[ https://jira.jboss.org/jira/browse/RF-3586?page=com.atlassian.jira.plugin... ] Nick Belaevski reassigned RF-3586: ---------------------------------- Assignee: Nick Belaevski (was: Alexander Smirnov) -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/RF-3586?page=com.atlassian.jira.plugin... ] Nick Belaevski updated RF-3586: ------------------------------- Affects: [Documentation (Ref Guide, User Guide, etc.)] -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/RF-3586?page=com.atlassian.jira.plugin... ] Svetlana mukhina updated RF-3586: --------------------------------- Component/s: docs updated -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/RF-3586?page=com.atlassian.jira.plugin... ] Olivier Martin reopened RF-3586: -------------------------------- The proposed solution does not solve the issue, since the ! character is reserved by the W3C RFC on URIs : http://www.faqs.org/rfcs/rfc1630.html I'm going to be more precise about this issue, since a lot of our projects are being denied to go into production by the security department because of the URIs auto-generated by RichFaces. (in fact the original fix still does not solve the main issue here : the URLs are *NOT* predictible). Before going into the details I would like to insist on the fact that many people are going to face the same issue here when developing in a corporate environment, there are rules and generating the URLs dynamically like this should be avoided. We will probably end up extracting and including the ressources by hand, which will allow us to control how they are cached anyway. -> The white list pattern is something I've seen a lot : everything is forbidden unless explicitely specified ! --- The details --- URIs must comply to those RFC : http://www.faqs.org/rfcs/rfc1630.html http://www.faqs.org/rfcs/rfc1738.html http://www.faqs.org/rfcs/rfc1808.html http://www.faqs.org/rfcs/rfc2396.html http://www.faqs.org/rfcs/rfc3986.html More client specific rules : - For directories, allowed characters are : 'a-z', 'A-Z', '0-9', '%', '_', '-' - For file names, allowed are : 'a-z', 'A-Z', '0-9', '%', '_', '-', '.' (for extension), '=', '?' - No multiple '/' or '.' - No unicode - No path depth > 8 etc... -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/RF-3586?page=com.atlassian.jira.plugin... ] Nick Belaevski updated RF-3586: ------------------------------- Fix Version/s: 3.3.0 (was: 3.2.2) Assignee: Nick Belaevski (was: Mikhail Vitenkov) -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/RF-3586?page=com.atlassian.jira.plugin... ] Work on RF-3586 started by Nick Belaevski. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/RF-3586?page=com.atlassian.jira.plugin... ] Nick Belaevski resolved RF-3586. -------------------------------- Resolution: Done Assignee: Tsikhon Kuprevich (was: Nick Belaevski) org.ajax4jsf.resource.cached.CachedResourceBuilder has been committed. Here is the excerpt from JavaDoc: This class is intended to generate predictable URIs for all resources handled by RichFaces. It creates mapping between resource key/data value and generated random string of known format for all resource requests. By default UUID.toString() is used. Mapping is maintained by LRU map having default capacity of 10000 so be aware that stale entries can be removed and application users will get errors then. How to use: add to application classpath META-INF/services/org.ajax4jsf.resource.InternetResourceBuilder file with the following content org.ajax4jsf.resource.cached.CachedResourceBuilder Limitations: 1. Doesn't work in clustered environments 2. All resource URIs become invalid after server restart that can cause cache issues 3. Diagnostic of resource loading errors becomes somewhat harder. Variant of code where random key is appended to resource name doesn't satisfy the requirement of no path depth > 8 as requested by users (see RF-3586 for more info) -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/RF-3586?page=com.atlassian.jira.plugin... ] Olivier Martin commented on RF-3586: ------------------------------------ Does that mean we won't be able to use RichFaces in a clustered environment ? What type of cluster ? - affinity based - session reclication based -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/RF-3586?page=com.atlassian.jira.plugin... ] Tsikhon Kuprevich closed RF-3586. --------------------------------- -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira