April 2013 - overlord-issues - Jboss List Archives

[JBoss JIRA] (SRAMPUI-68) Create Dashboard page

by Eric Wittmann (JIRA)

Eric Wittmann created SRAMPUI-68: ------------------------------------ Summary: Create Dashboard page Key: SRAMPUI-68 URL: https://issues.jboss.org/browse/SRAMPUI-68 Project: S-RAMP UI Issue Type: Feature Request Components: View Reporter: Eric Wittmann Fix For: Milestone 4 We're planning on a shared top navigation header for all Overlord projects. Once this is done, the S-RAMP browser should have a Dashboard which will be a starting point for navigation. Artifacts, Ontologies, and Settings will have sections on the Dashboard. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

11 years, 8 months

1
0
0 / 0

[JBoss JIRA] (SRAMPUI-67) Artifacts Page - add multi-select with Actions drop-down

by Eric Wittmann (JIRA)

Eric Wittmann created SRAMPUI-67: ------------------------------------ Summary: Artifacts Page - add multi-select with Actions drop-down Key: SRAMPUI-67 URL: https://issues.jboss.org/browse/SRAMPUI-67 Project: S-RAMP UI Issue Type: Feature Request Reporter: Eric Wittmann Assignee: Eric Wittmann Fix For: Future (Unscheduled) Currently artifacts cannot be selected. We need to support multi-select. Once that is done, the actions drop-down should be restored and implemented (e.g. Download, Delete, etc...) -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

11 years, 8 months

1
0
0 / 0

[JBoss JIRA] (SRAMPUI-66) Use a type-ahead control for Core-Property filtering of Artifact Type

by Eric Wittmann (JIRA)

Eric Wittmann created SRAMPUI-66: ------------------------------------ Summary: Use a type-ahead control for Core-Property filtering of Artifact Type Key: SRAMPUI-66 URL: https://issues.jboss.org/browse/SRAMPUI-66 Project: S-RAMP UI Issue Type: Feature Request Components: Widget Reporter: Eric Wittmann Assignee: Eric Wittmann Fix For: Milestone 4 Currently this is just a text box. It would be better to have a type-ahead control that would let users quickly choose from the standard S-RAMP types. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

11 years, 8 months

1
0
0 / 0

[JBoss JIRA] (SRAMPUI-63) Artifact Details: Make Relationship sections collapsible

by Eric Wittmann (JIRA)

[ https://issues.jboss.org/browse/SRAMPUI-63?page=com.atlassian.jira.plugin... ] Eric Wittmann updated SRAMPUI-63: --------------------------------- Fix Version/s: Future (Unscheduled) (was: Milestone 4) > Artifact Details: Make Relationship sections collapsible > --------------------------------------------------------- > > Key: SRAMPUI-63 > URL: https://issues.jboss.org/browse/SRAMPUI-63 > Project: S-RAMP UI > Issue Type: Feature Request > Components: Widget > Reporter: Eric Wittmann > Assignee: Eric Wittmann > Fix For: Future (Unscheduled) > > > The relationships tab on the artifact details page organizes the relationships into sections. Make the sections collapsible. Some JS to help with this: > http://jsfiddle.net/T8t2r/3/ -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

11 years, 8 months

1
0
0 / 0

[JBoss JIRA] (SRAMP-178) Trusting MIME type sent from clients is dangerous

by Eric Wittmann (JIRA)

[ https://issues.jboss.org/browse/SRAMP-178?page=com.atlassian.jira.plugin.... ] Eric Wittmann resolved SRAMP-178. --------------------------------- Resolution: Done > Trusting MIME type sent from clients is dangerous > ------------------------------------------------- > > Key: SRAMP-178 > URL: https://issues.jboss.org/browse/SRAMP-178 > Project: S-RAMP > Issue Type: Bug > Security Level: Public(Everyone can see) > Components: Client > Affects Versions: 0.1.1 > Reporter: Lukas Krejci > Assignee: Kurt Stam > Fix For: 0.2.0 - Milestone 4 > > > While uploading artifact to the repository, the S-RAMP server completely trusts the client with the supplied mime type and uses it from thereafter. > This also includes the time when the artifact is downloaded from S-RAMP server. > This is quite dangerous, IMHO, because it gives the potential attackers the means for making certain types of files look like something they aren't. This could be a nice vector to exploiting vulnerabilities in applications that then open such files. > For example, consider this command: > curl -H 'Content-Type: image/png' -H 'Slug: wha.pkg' --data-binary @tmp.pdf 'http://localhost:8080/s-ramp-server/s-ramp/core/Document' > This will create an artifact called "wha.pkg" in the repository, which will have the stored content type of "image/png" but the actual data will be a PDF. > IMHO, the mime type detection should be purely a server-side affair ignoring any hints of mimetype sent in by the clients. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

11 years, 8 months

1
0
0 / 0

[JBoss JIRA] (SRAMP-178) Trusting MIME type sent from clients is dangerous

by Eric Wittmann (JIRA)

[ https://issues.jboss.org/browse/SRAMP-178?page=com.atlassian.jira.plugin.... ] Eric Wittmann closed SRAMP-178. ------------------------------- > Trusting MIME type sent from clients is dangerous > ------------------------------------------------- > > Key: SRAMP-178 > URL: https://issues.jboss.org/browse/SRAMP-178 > Project: S-RAMP > Issue Type: Bug > Security Level: Public(Everyone can see) > Components: Client > Affects Versions: 0.1.1 > Reporter: Lukas Krejci > Assignee: Kurt Stam > Fix For: 0.2.0 - Milestone 4 > > > While uploading artifact to the repository, the S-RAMP server completely trusts the client with the supplied mime type and uses it from thereafter. > This also includes the time when the artifact is downloaded from S-RAMP server. > This is quite dangerous, IMHO, because it gives the potential attackers the means for making certain types of files look like something they aren't. This could be a nice vector to exploiting vulnerabilities in applications that then open such files. > For example, consider this command: > curl -H 'Content-Type: image/png' -H 'Slug: wha.pkg' --data-binary @tmp.pdf 'http://localhost:8080/s-ramp-server/s-ramp/core/Document' > This will create an artifact called "wha.pkg" in the repository, which will have the stored content type of "image/png" but the actual data will be a PDF. > IMHO, the mime type detection should be purely a server-side affair ignoring any hints of mimetype sent in by the clients. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

11 years, 8 months

1
0
0 / 0

[JBoss JIRA] (SRAMP-178) Trusting MIME type sent from clients is dangerous

by Eric Wittmann (JIRA)

[ https://issues.jboss.org/browse/SRAMP-178?page=com.atlassian.jira.plugin.... ] Eric Wittmann updated SRAMP-178: -------------------------------- Git Pull Request: https://github.com/Governance/s-ramp/pull/221 > Trusting MIME type sent from clients is dangerous > ------------------------------------------------- > > Key: SRAMP-178 > URL: https://issues.jboss.org/browse/SRAMP-178 > Project: S-RAMP > Issue Type: Bug > Security Level: Public(Everyone can see) > Components: Client > Affects Versions: 0.1.1 > Reporter: Lukas Krejci > Assignee: Kurt Stam > Fix For: 0.2.0 - Milestone 4 > > > While uploading artifact to the repository, the S-RAMP server completely trusts the client with the supplied mime type and uses it from thereafter. > This also includes the time when the artifact is downloaded from S-RAMP server. > This is quite dangerous, IMHO, because it gives the potential attackers the means for making certain types of files look like something they aren't. This could be a nice vector to exploiting vulnerabilities in applications that then open such files. > For example, consider this command: > curl -H 'Content-Type: image/png' -H 'Slug: wha.pkg' --data-binary @tmp.pdf 'http://localhost:8080/s-ramp-server/s-ramp/core/Document' > This will create an artifact called "wha.pkg" in the repository, which will have the stored content type of "image/png" but the actual data will be a PDF. > IMHO, the mime type detection should be purely a server-side affair ignoring any hints of mimetype sent in by the clients. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

11 years, 8 months

1
0
0 / 0

[JBoss JIRA] (SRAMP-178) Trusting MIME type sent from clients is dangerous

by Eric Wittmann (JIRA)

[ https://issues.jboss.org/browse/SRAMP-178?page=com.atlassian.jira.plugin.... ] Eric Wittmann commented on SRAMP-178: ------------------------------------- You're right, I did. :) Things look good so I'm going to close out this issue. > Trusting MIME type sent from clients is dangerous > ------------------------------------------------- > > Key: SRAMP-178 > URL: https://issues.jboss.org/browse/SRAMP-178 > Project: S-RAMP > Issue Type: Bug > Security Level: Public(Everyone can see) > Components: Client > Affects Versions: 0.1.1 > Reporter: Lukas Krejci > Assignee: Kurt Stam > Fix For: 0.2.0 - Milestone 4 > > > While uploading artifact to the repository, the S-RAMP server completely trusts the client with the supplied mime type and uses it from thereafter. > This also includes the time when the artifact is downloaded from S-RAMP server. > This is quite dangerous, IMHO, because it gives the potential attackers the means for making certain types of files look like something they aren't. This could be a nice vector to exploiting vulnerabilities in applications that then open such files. > For example, consider this command: > curl -H 'Content-Type: image/png' -H 'Slug: wha.pkg' --data-binary @tmp.pdf 'http://localhost:8080/s-ramp-server/s-ramp/core/Document' > This will create an artifact called "wha.pkg" in the repository, which will have the stored content type of "image/png" but the actual data will be a PDF. > IMHO, the mime type detection should be purely a server-side affair ignoring any hints of mimetype sent in by the clients. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

11 years, 8 months

1
0
0 / 0

[JBoss JIRA] (SRAMP-178) Trusting MIME type sent from clients is dangerous

by Lukas Krejci (JIRA)

[ https://issues.jboss.org/browse/SRAMP-178?page=com.atlassian.jira.plugin.... ] Lukas Krejci commented on SRAMP-178: ------------------------------------ Well, you merged my pull request: https://github.com/Governance/s-ramp/pull/221 That doesn't mean I didn't introduce any new bugs ;) Nevertheless, S-RAMP server should now use Tika to assign MIME types of the uploaded artifacts. > Trusting MIME type sent from clients is dangerous > ------------------------------------------------- > > Key: SRAMP-178 > URL: https://issues.jboss.org/browse/SRAMP-178 > Project: S-RAMP > Issue Type: Bug > Security Level: Public(Everyone can see) > Components: Client > Affects Versions: 0.1.1 > Reporter: Lukas Krejci > Assignee: Kurt Stam > Fix For: 0.2.0 - Milestone 4 > > > While uploading artifact to the repository, the S-RAMP server completely trusts the client with the supplied mime type and uses it from thereafter. > This also includes the time when the artifact is downloaded from S-RAMP server. > This is quite dangerous, IMHO, because it gives the potential attackers the means for making certain types of files look like something they aren't. This could be a nice vector to exploiting vulnerabilities in applications that then open such files. > For example, consider this command: > curl -H 'Content-Type: image/png' -H 'Slug: wha.pkg' --data-binary @tmp.pdf 'http://localhost:8080/s-ramp-server/s-ramp/core/Document' > This will create an artifact called "wha.pkg" in the repository, which will have the stored content type of "image/png" but the actual data will be a PDF. > IMHO, the mime type detection should be purely a server-side affair ignoring any hints of mimetype sent in by the clients. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

11 years, 8 months

1
0
0 / 0

[JBoss JIRA] (SRAMPUI-45) Filtering - classifiers

by Eric Wittmann (JIRA)

[ https://issues.jboss.org/browse/SRAMPUI-45?page=com.atlassian.jira.plugin... ] Eric Wittmann closed SRAMPUI-45. -------------------------------- > Filtering - classifiers > ----------------------- > > Key: SRAMPUI-45 > URL: https://issues.jboss.org/browse/SRAMPUI-45 > Project: S-RAMP UI > Issue Type: Task > Reporter: Eric Wittmann > Assignee: Eric Wittmann > Fix For: Milestone 4 > > > Filter by classifications. This requires that there be a way to query the server for the list of ontologies, then pull them all down and display them in the UI (so that the user can pick 0 or more classes in the ontology). -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

11 years, 8 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

overlord-issues April 2013