see) Components: Core Engine Affects Versions: jBPM 3.3.0 GA Reporter: Mauro Molinari Priority: Critical I have encountered a serious problem working with variables whose value is a serializable object. The problem is that sometimes (not always!) an error like the following is given when retrieving a variable: java.lang.ClassCastException: org.jbpm.bytes.ByteArray$$EnhancerByCGLIB$$cc67d06e The code is like: MySerializableClass obj = (MySerializableClass) contextInstance.getVariable("myVariable"); (of course, "myVariable" is a variable that I previously have set with a MySerializableClass object) Apart from the CGLIB awful problem with proxies, even if I extract the value from the proxy with the following: public static Object getCGLIBProxiedObject(final Object proxy) { if(proxy instanceof HibernateProxy) { final LazyInitializer initializer = ((HibernateProxy) proxy).getHibernateLazyInitializer(); return initializer.getImplementation(); } return proxy; } the problem is that the variable value is retrieved as a org.jbpm.bytes.ByteArray instead of a MyClass instance! I did some debugging and discovered that: - in org.jbpm.context.exe.VariableContainer.getVariable(String), when org.jbpm.context.exe.VariableContainer.hasVariableLocally(String) is called, Hibernate lazily retrieves a org.jbpm.context.exe.variableinstance.ByteArrayInstance instance from the database and creates it using its empty constructor - unfortunately, when a org.jbpm.context.exe.VariableInstance (extended by ByteArrayInstance) is constructed using its constructor, its converter instance variable remains null - the VariableInstance converter instance variable is set to something only when a VariableInstance is created using org.jbpm.context.exe.JbpmType.newVariableInstance(), but this is not the case when a VariableInstance is lazily loaded by Hibernate; in fact, in my case, org.jbpm.context.exe.JbpmType.newVariableInstance() is never called and the converter field of my ByteArrayInstance instance is always null! - this causes org.jbpm.context.exe.VariableInstance.getValue() to return the value given by org.jbpm.context.exe.variableinstance.ByteArrayInstance.getObject() without applying the necessary conversion (deserialization) Please note that my variable values are stored in jBPM database in JBPM_VARIABLEINSTANCE table with the CONVERTER column correctly populated with "R". I think this is a critical problem. By now, the only workaround I have found is to always apply the following utility method when retrieving variable values, before returning them to the client code: public static Object extractVariableValue(final Object rawValue) { Object result = CardinisJbpmUtilities.getCGLIBProxiedObject(rawValue); if(result instanceof ByteArray) try { result = new ObjectInputStream(new ByteArrayInputStream(((ByteArray) result) .getBytes())).readObject(); } catch(final Exception e) { throw new RuntimeException(e); } return result; } -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 4 months

5
21
0 / 0

[JBoss JIRA] Created: (JBPM-1797) Add authorization to the console

by Heiko Braun (JIRA)

Add authorization to the console -------------------------------- Key: JBPM-1797 URL: https://jira.jboss.org/jira/browse/JBPM-1797 Project: JBoss jBPM Issue Type: Task Security Level: Public (Everyone can see) Components: Console Reporter: Heiko Braun Assignee: Heiko Braun Fix For: GWT Console 1.0.0 CR1 Role based access to specific parts of the console -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 6 months

2
3
0 / 0

[JBoss JIRA] Created: (JBPM-1772) Fix JoinDbTest on postgresql

by Thomas Diesler (JIRA)

Fix JoinDbTest on postgresql ---------------------------- Key: JBPM-1772 URL: https://jira.jboss.org/jira/browse/JBPM-1772 Project: JBoss jBPM Issue Type: Task Security Level: Public (Everyone can see) Reporter: Thomas Diesler Fix For: jBPM 3.3.1 GA expected:<[10X, 10Y, 10Z, 10a, 10b, 10c, 10d, 10e, 11X, 11Y, 11Z, 11a, 11b, 11c, 11d, 11e, 12X, 12Y, 12Z, 12a, 12b, 12c, 12d, 12e, 13X, 13Y, 13Z, 13a, 13b, 13c, 13d, 13e, 14X, 14Y, 14Z, 14a, 14b, 14c, 14d, 14e, 15X, 15Y, 15Z, 15a, 15b, 15c, 15d, 15e, 16X, 16Y, 16Z, 16a, 16b, 16c, 16d, 16e, 17X, 17Y, 17Z, 17a, 17b, 17c, 17d, 17e, 18X, 18Y, 18Z, 18a, 18b, 18c, 18d, 18e, 19X, 19Y, 19Z, 19a, 19b, 19c, 19d, 19e, 1X, 1Y, 1Z, 1a, 1b, 1c, 1d, 1e, 20X, 20Y, 20Z, 20a, 20b, 20c, 20d, 20e, 2X, 2Y, 2Z, 2a, 2b, 2c, 2d, 2e, 3X, 3Y, 3Z, 3a, 3b, 3c, 3d, 3e, 4X, 4Y, 4Z, 4a, 4b, 4c, 4d, 4e, 5X, 5Y, 5Z, 5a, 5b, 5c, 5d, 5e, 6X, 6Y, 6Z, 6a, 6b, 6c, 6d, 6e, 7X, 7Y, 7Z, 7a, 7b, 7c, 7d, 7e, 8X, 8Y, 8Z, 8a, 8b, 8c, 8d, 8e, 9X, 9Y, 9Z, 9a, 9b, 9c, 9d, 9e]> but was:<[100X, 100Y, 100Z, 100a, 100b, 100c, 100d, 100e, 108X, 108Y, 108Z, 108a, 108b, 108c, 108d, 108e, 116X, 116Y, 116Z, 116a, 116b, 116c, 116d, 116e, 124X, 124Y, 124Z, 124a, 124b, 124c, 124d, 124e, 132X, 132Y, 132Z, 132a, 132b, 132c, 132d, 132e, 140X, 140Y, 140Z, 140a, 140b, 140c, 140d, 140e, 148X, 148Y, 148Z, 148a, 148b, 148c, 148d, 148e, 156X, 156Y, 156Z, 156a, 156b, 156c, 156d, 156e, 164X, 164Y, 164Z, 164a, 164b, 164c, 164d, 164e, 172X, 172Y, 172Z, 172a, 172b, 172c, 172d, 172e, 180X, 180Y, 180Z, 180a, 180b, 180c, 180d, 180e, 188X, 188Y, 188Z, 188a, 188b, 188c, 188d, 188e, 36X, 36Y, 36Z, 36a, 36b, 36c, 36d, 36e, 44X, 44Y, 44Z, 44a, 44b, 44c, 44d, 44e, 52X, 52Y, 52Z, 52a, 52b, 52c, 52d, 52e, 60X, 60Y, 60Z, 60a, 60b, 60c, 60d, 60e, 68X, 68Y, 68Z, 68a, 68b, 68c, 68d, 68e, 76X, 76Y, 76Z, 76a, 76b, 76c, 76d, 76e, 84X, 84Y, 84Z, 84a, 84b, 84c, 84d, 84e, 92X, 92Y, 92Z, 92a, 92b, 92c, 92d, 92e]> -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 6 months

4
13
0 / 0

[JBoss JIRA] Created: (JBPM-1460) remove ObjectReference ?

by Tom Baeyens (JIRA)

remove ObjectReference ? ------------------------ Key: JBPM-1460 URL: https://jira.jboss.org/jira/browse/JBPM-1460 Project: JBoss jBPM Issue Type: Task Security Level: Public (Everyone can see) Components: PVM Reporter: Tom Baeyens Priority: Critical i think that ObjectReference can be replaced by Descriptor. ObjectReference.expression can be replaced by an (to-be-created) ExpressionDescriptor ObjectReference.object can be replaced by a ProvidedObjectDescriptor WDYT ? -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 7 months

2
9
0 / 0

[JBoss JIRA] Created: (JBPM-1756) NullPointerException using bcc recipients in org.jbpm.mail.Mail

by Christiane Hausleiter (JIRA)

NullPointerException using bcc recipients in org.jbpm.mail.Mail ---------------------------------------------------------------- Key: JBPM-1756 URL: https://jira.jboss.org/jira/browse/JBPM-1756 Project: JBoss jBPM Issue Type: Bug Security Level: Public (Everyone can see) Components: jPDL 3 Affects Versions: jBPM 3.2.1 Reporter: Christiane Hausleiter The "getBccRecipients" method uses the "to" field instead of "bcc", leading to a NPE if one works with actors and bcc recipients. public List getBccRecipients() { List recipients = new ArrayList(); ... if (bcc!=null) { String resolvedTo = evaluate(to); recipients.addAll(tokenize(resolvedTo)); } ... return recipients; } -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 7 months

2
3
0 / 0

[JBoss JIRA] Created: (JBPM-1966) clean up classloading

by Tom Baeyens (JIRA)

clean up classloading --------------------- Key: JBPM-1966 URL: https://jira.jboss.org/jira/browse/JBPM-1966 Project: JBoss jBPM Issue Type: Task Security Level: Public (Everyone can see) Reporter: Tom Baeyens Fix For: jBPM 4.0.0 Alpha2 in all of jbpm codebase, the context classloader should be taken. all classloader members to provide a classloader programmatically should be removed. if users want to configure the classloader, it should be done with a command service interceptor that sets the current thread context classloader. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 8 months

2
13
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

jbpm-issues January 2009