svn commit: r1717058 - /ofbiz/trunk/build.xml

[jl...@apache.org]

Author: jleroux
Date: Sun Nov 29 13:08:27 2015
New Revision: 1717058

URL: http://svn.apache.org/viewvc?rev=1717058&view=rev
Log:
Temporary workaround which should be used by anyone responsible for OFBiz security until OFBIZ-6568 is fixed. To get the contrast-rO0.jar see https://github.com/Contrast-Security-OSS/contrast-rO0

Note that we are safe from an exploit using the commons collections see OFBIZ-6726. The demos will be using contrast-rO0.jar starting this night.

Modified:
    ofbiz/trunk/build.xml

Modified: ofbiz/trunk/build.xml
URL: http://svn.apache.org/viewvc/ofbiz/trunk/build.xml?rev=1717058&r1=1717057&r2=1717058&view=diff
==============================================================================
--- ofbiz/trunk/build.xml (original)
+++ ofbiz/trunk/build.xml Sun Nov 29 13:08:27 2015
@@ -593,6 +593,16 @@ under the License.
             <arg value="-portoffset=${portoffset}"/>
         </java>
     </target>
+    <target name="start-secure"
+            description="Start OFBiz same than start but pre-loading the contrast-rO0 lib (from OFBiz roo dir) to secure OFBiz from the deserialization issue">
+        <java jar="ofbiz.jar" fork="true">
+            <jvmarg value="${memory.initial.param}"/>
+            <jvmarg value="${memory.max.param}"/>
+            <jvmarg value="-javaagent:${ofbiz.home.dir}/contrast-rO0.jar"/>
+            <arg value="start"/>
+            <arg value="-portoffset=${portoffset}"/>
+        </java>
+    </target>
     <target name="start-batch"
             description="Start OFBiz as a separate process. Use -Dportoffset=portNumber to shift all ports with the portNumber value.">
         <java jar="ofbiz.jar" fork="true" spawn="true">