[seam-commits] Seam SVN: r7400 - trunk/src/remoting/org/jboss/seam/remoting.

[seam-commits at lists.jboss.org]

Author: shane.bryzak at jboss.com
Date: 2008-02-08 23:59:13 -0500 (Fri, 08 Feb 2008)
New Revision: 7400

Modified:
   trunk/src/remoting/org/jboss/seam/remoting/Call.java
   trunk/src/remoting/org/jboss/seam/remoting/ExecutionHandler.java
   trunk/src/remoting/org/jboss/seam/remoting/InterfaceGenerator.java
   trunk/src/remoting/org/jboss/seam/remoting/remote.js
Log:
disabled Seam.Remoting.eval() because of security issues

Modified: trunk/src/remoting/org/jboss/seam/remoting/Call.java
===================================================================
--- trunk/src/remoting/org/jboss/seam/remoting/Call.java	2008-02-08 20:38:16 UTC (rev 7399)
+++ trunk/src/remoting/org/jboss/seam/remoting/Call.java	2008-02-09 04:59:13 UTC (rev 7400)
@@ -10,7 +10,6 @@
 
 import org.jboss.seam.Component;
 import org.jboss.seam.annotations.remoting.WebRemote;
-import org.jboss.seam.core.Expressions;
 import org.jboss.seam.remoting.wrapper.ConversionException;
 import org.jboss.seam.remoting.wrapper.ConversionScore;
 import org.jboss.seam.remoting.wrapper.Wrapper;
@@ -25,7 +24,7 @@
   private String id;
   private String componentName;
   private String methodName;
-  private String expression;
+  //private String expression;
 
   private List<Wrapper> params = new ArrayList<Wrapper> ();
 
@@ -48,18 +47,6 @@
     this.methodName = methodName;
     this.context = new CallContext();
   }
-  
-  /**
-   * 
-   * @param id
-   * @param expression
-   */
-  public Call(String id, String expression)
-  {
-     this.id = id;
-     this.expression = expression;
-     this.context = new CallContext();
-  }
 
   /**
    * Return the call context.
@@ -123,10 +110,6 @@
      {
         processInvocation();
      }
-     else if (expression != null)
-     {
-        processExpression();
-     }
   }
   
   private void processInvocation()
@@ -180,11 +163,6 @@
      // Invoke!
      result = m.invoke(instance, convertParams(m.getGenericParameterTypes()));     
   }
-  
-  private void processExpression()
-  {
-     result = Expressions.instance().createValueExpression(expression).getValue();
-  }
 
   /**
    * Convert our parameter values to an Object array of the specified target

Modified: trunk/src/remoting/org/jboss/seam/remoting/ExecutionHandler.java
===================================================================
--- trunk/src/remoting/org/jboss/seam/remoting/ExecutionHandler.java	2008-02-08 20:38:16 UTC (rev 7399)
+++ trunk/src/remoting/org/jboss/seam/remoting/ExecutionHandler.java	2008-02-09 04:59:13 UTC (rev 7400)
@@ -186,13 +186,6 @@
 
         calls.add(call);
       }
-      
-      List<Element> exprElements = env.element("body").elements("eval");
-      for (Element e : exprElements)
-      {
-         Call call = new Call(e.attributeValue("id"), e.attributeValue("expr"));
-         calls.add(call);
-      }
 
       return calls;
     }

Modified: trunk/src/remoting/org/jboss/seam/remoting/InterfaceGenerator.java
===================================================================
--- trunk/src/remoting/org/jboss/seam/remoting/InterfaceGenerator.java	2008-02-08 20:38:16 UTC (rev 7399)
+++ trunk/src/remoting/org/jboss/seam/remoting/InterfaceGenerator.java	2008-02-09 04:59:13 UTC (rev 7400)
@@ -317,9 +317,12 @@
 
     for (Method m : type.getDeclaredMethods())
     {
-      if (m.getAnnotation(WebRemote.class) == null)
-        continue;
+      if (m.getAnnotation(WebRemote.class) == null) continue;
 
+      WebRemote webRemote = m.getAnnotation(WebRemote.class);
+      
+      String[] excludes = webRemote.exclude();
+
       // Append the return type to the source block
       appendTypeSource(out, m.getGenericReturnType(), types);
 
@@ -334,14 +337,12 @@
       {
         appendTypeSource(out, m.getGenericParameterTypes()[i], types);
 
-        if (i > 0)
-          componentSrc.append(", ");
+        if (i > 0) componentSrc.append(", ");
         componentSrc.append("p");
         componentSrc.append(i);
       }
 
-      if (m.getGenericParameterTypes().length > 0)
-        componentSrc.append(", ");
+      if (m.getGenericParameterTypes().length > 0) componentSrc.append(", ");
       componentSrc.append("callback) {\n");
 
       componentSrc.append("    return Seam.Remoting.execute(this, \"");
@@ -350,8 +351,7 @@
 
       for (int i = 0; i < m.getParameterTypes().length; i++)
       {
-        if (i > 0)
-          componentSrc.append(", ");
+        if (i > 0) componentSrc.append(", ");
         componentSrc.append("p");
         componentSrc.append(i);
       }

Modified: trunk/src/remoting/org/jboss/seam/remoting/remote.js
===================================================================
--- trunk/src/remoting/org/jboss/seam/remoting/remote.js	2008-02-08 20:38:16 UTC (rev 7399)
+++ trunk/src/remoting/org/jboss/seam/remoting/remote.js	2008-02-09 04:59:13 UTC (rev 7400)
@@ -435,21 +435,23 @@
 
 Seam.Remoting.__callId = 0;
 
-Seam.Remoting.eval = function(expression, callback)
-{
-  var callId = "" + Seam.Remoting.__callId++; 
-  var data = "<eval expr=\"";
-  data += expression;
-  data += "\" id=\"";
-  data += callId;
-  data += "\"/>";
-  var call = {data: data, id: callId, callback: callback};  
+// eval() disabled until security issues resolved.
+
+//Seam.Remoting.eval = function(expression, callback)
+//{
+//  var callId = "" + Seam.Remoting.__callId++; 
+//  var data = "<eval expr=\"";
+//  data += expression;
+//  data += "\" id=\"";
+//  data += callId;
+//  data += "\"/>";
+//  var call = {data: data, id: callId, callback: callback};  
   
-  var envelope = Seam.Remoting.createEnvelope(Seam.Remoting.createHeader(), data);
-  Seam.Remoting.pendingCalls.put(call.id, call);
+//  var envelope = Seam.Remoting.createEnvelope(Seam.Remoting.createHeader(), data);
+//  Seam.Remoting.pendingCalls.put(call.id, call);
   
-  call.asyncReq = Seam.Remoting.sendAjaxRequest(envelope, Seam.Remoting.PATH_EXECUTE, Seam.Remoting.processResponse, false);
-}
+//  call.asyncReq = Seam.Remoting.sendAjaxRequest(envelope, Seam.Remoting.PATH_EXECUTE, Seam.Remoting.processResponse, false);
+//}
 
 Seam.Remoting.createCall = function(component, methodName, params, callback)
 {