[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-4308) Unable to run TestNG tests within JBDS due to missing dependency - slf4j-api
by Karel Piwko (JIRA)
Unable to run TestNG tests within JBDS due to missing dependency - slf4j-api
-----------------------------------------------------------------------------
Key: JBSEAM-4308
URL: https://jira.jboss.org/jira/browse/JBSEAM-4308
Project: Seam
Issue Type: Bug
Components: Build
Affects Versions: 2.2.0.GA
Reporter: Karel Piwko
When running TestNG test suite within JBDS on project generated by seam-gen, there is sl4j-api library missing and tests could not be run.
When the same project is run within seam-gen, classpaths are set correctly.
Current list of files which must be included in JDBS/Eclipse+TestNG to run tests:
/lib/test/jboss-embedded-all.jar
/lib/test/hibernate-all.jar
/lib/test/thirdparty-all.jar
/lib/jboss-embedded-api.jar
/lib/jboss-deployers-client-spi.jar
/lib/jboss-deployers-core-spi.jar
So slf4j-api.jar should go to thirdparty.jar
Stacktrace:
ERROR [org.jboss.kernel.plugins.dependency.AbstractKernelController] Error installing to Parse: name=vfsfile:/home/kapy/devel/seam-gen/seamEarTest/test-build/ state=Not Installed mode=Manual requiredState=Parse
org.jboss.deployers.spi.DeploymentException: Error during deploy: vfsfile:/home/kapy/devel/seam-gen/seamEarTest/test-build/
at org.jboss.deployers.spi.DeploymentException.rethrowAsDeploymentException(DeploymentException.java:49)
at org.jboss.deployers.plugins.deployers.DeployerWrapper.deploy(DeployerWrapper.java:175)
at org.jboss.deployers.plugins.deployers.DeployersImpl.doInstallParentFirst(DeployersImpl.java:853)
at org.jboss.deployers.plugins.deployers.DeployersImpl.install(DeployersImpl.java:794)
at org.jboss.dependency.plugins.AbstractControllerContext.install(AbstractControllerContext.java:327)
at org.jboss.dependency.plugins.AbstractController.install(AbstractController.java:1309)
at org.jboss.dependency.plugins.AbstractController.incrementState(AbstractController.java:734)
at org.jboss.dependency.plugins.AbstractController.resolveContexts(AbstractController.java:862)
at org.jboss.dependency.plugins.AbstractController.resolveContexts(AbstractController.java:784)
at org.jboss.dependency.plugins.AbstractController.change(AbstractController.java:622)
at org.jboss.dependency.plugins.AbstractController.change(AbstractController.java:411)
at org.jboss.deployers.plugins.deployers.DeployersImpl.process(DeployersImpl.java:498)
at org.jboss.deployers.plugins.main.MainDeployerImpl.process(MainDeployerImpl.java:506)
at org.jboss.embedded.DeploymentGroup.process(DeploymentGroup.java:127)
at org.jboss.embedded.Bootstrap.deployResourceBases(Bootstrap.java:289)
at org.jboss.seam.mock.EmbeddedBootstrap.startAndDeployResources(EmbeddedBootstrap.java:15)
at org.jboss.seam.mock.AbstractSeamTest.startJbossEmbeddedIfNecessary(AbstractSeamTest.java:1024)
at org.jboss.seam.mock.AbstractSeamTest.startSeam(AbstractSeamTest.java:915)
at org.jboss.seam.mock.SeamTest.startSeam(SeamTest.java:58)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.testng.internal.MethodHelper.invokeMethod(MethodHelper.java:580)
at org.testng.internal.Invoker.invokeConfigurationMethod(Invoker.java:398)
at org.testng.internal.Invoker.invokeConfigurations(Invoker.java:145)
at org.testng.internal.Invoker.invokeConfigurations(Invoker.java:82)
at org.testng.SuiteRunner.privateRun(SuiteRunner.java:278)
at org.testng.SuiteRunner.run(SuiteRunner.java:198)
at org.testng.TestNG.createAndRunSuiteRunners(TestNG.java:823)
at org.testng.TestNG.runSuitesLocally(TestNG.java:790)
at org.testng.TestNG.run(TestNG.java:708)
at org.testng.remote.RemoteTestNG.run(RemoteTestNG.java:73)
at org.testng.remote.RemoteTestNG.main(RemoteTestNG.java:124)
Caused by: java.lang.NoClassDefFoundError: org/slf4j/LoggerFactory
at org.hibernate.util.DTDEntityResolver.<clinit>(DTDEntityResolver.java:57)
at org.jboss.ejb3.deployers.PersistenceUnitParsingDeployer.parse(PersistenceUnitParsingDeployer.java:113)
at org.jboss.ejb3.deployers.PersistenceUnitParsingDeployer.parse(PersistenceUnitParsingDeployer.java:89)
at org.jboss.ejb3.deployers.PersistenceUnitParsingDeployer.parse(PersistenceUnitParsingDeployer.java:51)
at org.jboss.deployers.spi.deployer.helpers.AbstractParsingDeployerWithOutput.createMetaData(AbstractParsingDeployerWithOutput.java:223)
at org.jboss.deployers.spi.deployer.helpers.AbstractParsingDeployerWithOutput.createMetaData(AbstractParsingDeployerWithOutput.java:199)
at org.jboss.deployers.spi.deployer.helpers.AbstractParsingDeployerWithOutput.deploy(AbstractParsingDeployerWithOutput.java:162)
at org.jboss.deployers.plugins.deployers.DeployerWrapper.deploy(DeployerWrapper.java:169)
... 32 more
Caused by: java.lang.ClassNotFoundException: org.slf4j.LoggerFactory
at java.net.URLClassLoader$1.run(URLClassLoader.java:200)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:188)
at java.lang.ClassLoader.loadClass(ClassLoader.java:307)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:301)
at java.lang.ClassLoader.loadClass(ClassLoader.java:252)
at java.lang.ClassLoader.loadClassInternal(ClassLoader.java:320)
... 40 more
FAILED CONFIGURATION: @BeforeSuite startSeam
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
16 years, 2 months
[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-4014) cannot configure max age of remember me cookie
by Dan Allen (JIRA)
cannot configure max age of remember me cookie
----------------------------------------------
Key: JBSEAM-4014
URL: https://jira.jboss.org/jira/browse/JBSEAM-4014
Project: Seam
Issue Type: Bug
Components: Security
Affects Versions: 2.1.1.GA
Reporter: Dan Allen
Fix For: 2.1.2.CR1
The configuration for the max age of the remember me cookie got totally messed up. First, the definition of the rememberMe element is missing from security-2.1.xsd. Second, the cookieMaxAge is no longer reachable through the configuration of the rememberMe component. Finally, there is a completely bogus definition of the facesSecurityEvents element, which claims to have a cookie-max-age attribute, when it has no corresponding property.
To fix this, there needs to be a cookieMaxAge property on the rememberMe component and the security-2.1.xsd file needs to be updated.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
16 years, 2 months
[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-4066) captureCurrentView on redirect should capture all request parameters
by Dan Allen (JIRA)
captureCurrentView on redirect should capture all request parameters
--------------------------------------------------------------------
Key: JBSEAM-4066
URL: https://jira.jboss.org/jira/browse/JBSEAM-4066
Project: Seam
Issue Type: Bug
Affects Versions: 2.1.1.GA
Reporter: Dan Allen
Assignee: Dan Allen
Fix For: 2.2.0.CR1
Attachments: JBSEAM-4066-trunk-v1.txt
When the captureCurrentRequest() method was deprecated and replaced by captureCurrentView(), the behavior changed such that page parameters were being saved instead of request parameters. I'm fine with the idea of preserving page parameters based on how they were bound to the model on the way into the page, but I also think that arbitrary request parameters need to be captured. Otherwise, the redirect back to the current view will in many cases be incomplete and thus fail. The logic I propose is to capture the request parameters and then override the values with the values from the page parameters (giving page parameters the precedence).
However, long term, we should also consider the fact that multi-value parameters are not being preserved. Likely they should be captured as well, but there is a lack of infrastructure to support them.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
16 years, 2 months
[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-4007) Provide an <s:token> UI component to secure JSF forms against cross-site request forgery (XSRF)
by Dan Allen (JIRA)
Provide an <s:token> UI component to secure JSF forms against cross-site request forgery (XSRF)
-----------------------------------------------------------------------------------------------
Key: JBSEAM-4007
URL: https://jira.jboss.org/jira/browse/JBSEAM-4007
Project: Seam
Issue Type: Feature Request
Components: JSF Controls
Affects Versions: 2.1.1.GA
Reporter: Dan Allen
Fix For: 2.1.2.GA
Introduce the UI component tag <s:token> to secure JSF form posts against cross-site request forgery (XSRF) attacks. Please note that if the solution below is implemented in JSF 2, then Seam does not need to provide a custom solution and this issue can be closed. However, we still need to implement something equivalent for Seam Remoting.
The problem today is that when using client-side state saving, a form POST can be crafted (forged) to submit into a JSF application from an external site (cross-site). The serialized view is simply passed in the javax.faces.ViewState parameter. JSF will blindly recreate the view and process the request.
Server-side state saving is equally insecure since all the forged POST has to do is provide the identifier of the view state on the server in the javax.faces.ViewState parameter. Actually, this is only a problem since JSF generates sequential identifiers per session in the form j_id + # of views in session.
Server-side state saving becomes event more problematic in JSF 2.0 since Facelets' "build during restore" feature is enabled by default. In this case, the javax.faces.ViewState parameter isn't even required since JSF will recreate the view before processing the request.
The <s:token> UI component will perform two steps. First, it will assign a unique identifier to the browser using a cookie that lives until the end of the browser session. This is roughly the browser's private key. The <s:token> tag is used inside of an <h:form> and generates a hidden form field named javax.faces.FormSignature. The form signature is calculated as follows:
sha1( signature = viewId + "," + formClientId, salt = clientUid )
The developer can also choose to incorporate the session id into this hash for a more secure token (at the cost of binding it to the session)
sha1( signature = viewId + "," + formClientId + "," + sessionId, salt = clientUid )
When the form is submitted, the hash is recreated and compared against the value of the javax.faces.FormSignature parameter.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
16 years, 2 months