[JBoss JIRA] Created: (JBPM-2774) parsing of pageflow causes to require internet connection

[JBoss JIRA] Created: (JBPM-2964)...

[JBoss JIRA] Created: (JBPM-2855)...

Marek Novotny (JIRA)

Thursday, 28 January 2010 Thu, 28 Jan '10

3:12 a.m.

parsing of pageflow causes to require internet connection --------------------------------------------------------- Key: JBPM-2774 URL: https://jira.jboss.org/jira/browse/JBPM-2774 Project: jBPM Issue Type: Bug Security Level: Public (Everyone can see) Affects Versions: jBPM 3.2.5.SP5, jBPM-3.2.5.SP4, jBPM 3.2.6.SP1, jBPM-3.2.5.SP3, jBPM-3.2.5.SP2, jBPM-3.2.5.SP1, jBPM 3.2.5 GA , jBPM 3.2.4 GA, jBPM 3.2.3, jBPM 3.2.2 Reporter: Marek Novotny JpdlParser has hard coded XSDs for local parsing instead of regular expression or wildcards in the file name of pageflow xsd. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

Show replies by date

Marek Novotny (JIRA)

Thursday, 28 January Thu, 28 Jan

3:24 a.m.

New subject: [JBoss JIRA] Commented: (JBPM-2774) parsing of pageflow causes to require internet connection

[ https://jira.jboss.org/jira/browse/JBPM-2774?page=com.atlassian.jira.plug... ] Marek Novotny commented on JBPM-2774: ------------------------------------- Now there is requirement to add also pageflow-2.1 and pageflow-2.2 local resources.

...

-- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

Marek Novotny (JIRA)

Tuesday, 13 April Tue, 13 Apr

5:45 a.m.

New subject: [JBoss JIRA] Commented: (JBPM-2774) parsing of pageflow causes to require internet connection

[ https://jira.jboss.org/jira/browse/JBPM-2774?page=com.atlassian.jira.plug... ] Marek Novotny commented on JBPM-2774: ------------------------------------- see solution at http://seamframework.org/Documentation/WhyDoesDeploymentFailWithASAXExcep...

...

parsing of pageflow causes to require internet connection --------------------------------------------------------- Key: JBPM-2774 URL: https://jira.jboss.org/jira/browse/JBPM-2774 Project: jBPM Issue Type: Bug Security Level: Public(Everyone can see) Affects Versions: jBPM 3.2.2, jBPM 3.2.3, jBPM 3.2.4 GA, jBPM 3.2.5 GA , jBPM-3.2.5.SP1, jBPM-3.2.5.SP2, jBPM-3.2.5.SP3, jBPM 3.2.6.SP1, jBPM-3.2.5.SP4, jBPM 3.2.5.SP5 Reporter: Marek Novotny Assignee: Alejandro Guizar JpdlParser has hard coded XSDs for local parsing instead of regular expression or wildcards in the file name of pageflow xsd.

Marek Novotny (JIRA)

5:45 a.m.

New subject: [JBoss JIRA] Assigned: (JBPM-2774) parsing of pageflow causes to require internet connection

[ https://jira.jboss.org/jira/browse/JBPM-2774?page=com.atlassian.jira.plug... ] Marek Novotny reassigned JBPM-2774: ----------------------------------- Assignee: Alejandro Guizar

...

parsing of pageflow causes to require internet connection --------------------------------------------------------- Key: JBPM-2774 URL: https://jira.jboss.org/jira/browse/JBPM-2774 Project: jBPM Issue Type: Bug Security Level: Public(Everyone can see) Affects Versions: jBPM 3.2.2, jBPM 3.2.3, jBPM 3.2.4 GA, jBPM 3.2.5 GA , jBPM-3.2.5.SP1, jBPM-3.2.5.SP2, jBPM-3.2.5.SP3, jBPM 3.2.6.SP1, jBPM-3.2.5.SP4, jBPM 3.2.5.SP5 Reporter: Marek Novotny Assignee: Alejandro Guizar JpdlParser has hard coded XSDs for local parsing instead of regular expression or wildcards in the file name of pageflow xsd.

Alejandro Guizar (JIRA)

Monday, 19 April Mon, 19 Apr

7:43 p.m.

New subject: [JBoss JIRA] Commented: (JBPM-2774) parsing of pageflow causes to require internet connection

[ https://jira.jboss.org/jira/browse/JBPM-2774?page=com.atlassian.jira.plug... ] Alejandro Guizar commented on JBPM-2774: ---------------------------------------- jBPM loads the pageflow-2.0 schema from resource org/jboss/seam/pageflow-2.0.xsd since version 3.2.4, other schema resources can be registered with JpdlParser.addSchemaResource() - see JBPM-1707. The change proposed in http://seamframework.org/Documentation/WhyDoesDeploymentFailWithASAXExcep... does not apply to jBPM 3.2.4 and above since we have abandoned the EntityResolver in favor of the JAXP schema source property. The motivation for this change was that jBPM does not use DTDs. The schema source property does not lend itself to resolve the pageflow schema resource for an arbitrary version as the entity resolver does. However, the Seam proposed code has a vulnerability: it can be used to access arbitrary resources in the classpath by crafting the systemId. if (systemId.startsWith(SEAM_NAMESPACE)) { log.debug("recognized Seam namespace; attempting to resolve on classpath under org/jboss/seam/"); String path = "org/jboss/seam/" + systemId.substring(SEAM_NAMESPACE.length()); try { inputSource = new InputSource(org.jboss.seam.Seam.class.getResourceAsStream(path)); } catch (Exception e) { log.debug(e.toString()); } } There are several options here. (a) Have JpdlParser try to load any schema resources named org/jboss/seam/pageflow-2.n.xsd, n >= 0 from the classpath. (b) Have Seam register pageflow schemas more recent than 2.0 by calling org/jboss/seam/pageflow-2.0.xsd. (c) Introduce a configuration property jbpm.schema.resources and load only the resources specified there from the classpath.

...

parsing of pageflow causes to require internet connection --------------------------------------------------------- Key: JBPM-2774 URL: https://jira.jboss.org/jira/browse/JBPM-2774 Project: jBPM Issue Type: Bug Security Level: Public(Everyone can see) Affects Versions: jBPM 3.2.2, jBPM 3.2.3, jBPM 3.2.4 GA, jBPM 3.2.5 GA , jBPM-3.2.5.SP1, jBPM-3.2.5.SP2, jBPM-3.2.5.SP3, jBPM 3.2.6.SP1, jBPM-3.2.5.SP4, jBPM 3.2.5.SP5 Reporter: Marek Novotny Assignee: Alejandro Guizar JpdlParser has hard coded XSDs for local parsing instead of regular expression or wildcards in the file name of pageflow xsd.

Alejandro Guizar (JIRA)

7:47 p.m.

New subject: [JBoss JIRA] Issue Comment Edited: (JBPM-2774) parsing of pageflow causes to require internet connection

[ https://jira.jboss.org/jira/browse/JBPM-2774?page=com.atlassian.jira.plug... ] Alejandro Guizar edited comment on JBPM-2774 at 4/19/10 8:45 PM: ----------------------------------------------------------------- jBPM loads the pageflow-2.0 schema from resource org/jboss/seam/pageflow-2.0.xsd since version 3.2.4, other schema resources can be registered with JpdlParser.addSchemaResource() - see JBPM-1707. The change proposed in http://seamframework.org/Documentation/WhyDoesDeploymentFailWithASAXExcep... does not apply to jBPM 3.2.4 and above since we have abandoned the EntityResolver in favor of the JAXP schema source property. The motivation for this change was that jBPM does not use DTDs. The schema source property does not lend itself to resolve the pageflow schema resource for an arbitrary version as the entity resolver does. However, the Seam proposed code has a vulnerability: it can be used to access arbitrary resources in the classpath by crafting the systemId. if (systemId.startsWith(SEAM_NAMESPACE)) { String path = "org/jboss/seam/" + systemId.substring(SEAM_NAMESPACE.length()); inputSource = new InputSource(org.jboss.seam.Seam.class.getResourceAsStream(path)); } There are several options here. (a) Have JpdlParser try to load any schema resources named org/jboss/seam/pageflow-2.n.xsd, n >= 0 from the classpath. (b) Have Seam register pageflow schemas more recent than 2.0 by calling org/jboss/seam/pageflow-2.0.xsd. (c) Introduce a configuration property jbpm.schema.resources and load only the resources specified there from the classpath. was (Author: alex.guizar(a)jboss.com): jBPM loads the pageflow-2.0 schema from resource org/jboss/seam/pageflow-2.0.xsd since version 3.2.4, other schema resources can be registered with JpdlParser.addSchemaResource() - see JBPM-1707. The change proposed in http://seamframework.org/Documentation/WhyDoesDeploymentFailWithASAXExcep... does not apply to jBPM 3.2.4 and above since we have abandoned the EntityResolver in favor of the JAXP schema source property. The motivation for this change was that jBPM does not use DTDs. The schema source property does not lend itself to resolve the pageflow schema resource for an arbitrary version as the entity resolver does. However, the Seam proposed code has a vulnerability: it can be used to access arbitrary resources in the classpath by crafting the systemId. if (systemId.startsWith(SEAM_NAMESPACE)) { log.debug("recognized Seam namespace; attempting to resolve on classpath under org/jboss/seam/"); String path = "org/jboss/seam/" + systemId.substring(SEAM_NAMESPACE.length()); try { inputSource = new InputSource(org.jboss.seam.Seam.class.getResourceAsStream(path)); } catch (Exception e) { log.debug(e.toString()); } } There are several options here. (a) Have JpdlParser try to load any schema resources named org/jboss/seam/pageflow-2.n.xsd, n >= 0 from the classpath. (b) Have Seam register pageflow schemas more recent than 2.0 by calling org/jboss/seam/pageflow-2.0.xsd. (c) Introduce a configuration property jbpm.schema.resources and load only the resources specified there from the classpath.

...

parsing of pageflow causes to require internet connection --------------------------------------------------------- Key: JBPM-2774 URL: https://jira.jboss.org/jira/browse/JBPM-2774 Project: jBPM Issue Type: Bug Security Level: Public(Everyone can see) Affects Versions: jBPM 3.2.2, jBPM 3.2.3, jBPM 3.2.4 GA, jBPM 3.2.5 GA , jBPM-3.2.5.SP1, jBPM-3.2.5.SP2, jBPM-3.2.5.SP3, jBPM 3.2.6.SP1, jBPM-3.2.5.SP4, jBPM 3.2.5.SP5 Reporter: Marek Novotny Assignee: Alejandro Guizar JpdlParser has hard coded XSDs for local parsing instead of regular expression or wildcards in the file name of pageflow xsd.

Marek Novotny (JIRA)

Monday, 3 May Mon, 3 May

5:25 a.m.

New subject: [JBoss JIRA] Commented: (JBPM-2774) parsing of pageflow causes to require internet connection

[ https://jira.jboss.org/jira/browse/JBPM-2774?page=com.atlassian.jira.plug... ] Marek Novotny commented on JBPM-2774: ------------------------------------- I will vote for (a) option.

...

parsing of pageflow causes to require internet connection --------------------------------------------------------- Key: JBPM-2774 URL: https://jira.jboss.org/jira/browse/JBPM-2774 Project: jBPM Issue Type: Bug Security Level: Public(Everyone can see) Affects Versions: jBPM 3.2.2, jBPM 3.2.3, jBPM 3.2.4 GA, jBPM 3.2.5 GA , jBPM-3.2.5.SP1, jBPM-3.2.5.SP2, jBPM-3.2.5.SP3, jBPM 3.2.6.SP1, jBPM-3.2.5.SP4, jBPM 3.2.5.SP5 Reporter: Marek Novotny Assignee: Alejandro Guizar JpdlParser has hard coded XSDs for local parsing instead of regular expression or wildcards in the file name of pageflow xsd.

Alejandro Guizar (JIRA)

Tuesday, 26 October Tue, 26 Oct

1:28 p.m.

New subject: [JBoss JIRA] Updated: (JBPM-2774) parsing of pageflow causes to require internet connection

[ https://jira.jboss.org/browse/JBPM-2774?page=com.atlassian.jira.plugin.sy... ] Alejandro Guizar updated JBPM-2774: ----------------------------------- Original Estimate: 0 minutes Remaining Estimate: 0 minutes Fix Version/s: jBPM 3.2.x Affects Version/s: (was: jBPM 3.2.5.SP5) Component/s: Runtime Engine

...

parsing of pageflow causes to require internet connection --------------------------------------------------------- Key: JBPM-2774 URL: https://jira.jboss.org/browse/JBPM-2774 Project: jBPM Issue Type: Bug Security Level: Public(Everyone can see) Components: Runtime Engine Affects Versions: jBPM 3.2.2, jBPM 3.2.3, jBPM 3.2.4 GA, jBPM 3.2.5 GA , jBPM-3.2.5.SP1, jBPM-3.2.5.SP2, jBPM-3.2.5.SP3, jBPM 3.2.6.SP1, jBPM-3.2.5.SP4 Reporter: Marek Novotny Assignee: Alejandro Guizar Fix For: jBPM 3.2.x Original Estimate: 0 minutes Remaining Estimate: 0 minutes JpdlParser has hard coded XSDs for local parsing instead of regular expression or wildcards in the file name of pageflow xsd.

-- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

Alejandro Guizar (JIRA)

1:32 p.m.

New subject: [JBoss JIRA] Issue Comment Edited: (JBPM-2774) parsing of pageflow causes to require internet connection

[ https://jira.jboss.org/browse/JBPM-2774?page=com.atlassian.jira.plugin.sy... ] Alejandro Guizar edited comment on JBPM-2774 at 10/26/10 2:32 PM: ------------------------------------------------------------------ jBPM loads the pageflow-2.0 schema from resource org/jboss/seam/pageflow-2.0.xsd since version 3.2.4, other schema resources can be registered with JpdlParser.addSchemaResource() - see JBPM-1707. The change proposed in http://seamframework.org/Documentation/WhyDoesDeploymentFailWithASAXExcep... does not apply to jBPM 3.2.4 and above since we have abandoned the EntityResolver in favor of the JAXP schema source property. The motivation for this change was that jBPM does not use DTDs. The schema source property does not lend itself to resolve the pageflow schema resource for an arbitrary version as the entity resolver does. However, the Seam proposed code has a vulnerability: it can be used to access arbitrary resources in the classpath by crafting the systemId. if (systemId.startsWith(SEAM_NAMESPACE)) { String path = "org/jboss/seam/" + systemId.substring(SEAM_NAMESPACE.length()); inputSource = new InputSource(org.jboss.seam.Seam.class.getResourceAsStream(path)); } There are several options here. a) Have JpdlParser try to load any schema resources named org/jboss/seam/pageflow-2.n.xsd, n >= 0 from the classpath b) Have Seam register pageflow schemas more recent than 2.0 by calling JpdlParser.addSchemaResource() c) Introduce a configuration property jbpm.schema.resources and load only the resources specified there from the classpath was (Author: alex.guizar(a)jboss.com): jBPM loads the pageflow-2.0 schema from resource org/jboss/seam/pageflow-2.0.xsd since version 3.2.4, other schema resources can be registered with JpdlParser.addSchemaResource() - see JBPM-1707. The change proposed in http://seamframework.org/Documentation/WhyDoesDeploymentFailWithASAXExcep... does not apply to jBPM 3.2.4 and above since we have abandoned the EntityResolver in favor of the JAXP schema source property. The motivation for this change was that jBPM does not use DTDs. The schema source property does not lend itself to resolve the pageflow schema resource for an arbitrary version as the entity resolver does. However, the Seam proposed code has a vulnerability: it can be used to access arbitrary resources in the classpath by crafting the systemId. if (systemId.startsWith(SEAM_NAMESPACE)) { String path = "org/jboss/seam/" + systemId.substring(SEAM_NAMESPACE.length()); inputSource = new InputSource(org.jboss.seam.Seam.class.getResourceAsStream(path)); } There are several options here. (a) Have JpdlParser try to load any schema resources named org/jboss/seam/pageflow-2.n.xsd, n >= 0 from the classpath. (b) Have Seam register pageflow schemas more recent than 2.0 by calling org/jboss/seam/pageflow-2.0.xsd. (c) Introduce a configuration property jbpm.schema.resources and load only the resources specified there from the classpath.

...

Alejandro Guizar (JIRA)

1:38 p.m.

New subject: [JBoss JIRA] Updated: (JBPM-2774) parsing of pageflow causes to require internet connection

[ https://jira.jboss.org/browse/JBPM-2774?page=com.atlassian.jira.plugin.sy... ] Alejandro Guizar updated JBPM-2774: ----------------------------------- Original Estimate: (was: 0 minutes) Remaining Estimate: (was: 0 minutes)

...

parsing of pageflow causes to require internet connection --------------------------------------------------------- Key: JBPM-2774 URL: https://jira.jboss.org/browse/JBPM-2774 Project: jBPM Issue Type: Bug Security Level: Public(Everyone can see) Components: Runtime Engine Affects Versions: jBPM 3.2.2, jBPM 3.2.3, jBPM 3.2.4 GA, jBPM 3.2.5 GA , jBPM-3.2.5.SP1, jBPM-3.2.5.SP2, jBPM-3.2.5.SP3, jBPM 3.2.6.SP1, jBPM-3.2.5.SP4 Reporter: Marek Novotny Assignee: Alejandro Guizar Fix For: jBPM 3.2.x JpdlParser has hard coded XSDs for local parsing instead of regular expression or wildcards in the file name of pageflow xsd.

Alejandro Guizar (JIRA)

1:46 p.m.

New subject: [JBoss JIRA] Updated: (JBPM-2774) parsing of pageflow causes to require internet connection

[ https://jira.jboss.org/browse/JBPM-2774?page=com.atlassian.jira.plugin.sy... ] Alejandro Guizar updated JBPM-2774: ----------------------------------- Fix Version/s: jBPM 3.2.10 (was: jBPM 3.2.x) Affects Version/s: jBPM 3.2.5.SP5 (was: jBPM 3.2.2) (was: jBPM 3.2.3) (was: jBPM 3.2.4 GA) (was: jBPM 3.2.5 GA ) (was: jBPM-3.2.5.SP1) (was: jBPM-3.2.5.SP2) (was: jBPM-3.2.5.SP3) (was: jBPM 3.2.6.SP1) (was: jBPM-3.2.5.SP4)

...

parsing of pageflow causes to require internet connection --------------------------------------------------------- Key: JBPM-2774 URL: https://jira.jboss.org/browse/JBPM-2774 Project: jBPM Issue Type: Bug Security Level: Public(Everyone can see) Components: Runtime Engine Affects Versions: jBPM 3.2.5.SP5 Reporter: Marek Novotny Assignee: Alejandro Guizar Fix For: jBPM 3.2.10 JpdlParser has hard coded XSDs for local parsing instead of regular expression or wildcards in the file name of pageflow xsd.

Alejandro Guizar (JIRA)

Wednesday, 27 October Wed, 27 Oct

2:32 a.m.

New subject: [JBoss JIRA] Updated: (JBPM-2774) parsing of pageflow causes to require internet connection

...

parsing of pageflow causes to require internet connection --------------------------------------------------------- Key: JBPM-2774 URL: https://jira.jboss.org/browse/JBPM-2774 Project: jBPM Issue Type: Bug Security Level: Public(Everyone can see) Components: Runtime Engine Affects Versions: jBPM 3.2.5.SP5 Reporter: Marek Novotny Assignee: Alejandro Guizar Fix For: jBPM 3.2.10 Original Estimate: 0 minutes Remaining Estimate: 0 minutes JpdlParser has hard coded XSDs for local parsing instead of regular expression or wildcards in the file name of pageflow xsd.

Alejandro Guizar (JIRA)

2:32 a.m.

New subject: [JBoss JIRA] Commented: (JBPM-2774) parsing of pageflow causes to require internet connection

[ https://jira.jboss.org/browse/JBPM-2774?page=com.atlassian.jira.plugin.sy... ] Alejandro Guizar commented on JBPM-2774: ---------------------------------------- Implemented option (c) to give integrators full control over the location of the schema resources in the classpath, thus realizing Pete Muir's suggestion of "externaliz[ing resources] so that it is up to the integrating product to define". Automatic loading as described in option (a), while convenient, might pose a threat as it can be exploited to have the engine load resources of arbitrary content and size. It should be noted the default jBPM configuration references only the Pageflow 2.2 schema because, in JAXP 1.2, "it is illegal to have two schemas that share the same namespace" (cf. section 3.5).

...

parsing of pageflow causes to require internet connection --------------------------------------------------------- Key: JBPM-2774 URL: https://jira.jboss.org/browse/JBPM-2774 Project: jBPM Issue Type: Bug Security Level: Public(Everyone can see) Components: Runtime Engine Affects Versions: jBPM 3.2.5.SP5 Reporter: Marek Novotny Assignee: Alejandro Guizar Fix For: jBPM 3.2.10 Original Estimate: 0 minutes Remaining Estimate: 0 minutes JpdlParser has hard coded XSDs for local parsing instead of regular expression or wildcards in the file name of pageflow xsd.

Alejandro Guizar (JIRA)

2:34 a.m.

New subject: [JBoss JIRA] Resolved: (JBPM-2774) parsing of pageflow causes to require internet connection

[ https://jira.jboss.org/browse/JBPM-2774?page=com.atlassian.jira.plugin.sy... ] Alejandro Guizar resolved JBPM-2774. ------------------------------------ Resolution: Done

...

parsing of pageflow causes to require internet connection --------------------------------------------------------- Key: JBPM-2774 URL: https://jira.jboss.org/browse/JBPM-2774 Project: jBPM Issue Type: Bug Security Level: Public(Everyone can see) Components: Runtime Engine Affects Versions: jBPM 3.2.5.SP5 Reporter: Marek Novotny Assignee: Alejandro Guizar Fix For: jBPM 3.2.10 Original Estimate: 0 minutes Remaining Estimate: 0 minutes JpdlParser has hard coded XSDs for local parsing instead of regular expression or wildcards in the file name of pageflow xsd.

5085

days inactive

5357

days old

jbpm-issues@lists.jboss.org

Manage subscription

13 comments

2 participants

tags (0)

participants (2)

Alejandro Guizar (JIRA)
Marek Novotny (JIRA)

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

[JBoss JIRA] Created: (JBPM-2774) parsing of pageflow causes to require internet connection