[Bug 958733] New: plexus-utils: suspicious shell quoting in org.codehaus.plexus.util.cli
by Red Hat Bugzilla
Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=958733
Bug ID: 958733
Summary: plexus-utils: suspicious shell quoting in
org.codehaus.plexus.util.cli
Product: Fedora
Version: 18
Component: plexus-utils
Severity: unspecified
Priority: unspecified
Assignee: fnasser(a)redhat.com
Reporter: fweimer(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: fnasser(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com
Blocks: 958220
Category: ---
The shell quoting logic in this package (and the
org.codehaus.plexus.util.cli.shell) package looks fairly dangerous. It appears
to be mostly dead code. Client code should be migrated to
java.lang.ProcessBuilder.
The different quoting options (single quotes, double quotes) are difficult to
get right, and the reference to StringUtils is not particularly helpful because
the caller has to provide the correct set of characters to be escaped, which is
platform-dependent.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=JhGrfK5sg6&a=cc_unsubscribe
5 years, 8 months
[Bug 719628] New: Please build jtidy for EPEL 6
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.
Summary: Please build jtidy for EPEL 6
https://bugzilla.redhat.com/show_bug.cgi?id=719628
Summary: Please build jtidy for EPEL 6
Product: Fedora
Version: rawhide
Platform: Unspecified
OS/Version: Unspecified
Status: NEW
Severity: unspecified
Priority: unspecified
Component: jtidy
AssignedTo: SpikeFedora(a)gmail.com
ReportedBy: redhat-bugzilla(a)linuxnetz.de
QAContact: extras-qa(a)fedoraproject.org
CC: dbhole(a)redhat.com, robert.scheck(a)etes.de,
SpikeFedora(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org
Classification: Fedora
Story Points: ---
Description of problem:
Please build jtidy from Fedora 15 for EPEL 6, because it is required to
build dom4j in EPEL 6.
Version-Release number of selected component (if applicable):
jtidy-1.0-0.10.20100930svn1125.fc15
Additional info:
Please let me know, if you just don't want to be the maintainer for the
jtidy EPEL 6 package...
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
6 years
[Bug 958727] New: plexus-utils: XMLWriterUtil should guard against problematic comments
by Red Hat Bugzilla
Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=958727
Bug ID: 958727
Summary: plexus-utils: XMLWriterUtil should guard against
problematic comments
Product: Fedora
Version: rawhide
Component: plexus-utils
Severity: unspecified
Priority: unspecified
Assignee: fnasser(a)redhat.com
Reporter: fweimer(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: fnasser(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com
Blocks: 958220
Category: ---
org.codehaus.plexus.util.xml#writeComment(XMLWriter, String, int, int, int)
does not check if the comment includes a "-->" sequence. This means that text
contained in the command string could be interpreted as XML, possibly leading
to XML injection issues, depending on how this method is being called.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=N5myzkUcYQ&a=cc_unsubscribe
7 years, 4 months
[Bug 958221] New: plexus-utils: directory traversal in org.codehaus.plexus.util.Expand
by Red Hat Bugzilla
Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=958221
Bug ID: 958221
Summary: plexus-utils: directory traversal in
org.codehaus.plexus.util.Expand
Product: Fedora
Version: rawhide
Component: plexus-utils
Severity: unspecified
Priority: unspecified
Assignee: fnasser(a)redhat.com
Reporter: fweimer(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: fnasser(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com
Blocks: 958220
Category: ---
org.codehaus.plexus.util.Expand does not guard against directory traversal, but
such protection is generally expected from unarchiving tools.
I think the class should just be deprecated and removed because there do not
appear to be any users left (not even a test case).
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=hp1lhU9LQd&a=cc_unsubscribe
7 years, 4 months
[Bug 753201] New: when javac is java-1.5.0-gcj ant seems to not be able to access environmental variables
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.
Summary: when javac is java-1.5.0-gcj ant seems to not be able to access environmental variables
https://bugzilla.redhat.com/show_bug.cgi?id=753201
Summary: when javac is java-1.5.0-gcj ant seems to not be able
to access environmental variables
Product: Fedora
Version: 15
Platform: Unspecified
OS/Version: Unspecified
Status: NEW
Severity: unspecified
Priority: unspecified
Component: ant
AssignedTo: pcheung(a)redhat.com
ReportedBy: caolanm(a)redhat.com
QAContact: extras-qa(a)fedoraproject.org
CC: pcheung(a)redhat.com, akurtako(a)redhat.com,
mmatejov(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org
Classification: Fedora
Story Points: ---
Type: ---
Created attachment 533096
--> https://bugzilla.redhat.com/attachment.cgi?id=533096
sample build.xml
Description of problem:
ant doesn't seem to be able to resolve environment variables (or something
clears the env) if the java in use is gcj rather than openjdk
Version-Release number of selected component (if applicable):
ant-1.8.2-3.fc15
How reproducible:
100%
Steps to Reproduce:
1. alternatives --set javac /usr/lib/jvm/java-1.6.0-openjdk.x86_64/bin/javac
2. ant -f build.xml gives the contents of $USERNAME as expected
3. alternatives --set javac /usr/lib/jvm/java-1.5.0-gcj/bin/javac
4. ant -f build.xml gives "${env.USERNAME}"
Actual results:
username
Expected results:
${env.USERNAME} string
Additional info:
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
8 years, 5 months