April 2016 - mod_cluster-issues - Jboss List Archives

[JBoss JIRA] (MODCLUSTER-394) Investigate issues found by code inspections: Java part

by Radoslav Husar (JIRA)

[ https://issues.jboss.org/browse/MODCLUSTER-394?page=com.atlassian.jira.pl... ] Radoslav Husar updated MODCLUSTER-394: -------------------------------------- Summary: Investigate issues found by code inspections: Java part (was: Address issues found by code inspections: Java part) > Investigate issues found by code inspections: Java part > ------------------------------------------------------- > > Key: MODCLUSTER-394 > URL: https://issues.jboss.org/browse/MODCLUSTER-394 > Project: mod_cluster > Issue Type: Sub-task > Reporter: Radoslav Husar > Assignee: Radoslav Husar > -- This message was sent by Atlassian JIRA (v6.4.11#64026)

8 years

1
0
0 / 0

[JBoss JIRA] (MODCLUSTER-382) Investigate issues found by code inspections/compiler warnings

by Radoslav Husar (JIRA)

[ https://issues.jboss.org/browse/MODCLUSTER-382?page=com.atlassian.jira.pl... ] Radoslav Husar updated MODCLUSTER-382: -------------------------------------- Summary: Investigate issues found by code inspections/compiler warnings (was: Address issues found by code inspections) > Investigate issues found by code inspections/compiler warnings > -------------------------------------------------------------- > > Key: MODCLUSTER-382 > URL: https://issues.jboss.org/browse/MODCLUSTER-382 > Project: mod_cluster > Issue Type: Task > Reporter: Radoslav Husar > Assignee: Radoslav Husar > Priority: Optional > > There are about 70 javadoc issues, 20 redundant declarations, etc. Would be nice to address before final. -- This message was sent by Atlassian JIRA (v6.4.11#64026)

8 years

1
0
0 / 0

[JBoss JIRA] (MODCLUSTER-382) Address issues found by code inspections

by Radoslav Husar (JIRA)

[ https://issues.jboss.org/browse/MODCLUSTER-382?page=com.atlassian.jira.pl... ] Radoslav Husar updated MODCLUSTER-382: -------------------------------------- Fix Version/s: (was: 1.3.3.Final) > Address issues found by code inspections > ---------------------------------------- > > Key: MODCLUSTER-382 > URL: https://issues.jboss.org/browse/MODCLUSTER-382 > Project: mod_cluster > Issue Type: Task > Reporter: Radoslav Husar > Assignee: Radoslav Husar > Priority: Optional > > There are about 70 javadoc issues, 20 redundant declarations, etc. Would be nice to address before final. -- This message was sent by Atlassian JIRA (v6.4.11#64026)

8 years

1
0
0 / 0

[JBoss JIRA] (MODCLUSTER-492) mod_cluster should allow failover of GET requests by default

by Paul Ferraro (JIRA)

[ https://issues.jboss.org/browse/MODCLUSTER-492?page=com.atlassian.jira.pl... ] Paul Ferraro reassigned MODCLUSTER-492: --------------------------------------- Assignee: Radoslav Husar (was: Jean-Frederic Clere) > mod_cluster should allow failover of GET requests by default > ------------------------------------------------------------ > > Key: MODCLUSTER-492 > URL: https://issues.jboss.org/browse/MODCLUSTER-492 > Project: mod_cluster > Issue Type: Enhancement > Components: Core & Container Integration (Java), Native (httpd modules) > Affects Versions: 1.3.2.Final > Reporter: Paul Ferraro > Assignee: Radoslav Husar > > For any well developed web application, all GET requests should be idempotent and safe for failing over to another node. This should be default behavior, with an configuration option to disable it. -- This message was sent by Atlassian JIRA (v6.4.11#64026)

8 years

1
0
0 / 0

[JBoss JIRA] (MODCLUSTER-492) mod_cluster should allow failover of GET requests by default

by Paul Ferraro (JIRA)

Paul Ferraro created MODCLUSTER-492: --------------------------------------- Summary: mod_cluster should allow failover of GET requests by default Key: MODCLUSTER-492 URL: https://issues.jboss.org/browse/MODCLUSTER-492 Project: mod_cluster Issue Type: Enhancement Components: Core & Container Integration (Java), Native (httpd modules) Affects Versions: 1.3.2.Final Reporter: Paul Ferraro Assignee: Jean-Frederic Clere For any well developed web application, all GET requests should be idempotent and safe for failing over to another node. This should be default behavior, with an configuration option to disable it. -- This message was sent by Atlassian JIRA (v6.4.11#64026)

8 years

1
0
0 / 0

[JBoss JIRA] (MODCLUSTER-453) It is possible to inject JavaScript into mod_cluster manager console via MCMP messages

by RH Bugzilla Integration (JIRA)

[ https://issues.jboss.org/browse/MODCLUSTER-453?page=com.atlassian.jira.pl... ] RH Bugzilla Integration commented on MODCLUSTER-453: ---------------------------------------------------- baranowb <bbaranow(a)redhat.com> changed the Status of [bug 1326179|https://bugzilla.redhat.com/show_bug.cgi?id=1326179] from NEW to MODIFIED > It is possible to inject JavaScript into mod_cluster manager console via MCMP messages > -------------------------------------------------------------------------------------- > > Key: MODCLUSTER-453 > URL: https://issues.jboss.org/browse/MODCLUSTER-453 > Project: mod_cluster > Issue Type: Bug > Components: Native (httpd modules) > Affects Versions: 1.2.6.Final, 1.2.9.Final, 1.2.11.Final, 1.3.1.Beta2 > Reporter: Michal Karm Babacek > Assignee: Jean-Frederic Clere > Priority: Critical > Fix For: 1.3.2.Final, 1.2.12.Final > > Attachments: MODCLUSTER-453_master-better_one.patch, MODCLUSTER-453_master-mbabacek.patch, MODCLUSTER-453_master-offensive_approach.patch, patch.new.best.patch, patch.new.txt, patch.txt > > > This is a nasty one indeed :-) > h3. Steps to reproduce > * start Apache HTTP Server with mod_cluster > * send these messages (provided you test instance listens on 127.0.0.1) > {code} > { echo "CONFIG / HTTP/1.1"; echo "Host: localhost.localdomain:6666"; echo "Content-Length: 95"; echo "User-Agent: Prdel"; echo ""; echo "JVMRoute=fake-1&Ho5t=127.0.0.1&Maxattempts=1&Port=8009&StickySessionForce=No&Type=ajp&ping=10"; sleep 1;} | telnet 127.0.0.1 6666 > { echo "ENABLE-APP / HTTP/1.1"; echo "Host: localhost.localdomain:6666"; echo "Content-Length: 102"; echo "User-Agent: ClusterListener%2F1.0"; echo ""; echo 'JVMRoute%3Dfake-1%26Alias%3Ddefault-host%26Context%3D%2FX%3Cscript%3Ealert(%27X%27)%3B%3C%2Fscript%3E'; sleep 1;} | telnet 127.0.0.1 6666 > {code} > * Open http://localhost:6666/mod_cluster_manager and enjoy JavaScript pop-up Alert being executed. > h3. Impact > * Anyone with access to the (hopefully only internal) network from which MCMP messages are allowed to come from could send these messages and execute arbitrary JavaScript code. > h3. Suggestion > * Leverage {{apr_escape*}} to sanitize MCMP messages. > h3. Proposed patch > * [^patch.new.best.patch]: MCMP messages containing suspicious characters are discarded. -- This message was sent by Atlassian JIRA (v6.4.11#64026)

8 years

1
0
0 / 0

[JBoss JIRA] (MODCLUSTER-453) It is possible to inject JavaScript into mod_cluster manager console via MCMP messages

by RH Bugzilla Integration (JIRA)

[ https://issues.jboss.org/browse/MODCLUSTER-453?page=com.atlassian.jira.pl... ] RH Bugzilla Integration updated MODCLUSTER-453: ----------------------------------------------- Bugzilla References: https://bugzilla.redhat.com/show_bug.cgi?id=1197186, https://bugzilla.redhat.com/show_bug.cgi?id=1197187, https://bugzilla.redhat.com/show_bug.cgi?id=1326179 (was: https://bugzilla.redhat.com/show_bug.cgi?id=1197186, https://bugzilla.redhat.com/show_bug.cgi?id=1197187) > It is possible to inject JavaScript into mod_cluster manager console via MCMP messages > -------------------------------------------------------------------------------------- > > Key: MODCLUSTER-453 > URL: https://issues.jboss.org/browse/MODCLUSTER-453 > Project: mod_cluster > Issue Type: Bug > Components: Native (httpd modules) > Affects Versions: 1.2.6.Final, 1.2.9.Final, 1.2.11.Final, 1.3.1.Beta2 > Reporter: Michal Karm Babacek > Assignee: Jean-Frederic Clere > Priority: Critical > Fix For: 1.3.2.Final, 1.2.12.Final > > Attachments: MODCLUSTER-453_master-better_one.patch, MODCLUSTER-453_master-mbabacek.patch, MODCLUSTER-453_master-offensive_approach.patch, patch.new.best.patch, patch.new.txt, patch.txt > > > This is a nasty one indeed :-) > h3. Steps to reproduce > * start Apache HTTP Server with mod_cluster > * send these messages (provided you test instance listens on 127.0.0.1) > {code} > { echo "CONFIG / HTTP/1.1"; echo "Host: localhost.localdomain:6666"; echo "Content-Length: 95"; echo "User-Agent: Prdel"; echo ""; echo "JVMRoute=fake-1&Ho5t=127.0.0.1&Maxattempts=1&Port=8009&StickySessionForce=No&Type=ajp&ping=10"; sleep 1;} | telnet 127.0.0.1 6666 > { echo "ENABLE-APP / HTTP/1.1"; echo "Host: localhost.localdomain:6666"; echo "Content-Length: 102"; echo "User-Agent: ClusterListener%2F1.0"; echo ""; echo 'JVMRoute%3Dfake-1%26Alias%3Ddefault-host%26Context%3D%2FX%3Cscript%3Ealert(%27X%27)%3B%3C%2Fscript%3E'; sleep 1;} | telnet 127.0.0.1 6666 > {code} > * Open http://localhost:6666/mod_cluster_manager and enjoy JavaScript pop-up Alert being executed. > h3. Impact > * Anyone with access to the (hopefully only internal) network from which MCMP messages are allowed to come from could send these messages and execute arbitrary JavaScript code. > h3. Suggestion > * Leverage {{apr_escape*}} to sanitize MCMP messages. > h3. Proposed patch > * [^patch.new.best.patch]: MCMP messages containing suspicious characters are discarded. -- This message was sent by Atlassian JIRA (v6.4.11#64026)

8 years

1
0
0 / 0

[JBoss JIRA] (MODCLUSTER-478) Session draining always takes maximum configured timeout since listener is always notified before session is removed

by RH Bugzilla Integration (JIRA)

[ https://issues.jboss.org/browse/MODCLUSTER-478?page=com.atlassian.jira.pl... ] RH Bugzilla Integration commented on MODCLUSTER-478: ---------------------------------------------------- baranowb <bbaranow(a)redhat.com> changed the Status of [bug 1314792|https://bugzilla.redhat.com/show_bug.cgi?id=1314792] from NEW to MODIFIED > Session draining always takes maximum configured timeout since listener is always notified before session is removed > -------------------------------------------------------------------------------------------------------------------- > > Key: MODCLUSTER-478 > URL: https://issues.jboss.org/browse/MODCLUSTER-478 > Project: mod_cluster > Issue Type: Bug > Components: Core & Container Integration (Java) > Affects Versions: 1.2.11.Final, 1.3.1.Final > Environment: -JBoss EAP 6 > Reporter: Aaron Ogburn > Assignee: Radoslav Husar > Fix For: 1.2.12.Final, 1.3.3.Final > > > mod_cluster session draining does not properly end when an active session is invalidated. The NotifyOnDestroySessionListener is not invoked because it is not properly added. That listener is added as a ApplicationLifecycleListeners, but JBossWeb 7 invokes ApplicationSessionLifecycleListeners instead upon session expiration. -- This message was sent by Atlassian JIRA (v6.4.11#64026)

8 years

1
0
0 / 0

[JBoss JIRA] (MODCLUSTER-478) Session draining always takes maximum configured timeout since listener is always notified before session is removed

by RH Bugzilla Integration (JIRA)

[ https://issues.jboss.org/browse/MODCLUSTER-478?page=com.atlassian.jira.pl... ] RH Bugzilla Integration commented on MODCLUSTER-478: ---------------------------------------------------- baranowb <bbaranow(a)redhat.com> changed the Status of [bug 1314792|https://bugzilla.redhat.com/show_bug.cgi?id=1314792] from POST to NEW > Session draining always takes maximum configured timeout since listener is always notified before session is removed > -------------------------------------------------------------------------------------------------------------------- > > Key: MODCLUSTER-478 > URL: https://issues.jboss.org/browse/MODCLUSTER-478 > Project: mod_cluster > Issue Type: Bug > Components: Core & Container Integration (Java) > Affects Versions: 1.2.11.Final, 1.3.1.Final > Environment: -JBoss EAP 6 > Reporter: Aaron Ogburn > Assignee: Radoslav Husar > Fix For: 1.2.12.Final, 1.3.3.Final > > > mod_cluster session draining does not properly end when an active session is invalidated. The NotifyOnDestroySessionListener is not invoked because it is not properly added. That listener is added as a ApplicationLifecycleListeners, but JBossWeb 7 invokes ApplicationSessionLifecycleListeners instead upon session expiration. -- This message was sent by Atlassian JIRA (v6.4.11#64026)

8 years

1
0
0 / 0

[JBoss JIRA] (MODCLUSTER-478) Session draining always takes maximum configured timeout since listener is always notified before session is removed

by RH Bugzilla Integration (JIRA)

[ https://issues.jboss.org/browse/MODCLUSTER-478?page=com.atlassian.jira.pl... ] RH Bugzilla Integration updated MODCLUSTER-478: ----------------------------------------------- Bugzilla References: https://bugzilla.redhat.com/show_bug.cgi?id=1314792, https://bugzilla.redhat.com/show_bug.cgi?id=1321090, https://bugzilla.redhat.com/show_bug.cgi?id=1324903 (was: https://bugzilla.redhat.com/show_bug.cgi?id=1314792, https://bugzilla.redhat.com/show_bug.cgi?id=1321090) > Session draining always takes maximum configured timeout since listener is always notified before session is removed > -------------------------------------------------------------------------------------------------------------------- > > Key: MODCLUSTER-478 > URL: https://issues.jboss.org/browse/MODCLUSTER-478 > Project: mod_cluster > Issue Type: Bug > Components: Core & Container Integration (Java) > Affects Versions: 1.2.11.Final, 1.3.1.Final > Environment: -JBoss EAP 6 > Reporter: Aaron Ogburn > Assignee: Radoslav Husar > Fix For: 1.2.12.Final, 1.3.3.Final > > > mod_cluster session draining does not properly end when an active session is invalidated. The NotifyOnDestroySessionListener is not invoked because it is not properly added. That listener is added as a ApplicationLifecycleListeners, but JBossWeb 7 invokes ApplicationSessionLifecycleListeners instead upon session expiration. -- This message was sent by Atlassian JIRA (v6.4.11#64026)

8 years

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

mod_cluster-issues April 2016