June 2012 - seam-issues - Jboss List Archives

[JBoss JIRA] (JBSEAM-4994) JBoss Seam remote execution vulnerability

by Kevin Eliuk (JIRA)

12 years, 6 months

2
1
0 / 0

[JBoss JIRA] (JBSEAM-4992) http/https scheme redirection does not propagate request parameters

by Brian Johnson (JIRA)

Brian Johnson created JBSEAM-4992: ------------------------------------- Summary: http/https scheme redirection does not propagate request parameters Key: JBSEAM-4992 URL: https://issues.jboss.org/browse/JBSEAM-4992 Project: Seam 2 Issue Type: Bug Components: Core Affects Versions: 2.2.0.GA Reporter: Brian Johnson Using Seam 2.2.0 Have the following wildcard scheme def in my pages.xml: <page view-id="*" scheme="http" /> For some specific pages (password change, etc), the scheme is specified as https. For all other view-id defs, no scheme is specified so the default of http is used. My problem is this, for a page that doesn't specify a scheme (and, hence, uses the default http), if the user attempts to visit the page using https, when Seam redirects to http, it drops the request parameters. Near as I can tell, this is what happens: in org.jboss.seam.navigation.Pages.preRender(FacesContext) after we've determined there's a scheme mismatch, the following is called: Manager.instance().redirect(viewId); that lands me in org.jboss.seam.faces.FacesManager.redirect(String), where we call: redirect(viewId, null, true, true); See that null there? That argument is the request parameter map. Are we intentionally not propagating the request parameters in this case? If so, can someone please enligten me as to why? Attempted to ask this question in the community forum (https://community.jboss.org/thread/200759), but have received no response. Read through the Seam documentation and saw no reference to propagation of request parameters for a scheme redirect. Common sense would seem to suggest that request parameter propagation should be occurring, so given the lack of information on the topic in the community forum and the doc, I guess that's all I have to rely on. I also tested with 2.2.2.Final and found the same results. I can presently workaround by extending Pages and overriding preRender as follows: @Override public boolean preRender(FacesContext facesContext) { String viewId = getViewId(facesContext); // redirect to HTTPS if necessary String requestScheme = getRequestScheme(facesContext); if (requestScheme != null) { String scheme = getScheme(viewId); if (scheme != null && !requestScheme.equals(scheme)) { Manager manager = Manager.instance(); if (manager instanceof FacesManager) { FacesManager facesManager = (FacesManager) manager; Map<String, Object> requestParamMap = null; try { Map<String, String> stringStringMap = facesContext.getExternalContext() .getRequestParameterMap(); if (stringStringMap != null) { requestParamMap = new HashMap<String, Object>(stringStringMap); } } catch (Exception e) { log.error("Failed to cast param map", e); } facesManager.redirect(viewId, requestParamMap, true, true); return false; } } } return super.preRender(facesContext); } -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira

12 years, 6 months

1
0
0 / 0

[JBoss JIRA] Created: (SEAMFACES-193) PrettyFaces URL rewriting is not happening when intercepted via @LoginView

by Bill Elliot (JIRA)

PrettyFaces URL rewriting is not happening when intercepted via @LoginView -------------------------------------------------------------------------- Key: SEAMFACES-193 URL: https://issues.jboss.org/browse/SEAMFACES-193 Project: Seam Faces Issue Type: Bug Components: Security, View Configuration Affects Versions: 3.0.2 Environment: JBoss AS6, Seam Faces 3.0.2, PrettyFaces 2.2 Reporter: Bill Elliot When starting as not logged in and you request a page mapped with PrettyFaces that has a security constraint (defined in pages @ViewConfig) which has a @LogonView, you are sent to the login screen first. Then once you login successfully you are takes to the requested page, but without the PrettyFaces URL rewriting. You get the raw URL. -- This message is automatically generated by JIRA. For more information on JIRA, see: http://www.atlassian.com/software/jira

12 years, 7 months

4
6
0 / 0

[JBoss JIRA] (SOLDER-332) Solder cannot deploy Class in empty package (default)

by Marco Battaglia (JIRA)

Marco Battaglia created SOLDER-332: -------------------------------------- Summary: Solder cannot deploy Class in empty package (default) Key: SOLDER-332 URL: https://issues.jboss.org/browse/SOLDER-332 Project: Solder Issue Type: Bug Components: Core Affects Versions: 3.0.0.Final Reporter: Marco Battaglia Priority: Minor If a class is in default package (i.e. no package) the whole application (.war) cannot be deployed, because solder annotation processor fall in error: NullPointerException. org.jboss.seam.solder.core.CoreExtension [...] <X> void processAnnotatedType(@Observes final ProcessAnnotatedType<X> pat, BeanManager beanManager) { [...] Package pkg = javaClass.getPackage(); Named namedFromPackage = null; /////////////////////////////////// // ERROR on next line: pkg is null if (pkg.isAnnotationPresent(Named.class) && !annotatedType.isAnnotationPresent(Named.class)) // ERROR pkg is null //////////////////////// { builder = initializeBuilder(builder, annotatedType); namedFromPackage = new NamedLiteral(); builder.addToClass(namedFromPackage); } -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira

12 years, 7 months

1
1
0 / 0

[JBoss JIRA] (JBSEAM-4990) Wrong usage of commons-logging Logger in MockViewHandler and MockRequestDispatcher

by Marek Novotny (JIRA)

Marek Novotny created JBSEAM-4990: ------------------------------------- Summary: Wrong usage of commons-logging Logger in MockViewHandler and MockRequestDispatcher Key: JBSEAM-4990 URL: https://issues.jboss.org/browse/JBSEAM-4990 Project: Seam 2 Issue Type: Bug Components: Core Affects Versions: 2.3.0.BETA2 Reporter: Marek Novotny Assignee: Marek Novotny Fix For: 2.3.0.CR1 There is wrong usage of commons-logging in Seam mocks classes like {code:java} private final Log logger = LogFactory.getLog(getClass()); {code} There should be used {code:java} private static final LogProvider logger = Logging.getLogProvider(some.class); {code} -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira

12 years, 7 months

1
1
0 / 0

[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-4070) Remove restriction that seam-debug.jar must be loaded by the same classloader as jsf-facelets.jar

by Stuart Douglas (JIRA)

Remove restriction that seam-debug.jar must be loaded by the same classloader as jsf-facelets.jar ------------------------------------------------------------------------------------------------- Key: JBSEAM-4070 URL: https://jira.jboss.org/jira/browse/JBSEAM-4070 Project: Seam Issue Type: Patch Reporter: Stuart Douglas Attachments: statewriter-patch.diff If seam-debug.jar and jsf-facelets.jar are not in the same classloader a redirect loop occurs when the debug page is displayed. I have changed the StateWriterControl class to use reflection to access StateWriter. This also mean the StateWriterControl can be moved out of com.sun.facelets and into an org.jboss.seam package. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

12 years, 7 months

5
7
0 / 0

[JBoss JIRA] (JBSEAM-4979) Seam 2.3.0.Beta2 breaks EL resolution in JSF

by Andrea Martino (JIRA)

Andrea Martino created JBSEAM-4979: -------------------------------------- Summary: Seam 2.3.0.Beta2 breaks EL resolution in JSF Key: JBSEAM-4979 URL: https://issues.jboss.org/browse/JBSEAM-4979 Project: Seam 2 Issue Type: Bug Components: JSF Integration Affects Versions: 2.3.0.BETA2 Environment: JBOSS AS 7.1.1. + RichFaces 4.2.2.Final + Seam 2.3.0.Beta2 Reporter: Andrea Martino Accessing the method of a bean without the ending brackets breaks property resolution. In Seam 2.3.0.Beta1 the following is valid and works fine. The action attribute of <s:link> tag references test.init without ending brackets. {code:xml} <s:link view="/test.xhtml" propagation="none" action="#{test.init}" value="Test" /> {code} The above code does not work in Seam 2.3.0.Beta2. In order to have it working in Beta2, the following must be used: {code:xml} <s:link view="/test.xhtml" propagation="none" action="#{test.init()}" value="Test" /> {code} If no brackets are added to the method name, the following is logged to the console: {code:title=Log file|borderStyle=solid} 17:19:43,181 SCHWERWIEGEND [javax.enterprise.resource.webcontainer.jsf.application] (http-localhost-127.0.0.1-8080-1) Error Rendering View[/menu.xhtml]: javax.el.ELException: /menu.xhtml: The class 'com.example.Test_$$_javassist_seam_66' does not have the property 'init'. at com.sun.faces.facelets.compiler.AttributeInstruction.write(AttributeInstruction.java:94) [jsf-impl-2.1.7-jbossorg-2.jar:] at com.sun.faces.facelets.compiler.UIInstructions.encodeBegin(UIInstructions.java:82) [jsf-impl-2.1.7-jbossorg-2.jar:] at com.sun.faces.facelets.compiler.UILeaf.encodeAll(UILeaf.java:183) [jsf-impl-2.1.7-jbossorg-2.jar:] at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1782) [jboss-jsf-api_2.1_spec-2.0.1.Final.jar: {code} -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira

12 years, 7 months

2
4
0 / 0

[JBoss JIRA] (JBSEAM-4989) javax.servlet.ServletException with message: "Component must be of type org.jboss.seam.ui.component.UICache"

by Serge Emmanuel Pagop (JIRA)

Serge Emmanuel Pagop created JBSEAM-4989: -------------------------------------------- Summary: javax.servlet.ServletException with message: "Component must be of type org.jboss.seam.ui.component.UICache" Key: JBSEAM-4989 URL: https://issues.jboss.org/browse/JBSEAM-4989 Project: Seam 2 Issue Type: Bug Components: Core Affects Versions: 2.3.0.BETA2 Environment: Mac OS X, java version "1.6.0_31" and SEAM 2.3.0 Beta 2, JBoss AS7.1.1 Reporter: Serge Emmanuel Pagop I have here curious error when changing the seam version used by my application from 2.3.0.Beta2-SNAPSHOT -> 2.3.0.Beta2 see error below: 22:11:25,721 SEVERE [javax.enterprise.resource.webcontainer.jsf.application] (http-localhost-127.0.0.1-8080-4) Error Rendering View[/logout.xhtml]: java.lang.IllegalArgumentException: Component must be of type org.jboss.seam.ui.component.UICache at org.jboss.seam.ui.util.cdk.RendererBase.encodeBegin(RendererBase.java:75) [jboss-seam-ui-2.3.0.Beta2.jar:2.3.0.Beta2] at javax.faces.component.UIComponentBase.encodeBegin(UIComponentBase.java:820) [jboss-jsf-api_2.1_spec-2.0.1.Final.jar:2.0.1.Final] at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1777) [jboss-jsf-api_2.1_spec-2.0.1.Final.jar:2.0.1.Final] at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1782) [jboss-jsf-api_2.1_spec-2.0.1.Final.jar:2.0.1.Final] at com.sun.faces.application.view.FaceletViewHandlingStrategy.renderView(FaceletViewHandlingStrategy.java:402) [jsf-impl-2.1.7-jbossorg-2.jar:] at com.sun.faces.application.view.MultiViewHandler.renderView(MultiViewHandler.java:125) [jsf-impl-2.1.7-jbossorg-2.jar:] at org.jboss.seam.jsf.SeamViewHandler.renderView(SeamViewHandler.java:88) [jboss-seam.jar:2.3.0.Beta2] at javax.faces.application.ViewHandlerWrapper.renderView(ViewHandlerWrapper.java:288) [jboss-jsf-api_2.1_spec-2.0.1.Final.jar:2.0.1.Final] at com.sun.faces.lifecycle.RenderResponsePhase.execute(RenderResponsePhase.java:121) [jsf-impl-2.1.7-jbossorg-2.jar:] at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:101) [jsf-impl-2.1.7-jbossorg-2.jar:] at com.sun.faces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:139) [jsf-impl-2.1.7-jbossorg-2.jar:] at javax.faces.webapp.FacesServlet.service(FacesServlet.java:594) [jboss-jsf-api_2.1_spec-2.0.1.Final.jar:2.0.1.Final] at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:329) [jbossweb-7.0.13.Final.jar:] at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248) [jbossweb-7.0.13.Final.jar:] at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:83) [jboss-seam.jar:2.3.0.Beta2] at org.jboss.seam.web.LoggingFilter.doFilter(LoggingFilter.java:60) [jboss-seam.jar:2.3.0.Beta2] at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69) [jboss-seam.jar:2.3.0.Beta2] at org.jboss.seam.web.IdentityFilter.doFilter(IdentityFilter.java:40) [jboss-seam.jar:2.3.0.Beta2] at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69) [jboss-seam.jar:2.3.0.Beta2] at org.jboss.seam.web.MultipartFilter.doFilter(MultipartFilter.java:90) [jboss-seam.jar:2.3.0.Beta2] at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69) [jboss-seam.jar:2.3.0.Beta2] at org.jboss.seam.web.ExceptionFilter.doFilter(ExceptionFilter.java:64) [jboss-seam.jar:2.3.0.Beta2] at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69) [jboss-seam.jar:2.3.0.Beta2] at org.jboss.seam.web.RedirectFilter.doFilter(RedirectFilter.java:45) [jboss-seam.jar:2.3.0.Beta2] at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69) [jboss-seam.jar:2.3.0.Beta2] at org.jboss.seam.web.HotDeployFilter.doFilter(HotDeployFilter.java:53) [jboss-seam.jar:2.3.0.Beta2] at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69) [jboss-seam.jar:2.3.0.Beta2] at org.jboss.seam.web.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:42) [jboss-seam.jar:2.3.0.Beta2] at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69) [jboss-seam.jar:2.3.0.Beta2] at org.jboss.seam.servlet.SeamFilter.doFilter(SeamFilter.java:158) [jboss-seam.jar:2.3.0.Beta2] at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:280) [jbossweb-7.0.13.Final.jar:] at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248) [jbossweb-7.0.13.Final.jar:] at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:275) [jbossweb-7.0.13.Final.jar:] at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:161) [jbossweb-7.0.13.Final.jar:] at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:397) [jbossweb-7.0.13.Final.jar:] at org.jboss.as.jpa.interceptor.WebNonTxEmCloserValve.invoke(WebNonTxEmCloserValve.java:50) [jboss-as-jpa-7.1.1.Final.jar:7.1.1.Final] at org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:153) [jboss-as-web-7.1.1.Final.jar:7.1.1.Final] at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:155) [jbossweb-7.0.13.Final.jar:] at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [jbossweb-7.0.13.Final.jar:] at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [jbossweb-7.0.13.Final.jar:] at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:368) [jbossweb-7.0.13.Final.jar:] at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:877) [jbossweb-7.0.13.Final.jar:] at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:671) [jbossweb-7.0.13.Final.jar:] at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:930) [jbossweb-7.0.13.Final.jar:] at java.lang.Thread.run(Thread.java:680) [classes.jar:1.6.0_31] 22:11:25,817 INFO [javax.enterprise.resource.webcontainer.jsf.renderkit] (http-localhost-127.0.0.1-8080-4) WARNING: FacesMessage(s) have been enqueued, but may not have been displayed. sourceId=null[severity=(ERROR 2), summary=(One or more resources have the target of 'head', but no 'head' component has been defined within the view.), detail=(One or more resources have the target of 'head', but no 'head' component has been defined within the view.)] -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira

12 years, 7 months

2
2
0 / 0

[JBoss JIRA] (SOLDER-331) @Exact does not do what its name implies/JavaDoc states

by Richard Kennard (JIRA)

Richard Kennard created SOLDER-331: -------------------------------------- Summary: @Exact does not do what its name implies/JavaDoc states Key: SOLDER-331 URL: https://issues.jboss.org/browse/SOLDER-331 Project: Solder Issue Type: Bug Components: Core Affects Versions: 3.1.0.Final Reporter: Richard Kennard The Solder annotation @Exact is poorly defined, IMHO, because it does not do what its name implies/JavaDoc states: "An injection point qualifier that may be used to select the exact bean to be injected, by specifying its implementation class." In the test suite it tests: {{@Inject @Exact(Greyhound.class) private Dog dog;}} But all @Exact does behind the scenes (in CoreExtension.java) is: {{if (f.isAnnotationPresent(Exact.class)) { ... builder.overrideFieldType(f, type);}} So whilst you can make Dog 'exact' into Greyhound, if there exists another class BetterGreyhound: {{package org.jboss.solder.test.core; public class BetterGreyhound extends Greyhound { }}} You *cannot* make BetterGreyhound into Greyhound. If BetterGreyhound exists and you try: {{@Inject @Exact(Greyhound.class) private Dog dog;}} You'll get: WELD-001409 Ambiguous dependencies for type [Greyhound] with qualifiers [@Default] at injection point [[field] @Exact @Inject private org.jboss.solder.test.core.RaceTrack.dog]. Possible dependencies [[Managed Bean [class org.jboss.solder.test.core.Greyhound] with qualifiers [@Any @Default @Named], Managed Bean [class org.jboss.solder.test.core.BetterGreyhound] with qualifiers [@Any @Default @Named]]] I think @Exact either: * needs to be a @Qualifier (which it used to be, and which its JavaDoc states it still is); or * needs to be renamed to @AtLeast; or * needs its JavaDoc fixed to clarify that it can only resolve ambiguious superclasses, not subclasses -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira

12 years, 7 months

1
4
0 / 0

[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-4185) ViewExpiredException is printed in the log even if i set log="false"

by Adrian Mitev (JIRA)

ViewExpiredException is printed in the log even if i set log="false" -------------------------------------------------------------------- Key: JBSEAM-4185 URL: https://jira.jboss.org/jira/browse/JBSEAM-4185 Project: Seam Issue Type: Bug Components: JSF Integration Affects Versions: 2.1.2.CR1 Reporter: Adrian Mitev Attachments: exception.txt See exception.txt for the stacktrace. This is what i have in pages.xml <exception class="javax.faces.application.ViewExpiredException" log="false"> <redirect view-id="/common/error.xhtml"> <message>#{messages.sessionTimeout}</message> </redirect> </exception> and the redirect is performed but i still see the exception in the log -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

12 years, 7 months

5
13
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

seam-issues June 2012