java-sig-commits April 2014

java-sig-commits@lists.fedoraproject.org

15 participants
848 discussions

[Bug 977249] New: htmlcleaner-2.5 is available
by Red Hat Bugzilla 24 Apr '18

24 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=977249 Bug ID: 977249 Summary: htmlcleaner-2.5 is available Product: Fedora Version: rawhide Component: htmlcleaner Keywords: FutureFeature, Triaged Severity: unspecified Priority: unspecified Assignee: Marcin.Dulak(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: bjoern.esser(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, Marcin.Dulak(a)gmail.com Latest upstream release: 2.5 Current version/release in Fedora Rawhide: 2.2.1-2.fc20 URL: http://sourceforge.net/api/file/index/project-name/htmlcleaner/mtime/desc/l… Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=B0wPSZFa2g&a=cc_unsubscribe

2 46

[Bug 958733] New: plexus-utils: suspicious shell quoting in org.codehaus.plexus.util.cli
by Red Hat Bugzilla 09 Jan '18

09 Jan '18

Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=958733 Bug ID: 958733 Summary: plexus-utils: suspicious shell quoting in org.codehaus.plexus.util.cli Product: Fedora Version: 18 Component: plexus-utils Severity: unspecified Priority: unspecified Assignee: fnasser(a)redhat.com Reporter: fweimer(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: fnasser(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Blocks: 958220 Category: --- The shell quoting logic in this package (and the org.codehaus.plexus.util.cli.shell) package looks fairly dangerous. It appears to be mostly dead code. Client code should be migrated to java.lang.ProcessBuilder. The different quoting options (single quotes, double quotes) are difficult to get right, and the reference to StringUtils is not particularly helpful because the caller has to provide the correct set of characters to be escaped, which is platform-dependent. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=JhGrfK5sg6&a=cc_unsubscribe

2 10

[Bug 719628] New: Please build jtidy for EPEL 6
by Red Hat Bugzilla 14 Sep '17

14 Sep '17

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. Summary: Please build jtidy for EPEL 6 https://bugzilla.redhat.com/show_bug.cgi?id=719628 Summary: Please build jtidy for EPEL 6 Product: Fedora Version: rawhide Platform: Unspecified OS/Version: Unspecified Status: NEW Severity: unspecified Priority: unspecified Component: jtidy AssignedTo: SpikeFedora(a)gmail.com ReportedBy: redhat-bugzilla(a)linuxnetz.de QAContact: extras-qa(a)fedoraproject.org CC: dbhole(a)redhat.com, robert.scheck(a)etes.de, SpikeFedora(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org Classification: Fedora Story Points: --- Description of problem: Please build jtidy from Fedora 15 for EPEL 6, because it is required to build dom4j in EPEL 6. Version-Release number of selected component (if applicable): jtidy-1.0-0.10.20100930svn1125.fc15 Additional info: Please let me know, if you just don't want to be the maintainer for the jtidy EPEL 6 package... -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

2 2

[Bug 998208] New: maven-remote-resources-plugin-1.5 is available
by Red Hat Bugzilla 12 Sep '17

12 Sep '17

https://bugzilla.redhat.com/show_bug.cgi?id=998208 Bug ID: 998208 Summary: maven-remote-resources-plugin-1.5 is available Product: Fedora Version: rawhide Component: maven-remote-resources-plugin Keywords: FutureFeature, Triaged Assignee: huwang(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: huwang(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, sochotni(a)redhat.com, tradej(a)redhat.com Latest upstream release: 1.5 Current version/release in Fedora Rawhide: 1.4-5.fc20 URL: http://repo1.maven.org/maven2/org/apache/maven/plugins/maven-remote-resourc… Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=IznNz4aeJt&a=cc_unsubscribe

2 3

[Bug 998251] New: activemq 5.8.0 is available
by Red Hat Bugzilla 27 Aug '16

27 Aug '16

https://bugzilla.redhat.com/show_bug.cgi?id=998251 Bug ID: 998251 Summary: activemq 5.8.0 is available Product: Fedora Version: rawhide Component: activemq Assignee: mspaulding06(a)gmail.com Reporter: puntogil(a)libero.it QA Contact: extras-qa(a)fedoraproject.org CC: agrimm(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, mspaulding06(a)gmail.com, tdawson(a)redhat.com Created attachment 787792 --> https://bugzilla.redhat.com/attachment.cgi?id=787792&action=edit update to 5.8.0 Upstream released activemq 5.8.0. Currently, we still have version 5.6.0 in Rawhide. Please consider updating, patch is attached. changes in spaec file - update to 5.8.0 - built with XMvn - adapt to current guideline - obsoletes activemq-core activemq-kahadb - built new modules: ° amq-store, broker, console, jdbc-store, ° log4j-appender, mqtt, openwire-generator, ° openwire-legacy, pool, ra, tooling (ra module is required by Apache OpenEJB/Tomee 4.5.1) - fix for CVE-2013-1879 (PATCH0) - fix for rhbz#991956 NOTE some features cannot be avalaible, cause: require com.thoughtworks.xstream:xstream:1.4.4 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=AN1TJhSLSq&a=cc_unsubscribe

1 42

[Bug 919544] New: maven-changes-plugin-2.9 is available
by Red Hat Bugzilla 27 Aug '16

27 Aug '16

Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=919544 Bug ID: 919544 Summary: maven-changes-plugin-2.9 is available Product: Fedora Version: rawhide Component: maven-changes-plugin Keywords: FutureFeature, Triaged Severity: unspecified Priority: unspecified Reporter: upstream-release-monitoring(a)fedoraproject.org Latest upstream release: 2.9 Current version in Fedora Rawhide: 2.8 URL: http://repo2.maven.org/maven2/org/apache/maven/plugins/maven-changes-plugin/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=sDYMSa0kpl&a=cc_unsubscribe

1 13

[Bug 988977] New: apache-rat tests fail to build
by Red Hat Bugzilla 19 Jul '16

19 Jul '16

https://bugzilla.redhat.com/show_bug.cgi?id=988977 Bug ID: 988977 Summary: apache-rat tests fail to build Product: Fedora Version: 19 Component: maven Severity: medium Assignee: sochotni(a)redhat.com Reporter: orion(a)cora.nwra.com QA Contact: extras-qa(a)fedoraproject.org CC: akurtako(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com, sochotni(a)redhat.com, tradej(a)redhat.com Description of problem: This the previous issue with building tests seems to have been addressed, I trying again but it is failing in a different way: [INFO] RAT Maven Plugin .................................. FAILURE [10.011s] [INFO] RAT Ant Tasks ..................................... SKIPPED [INFO] RAT Application ................................... SKIPPED [INFO] ------------------------------------------------------------------------ [INFO] BUILD FAILURE [INFO] ------------------------------------------------------------------------ [INFO] Total time: 19.363s [INFO] Finished at: Fri Jul 26 14:02:13 MDT 2013 [INFO] Final Memory: 36M/201M [INFO] ------------------------------------------------------------------------ [ERROR] Failed to execute goal org.apache.maven.plugins:maven-surefire-plugin:2.15:test (default-test) on project apache-rat-plugin: Execution default-test of goal org.apache.maven.plugins:maven-surefire-plugin:2.15:test failed: There was an error in the forked process [ERROR] java.lang.NoClassDefFoundError: org/sonatype/aether/RepositorySystemSession [ERROR] at java.lang.Class.getDeclaredMethods0(Native Method) [ERROR] at java.lang.Class.privateGetDeclaredMethods(Class.java:2521) [ERROR] at java.lang.Class.getMethod0(Class.java:2764) [ERROR] at java.lang.Class.getMethod(Class.java:1653) [ERROR] at org.apache.maven.surefire.common.junit3.JUnit3Reflector.createInstanceFromSuiteMethod(JUnit3Reflector.java:152) [ERROR] at org.apache.maven.surefire.common.junit3.JUnit3Reflector.constructTestObject(JUnit3Reflector.java:121) [ERROR] at org.apache.maven.surefire.junit.JUnitTestSet.execute(JUnitTestSet.java:70) [ERROR] at org.apache.maven.surefire.junit.JUnit3Provider.executeTestSet(JUnit3Provider.java:131) [ERROR] at org.apache.maven.surefire.junit.JUnit3Provider.invoke(JUnit3Provider.java:108) [ERROR] at org.apache.maven.surefire.booter.ForkedBooter.invokeProviderInSameClassLoader(ForkedBooter.java:200) [ERROR] at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:153) [ERROR] at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:103) [ERROR] Caused by: java.lang.ClassNotFoundException: org.sonatype.aether.RepositorySystemSession [ERROR] at java.net.URLClassLoader$1.run(URLClassLoader.java:366) [ERROR] at java.net.URLClassLoader$1.run(URLClassLoader.java:355) [ERROR] at java.security.AccessController.doPrivileged(Native Method) [ERROR] at java.net.URLClassLoader.findClass(URLClassLoader.java:354) [ERROR] at java.lang.ClassLoader.loadClass(ClassLoader.java:424) [ERROR] at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:308) [ERROR] at java.lang.ClassLoader.loadClass(ClassLoader.java:357) [ERROR] ... 12 more [ERROR] -> [Help 1] org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal org.apache.maven.plugins:maven-surefire-plugin:2.15:test (default-test) on project apache-rat-plugin: Execution default-test of goal org.apache.maven.plugins:maven-surefire-plugin:2.15:test failed: There was an error in the forked process java.lang.NoClassDefFoundError: org/sonatype/aether/RepositorySystemSession at java.lang.Class.getDeclaredMethods0(Native Method) at java.lang.Class.privateGetDeclaredMethods(Class.java:2521) at java.lang.Class.getMethod0(Class.java:2764) at java.lang.Class.getMethod(Class.java:1653) at org.apache.maven.surefire.common.junit3.JUnit3Reflector.createInstanceFromSuiteMethod(JUnit3Reflector.java:152) at org.apache.maven.surefire.common.junit3.JUnit3Reflector.constructTestObject(JUnit3Reflector.java:121) at org.apache.maven.surefire.junit.JUnitTestSet.execute(JUnitTestSet.java:70) at org.apache.maven.surefire.junit.JUnit3Provider.executeTestSet(JUnit3Provider.java:131) at org.apache.maven.surefire.junit.JUnit3Provider.invoke(JUnit3Provider.java:108) at org.apache.maven.surefire.booter.ForkedBooter.invokeProviderInSameClassLoader(ForkedBooter.java:200) at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:153) at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:103) Caused by: java.lang.ClassNotFoundException: org.sonatype.aether.RepositorySystemSession at java.net.URLClassLoader$1.run(URLClassLoader.java:366) at java.net.URLClassLoader$1.run(URLClassLoader.java:355) at java.security.AccessController.doPrivileged(Native Method) at java.net.URLClassLoader.findClass(URLClassLoader.java:354) at java.lang.ClassLoader.loadClass(ClassLoader.java:424) at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:308) at java.lang.ClassLoader.loadClass(ClassLoader.java:357) ... 12 more at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:224) at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:153) at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:145) at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:84) at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:59) at org.apache.maven.lifecycle.internal.LifecycleStarter.singleThreadedBuild(LifecycleStarter.java:183) at org.apache.maven.lifecycle.internal.LifecycleStarter.execute(LifecycleStarter.java:161) at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:318) at org.apache.maven.DefaultMaven.execute(DefaultMaven.java:153) at org.apache.maven.cli.MavenCli.execute(MavenCli.java:555) at org.apache.maven.cli.MavenCli.doMain(MavenCli.java:214) at org.apache.maven.cli.MavenCli.main(MavenCli.java:158) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:606) at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced(Launcher.java:290) at org.codehaus.plexus.classworlds.launcher.Launcher.launch(Launcher.java:230) at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode(Launcher.java:414) at org.codehaus.plexus.classworlds.launcher.Launcher.main(Launcher.java:357) Caused by: org.apache.maven.plugin.PluginExecutionException: Execution default-test of goal org.apache.maven.plugins:maven-surefire-plugin:2.15:test failed: There was an error in the forked process java.lang.NoClassDefFoundError: at java.lang.Class.getDeclaredMethods0(Native Method) at java.lang.Class.privateGetDeclaredMethods(Class.java:2521) at java.lang.Class.getMethod0(Class.java:2764) at java.lang.Class.getMethod(Class.java:1653) at org.apache.maven.surefire.common.junit3.JUnit3Reflector.createInstanceFromSuiteMethod(JUnit3Reflector.java:152) at org.apache.maven.surefire.common.junit3.JUnit3Reflector.constructTestObject(JUnit3Reflector.java:121) at org.apache.maven.surefire.junit.JUnitTestSet.execute(JUnitTestSet.java:70) at org.apache.maven.surefire.junit.JUnit3Provider.executeTestSet(JUnit3Provider.java:131) at org.apache.maven.surefire.junit.JUnit3Provider.invoke(JUnit3Provider.java:108) at org.apache.maven.surefire.booter.ForkedBooter.invokeProviderInSameClassLoader(ForkedBooter.java:200) at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:153) at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:103) Caused by: java.lang.ClassNotFoundException: org.sonatype.aether.RepositorySystemSession at java.net.URLClassLoader$1.run(URLClassLoader.java:366) at java.net.URLClassLoader$1.run(URLClassLoader.java:355) at java.security.AccessController.doPrivileged(Native Method) at java.net.URLClassLoader.findClass(URLClassLoader.java:354) at java.lang.ClassLoader.loadClass(ClassLoader.java:424) at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:308) at java.lang.ClassLoader.loadClass(ClassLoader.java:357) ... 12 more at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:115) at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:208) ... 19 more Caused by: java.lang.RuntimeException: There was an error in the forked process java.lang.NoClassDefFoundError: org/sonatype/aether/RepositorySystemSession at java.lang.Class.getDeclaredMethods0(Native Method) at java.lang.Class.privateGetDeclaredMethods(Class.java:2521) at java.lang.Class.getMethod0(Class.java:2764) at java.lang.Class.getMethod(Class.java:1653) at org.apache.maven.surefire.common.junit3.JUnit3Reflector.createInstanceFromSuiteMethod(JUnit3Reflector.java:152) at org.apache.maven.surefire.common.junit3.JUnit3Reflector.constructTestObject(JUnit3Reflector.java:121) at org.apache.maven.surefire.junit.JUnitTestSet.execute(JUnitTestSet.java:70) at org.apache.maven.surefire.junit.JUnit3Provider.executeTestSet(JUnit3Provider.java:131) at org.apache.maven.surefire.junit.JUnit3Provider.invoke(JUnit3Provider.java:108) at org.apache.maven.surefire.booter.ForkedBooter.invokeProviderInSameClassLoader(ForkedBooter.java:200) at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:153) at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:103) Caused by: java.lang.ClassNotFoundException: org.sonatype.aether.RepositorySystemSession at java.net.URLClassLoader$1.run(URLClassLoader.java:366) at java.net.URLClassLoader$1.run(URLClassLoader.java:355) at java.security.AccessController.doPrivileged(Native Method) at java.net.URLClassLoader.findClass(URLClassLoader.java:354) at java.lang.ClassLoader.loadClass(ClassLoader.java:424) at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:308) at java.lang.ClassLoader.loadClass(ClassLoader.java:357) ... 12 more at org.apache.maven.plugin.surefire.booterclient.ForkStarter.fork(ForkStarter.java:479) at org.apache.maven.plugin.surefire.booterclient.ForkStarter.fork(ForkStarter.java:352) at org.apache.maven.plugin.surefire.booterclient.ForkStarter.run(ForkStarter.java:158) at org.apache.maven.plugin.surefire.AbstractSurefireMojo.executeProvider(AbstractSurefireMojo.java:883) at org.apache.maven.plugin.surefire.AbstractSurefireMojo.executeAfterPreconditionsChecked(AbstractSurefireMojo.java:747) at org.apache.maven.plugin.surefire.AbstractSurefireMojo.execute(AbstractSurefireMojo.java:645) at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:106) ... 20 more [ERROR] [ERROR] [ERROR] For more information about the errors and possible solutions, please read the following articles: [ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/PluginExecutionException Version-Release number of selected component (if applicable): maven-3.1.0-2.fc20.noarch org/sonatype/aether/RepositorySystemSession seems to be in aether-api.jar which is installed. Perhaps maven-surefire isn't expressing its dependencies correctly? -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=H63xmZZ3Nz&a=cc_unsubscribe

1 18

[Bug 1013603] New: jspc: Maven metadata is installed incorrectly
by Red Hat Bugzilla 19 Jul '16

19 Jul '16

https://bugzilla.redhat.com/show_bug.cgi?id=1013603 Bug ID: 1013603 Summary: jspc: Maven metadata is installed incorrectly Product: Fedora Version: rawhide Component: jspc Assignee: pmackinn(a)redhat.com Reporter: mizdebsk(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, pmackinn(a)redhat.com Description of problem: jspc package installs the same Maven metadata in more than one package. This results in incorrect package provides. Version-Release number of selected component (if applicable): 2.0-0.7.alpha.3 Steps to Reproduce: 1. Look at package provides Actual results: mvn(org.codehaus.mojo.jspc:jspc): jspc: package version: 2.0 provided version: 2.0-alpha-3 jspc-compiler-tomcat6 (jspc): package version: 2.0 provided version: 2.0-alpha-3 jspc-compilers (jspc): package version: 2.0 provided version: 2.0-alpha-3 jspc-maven-plugin (jspc): package version: 2.0 provided version: 2.0-alpha-3 mvn(org.codehaus.mojo.jspc:jspc-compiler-api): jspc: package version: 2.0 provided version: 2.0-alpha-3 jspc-compiler-tomcat6 (jspc): package version: 2.0 provided version: 2.0-alpha-3 jspc-compilers (jspc): package version: 2.0 provided version: 2.0-alpha-3 jspc-maven-plugin (jspc): package version: 2.0 provided version: 2.0-alpha-3 mvn(org.codehaus.mojo.jspc:jspc-compiler-tomcat6): jspc: package version: 2.0 provided version: 2.0-alpha-3 jspc-compiler-tomcat6 (jspc): package version: 2.0 provided version: 2.0-alpha-3 jspc-compilers (jspc): package version: 2.0 provided version: 2.0-alpha-3 jspc-maven-plugin (jspc): package version: 2.0 provided version: 2.0-alpha-3 mvn(org.codehaus.mojo.jspc:jspc-compilers): jspc: package version: 2.0 provided version: 2.0-alpha-3 jspc-compiler-tomcat6 (jspc): package version: 2.0 provided version: 2.0-alpha-3 jspc-compilers (jspc): package version: 2.0 provided version: 2.0-alpha-3 jspc-maven-plugin (jspc): package version: 2.0 provided version: 2.0-alpha-3 mvn(org.codehaus.mojo.jspc:jspc-maven-plugin): jspc: package version: 2.0 provided version: 2.0-alpha-3 jspc-compiler-tomcat6 (jspc): package version: 2.0 provided version: 2.0-alpha-3 jspc-compilers (jspc): package version: 2.0 provided version: 2.0-alpha-3 jspc-maven-plugin (jspc): package version: 2.0 provided version: 2.0-alpha-3 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Oals1syJlT&a=cc_unsubscribe

1 2

[Bug 958047] New: woodstox-core: javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING not supported
by Red Hat Bugzilla 19 Jul '16

19 Jul '16

Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=958047 Bug ID: 958047 Summary: woodstox-core: javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING not supported Product: Fedora Version: rawhide Component: woodstox-core Severity: unspecified Priority: unspecified Assignee: jcapik(a)redhat.com Reporter: fweimer(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, jcapik(a)redhat.com, mizdebsk(a)redhat.com Blocks: 958046 Category: --- This doesn't work: SAXParserFactory factory = new WstxSAXParserFactory(); factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); SAXParser parser = factory.newSAXParser(); InputSource is = new InputSource(new FileInputStream(args[0])); parser.parse(is, new DefaultHandler()); It results in: Exception in thread "main" org.xml.sax.SAXNotRecognizedException: Feature 'http://javax.xml.XMLConstants/feature/secure-processing' not recognized As a result, it appears impossible to defend against "billion laughs"-style denial of service attacks, along the lines of: https://git.fedorahosted.org/cgit/secure-coding.git/tree/defensive-coding/s… https://git.fedorahosted.org/cgit/secure-coding.git/tree/defensive-coding/s… -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=bPCdHpPVN2&a=cc_unsubscribe

1 4

[Bug 958727] New: plexus-utils: XMLWriterUtil should guard against problematic comments
by Red Hat Bugzilla 08 May '16

08 May '16

Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=958727 Bug ID: 958727 Summary: plexus-utils: XMLWriterUtil should guard against problematic comments Product: Fedora Version: rawhide Component: plexus-utils Severity: unspecified Priority: unspecified Assignee: fnasser(a)redhat.com Reporter: fweimer(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: fnasser(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Blocks: 958220 Category: --- org.codehaus.plexus.util.xml#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a "-->" sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=N5myzkUcYQ&a=cc_unsubscribe

1 6

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits April 2014