You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@myfaces.apache.org by we...@apache.org on 2021/05/06 11:37:06 UTC
[myfaces-tobago] branch TOBAGO-1999_Select2 updated (c53c9fe ->
2d31b3b)
This is an automated email from the ASF dual-hosted git repository.
weber pushed a change to branch TOBAGO-1999_Select2
in repository https://gitbox.apache.org/repos/asf/myfaces-tobago.git.
from c53c9fe build: CVE fix
new cd02ffd build: CVE fix
new 2d31b3b build: CVE fix
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
tobago-example/tobago-example-test/pom.xml | 57 ----------------------
.../tobago/example/test/TestPageFilter.java | 1 -
.../tobago/example/test/TomahawkInputHtml.java | 37 --------------
.../apache/myfaces/tobago/example/test/Upload.java | 12 ++---
.../src/main/webapp/WEB-INF/faces-config.xml | 6 ---
.../webapp/test/mediator/tomahawk-captcha.xhtml | 49 -------------------
.../webapp/test/mediator/tomahawk-inputHtml.xhtml | 50 -------------------
tobago-tool/tobago-theme-plugin/pom.xml | 20 +++++++-
8 files changed, 25 insertions(+), 207 deletions(-)
delete mode 100644 tobago-example/tobago-example-test/src/main/java/org/apache/myfaces/tobago/example/test/TomahawkInputHtml.java
delete mode 100644 tobago-example/tobago-example-test/src/main/webapp/test/mediator/tomahawk-captcha.xhtml
delete mode 100644 tobago-example/tobago-example-test/src/main/webapp/test/mediator/tomahawk-inputHtml.xhtml
[myfaces-tobago] 02/02: build: CVE fix
Posted by we...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
weber pushed a commit to branch TOBAGO-1999_Select2
in repository https://gitbox.apache.org/repos/asf/myfaces-tobago.git
commit 2d31b3bec243d3807b6b675cbb1e67f1e0372f7f
Author: Udo Schnurpfeil <ud...@irian.eu>
AuthorDate: Thu May 6 09:59:04 2021 +0200
build: CVE fix
* remove batik, because of CVE-2020-7791
* remove tomahawk, because it uses batik and is not crucial for tobago-example-test
* update upload test to standard, instead of commons-fileupload
---
tobago-example/tobago-example-test/pom.xml | 57 ----------------------
.../tobago/example/test/TestPageFilter.java | 1 -
.../tobago/example/test/TomahawkInputHtml.java | 37 --------------
.../apache/myfaces/tobago/example/test/Upload.java | 12 ++---
.../src/main/webapp/WEB-INF/faces-config.xml | 6 ---
.../webapp/test/mediator/tomahawk-captcha.xhtml | 49 -------------------
.../webapp/test/mediator/tomahawk-inputHtml.xhtml | 50 -------------------
7 files changed, 6 insertions(+), 206 deletions(-)
diff --git a/tobago-example/tobago-example-test/pom.xml b/tobago-example/tobago-example-test/pom.xml
index 4ad7c8d..04d449a 100644
--- a/tobago-example/tobago-example-test/pom.xml
+++ b/tobago-example/tobago-example-test/pom.xml
@@ -116,63 +116,6 @@
<version>${project.version}</version>
</dependency>
<dependency>
- <groupId>org.apache.myfaces.tomahawk</groupId>
- <artifactId>tomahawk20</artifactId>
- <version>1.1.13</version>
- <exclusions>
- <exclusion>
- <groupId>javax.servlet</groupId>
- <artifactId>jstl</artifactId>
- </exclusion>
- <!-- BEGIN exclude some tomahawk20 dependencies -->
- <exclusion>
- <groupId>batik</groupId>
- <artifactId>batik-awt-util</artifactId>
- </exclusion>
- <exclusion>
- <groupId>batik</groupId>
- <artifactId>batik-gui-util</artifactId>
- </exclusion>
- <exclusion>
- <groupId>batik</groupId>
- <artifactId>batik-util</artifactId>
- </exclusion>
- <exclusion>
- <groupId>commons-validator</groupId>
- <artifactId>commons-validator</artifactId>
- </exclusion>
- <!-- END exclude some tomahawk20 dependencies -->
- </exclusions>
- </dependency>
- <!-- BEGIN replace tomahawk20 excluded dependencies -->
- <dependency>
- <groupId>org.apache.xmlgraphics</groupId>
- <artifactId>batik-awt-util</artifactId>
- <version>1.14</version>
- </dependency>
- <dependency>
- <groupId>org.apache.xmlgraphics</groupId>
- <artifactId>batik-gui-util</artifactId>
- <version>1.14</version>
- </dependency>
- <dependency>
- <groupId>org.apache.xmlgraphics</groupId>
- <artifactId>batik-util</artifactId>
- <version>1.14</version>
- </dependency>
- <!-- overrides the tomahawk version -->
- <dependency>
- <groupId>commons-fileupload</groupId>
- <artifactId>commons-fileupload</artifactId>
- <version>1.3.3</version>
- </dependency>
- <dependency>
- <groupId>commons-validator</groupId>
- <artifactId>commons-validator</artifactId>
- <version>1.5.0</version>
- </dependency>
- <!-- END replace tomahawk20 excluded dependencies -->
- <dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
</dependency>
diff --git a/tobago-example/tobago-example-test/src/main/java/org/apache/myfaces/tobago/example/test/TestPageFilter.java b/tobago-example/tobago-example-test/src/main/java/org/apache/myfaces/tobago/example/test/TestPageFilter.java
index 8afdc38..761efa6 100644
--- a/tobago-example/tobago-example-test/src/main/java/org/apache/myfaces/tobago/example/test/TestPageFilter.java
+++ b/tobago-example/tobago-example-test/src/main/java/org/apache/myfaces/tobago/example/test/TestPageFilter.java
@@ -87,7 +87,6 @@ public class TestPageFilter {
"/test/gridLayout/scrolling-2-levels.*", // todo: ?
"/test/gridLayout/scrolling-tab.*", // todo: measurement problem with firefox?
"/test/gridLayout/transparent-for-layout.jspx", // uses facelets templates
- "/test/mediator/tomahawk-inputHtml.*", // todo
"/test/treeListbox/*", // todo
"/test/label/label-tx.xhtml", // todo see TOBAGO-993
"/tf/.*", // TBD
diff --git a/tobago-example/tobago-example-test/src/main/java/org/apache/myfaces/tobago/example/test/TomahawkInputHtml.java b/tobago-example/tobago-example-test/src/main/java/org/apache/myfaces/tobago/example/test/TomahawkInputHtml.java
deleted file mode 100644
index f97b846..0000000
--- a/tobago-example/tobago-example-test/src/main/java/org/apache/myfaces/tobago/example/test/TomahawkInputHtml.java
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.myfaces.tobago.example.test;
-
-import java.io.Serializable;
-
-public class TomahawkInputHtml implements Serializable {
-
- private String inputHtml =
- "<html><body>Hallo <b>Tomahawk</b><br/>not working yet: "
- + "javascript errors, submit will not be sent.</body></html>";
-
- public void setInputHtml(final String inputHtml) {
- this.inputHtml = inputHtml;
- }
-
- public String getInputHtml() {
- return inputHtml;
- }
-}
diff --git a/tobago-example/tobago-example-test/src/main/java/org/apache/myfaces/tobago/example/test/Upload.java b/tobago-example/tobago-example-test/src/main/java/org/apache/myfaces/tobago/example/test/Upload.java
index 1fa21b7..d443d3e 100644
--- a/tobago-example/tobago-example-test/src/main/java/org/apache/myfaces/tobago/example/test/Upload.java
+++ b/tobago-example/tobago-example-test/src/main/java/org/apache/myfaces/tobago/example/test/Upload.java
@@ -19,19 +19,19 @@
package org.apache.myfaces.tobago.example.test;
-import org.apache.commons.fileupload.FileItem;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import javax.faces.application.FacesMessage;
import javax.faces.context.FacesContext;
+import javax.servlet.http.Part;
import java.io.Serializable;
public class Upload implements Serializable {
private static final Logger LOG = LoggerFactory.getLogger(Upload.class);
- private FileItem file;
+ private Part file;
private String result;
@@ -42,16 +42,16 @@ public class Upload implements Serializable {
null, new FacesMessage(FacesMessage.SEVERITY_ERROR, "No UploadItem found!", null));
return null;
}
- result = "type='" + file.getContentType() + "' size='" + file.get().length + "' name='" + file.getName() + "'";
+ result = "type='" + file.getContentType() + "' size='" + file.getSize() + "' name='" + file.getName() + "'";
LOG.info(result);
return "/test/file/file.xhtml";
}
-
- public FileItem getFile() {
+
+ public Part getFile() {
return file;
}
- public void setFile(final FileItem file) {
+ public void setFile(final Part file) {
this.file = file;
}
diff --git a/tobago-example/tobago-example-test/src/main/webapp/WEB-INF/faces-config.xml b/tobago-example/tobago-example-test/src/main/webapp/WEB-INF/faces-config.xml
index a1de545..1b28fc7 100644
--- a/tobago-example/tobago-example-test/src/main/webapp/WEB-INF/faces-config.xml
+++ b/tobago-example/tobago-example-test/src/main/webapp/WEB-INF/faces-config.xml
@@ -111,12 +111,6 @@
</managed-bean>
<managed-bean>
- <managed-bean-name>tomahawkInputHtml</managed-bean-name>
- <managed-bean-class>org.apache.myfaces.tobago.example.test.TomahawkInputHtml</managed-bean-class>
- <managed-bean-scope>session</managed-bean-scope>
- </managed-bean>
-
- <managed-bean>
<managed-bean-name>sheet</managed-bean-name>
<managed-bean-class>org.apache.myfaces.tobago.example.test.SheetController</managed-bean-class>
<managed-bean-scope>session</managed-bean-scope>
diff --git a/tobago-example/tobago-example-test/src/main/webapp/test/mediator/tomahawk-captcha.xhtml b/tobago-example/tobago-example-test/src/main/webapp/test/mediator/tomahawk-captcha.xhtml
deleted file mode 100644
index c1531a9..0000000
--- a/tobago-example/tobago-example-test/src/main/webapp/test/mediator/tomahawk-captcha.xhtml
+++ /dev/null
@@ -1,49 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
--->
-
-<f:view
- xmlns:tc="http://myfaces.apache.org/tobago/component"
- xmlns:tx="http://myfaces.apache.org/tobago/extension"
- xmlns:ui="http://java.sun.com/jsf/facelets"
- xmlns:f="http://java.sun.com/jsf/core"
- xmlns:tomahawk="http://myfaces.apache.org/tomahawk">
-
- <tc:page id="page">
- <tc:gridLayoutConstraint width="600px" height="300px"/>
- <f:facet name="layout">
- <tc:gridLayout columns="*;*" rows="*;2*"/>
- </f:facet>
-
- <tc:mediator var="mediator">
- <tomahawk:captcha captchaSessionKeyName="captcha"
- imageHeight="#{mediator.height}" imageWidth="#{mediator.width}"/>
- </tc:mediator>
- <tc:panel/>
-
- <tc:mediator var="mediator">
- <tc:gridLayoutConstraint columnSpan="2"/>
- <tomahawk:captcha captchaSessionKeyName="captcha"
- imageHeight="#{mediator.height}" imageWidth="#{mediator.width}"/>
- </tc:mediator>
-
- <tx:in label="Last Value" value="#{sessionScope.captcha}">
- <tc:gridLayoutConstraint columnSpan="2"/>
- </tx:in>
-
- </tc:page>
-</f:view>
diff --git a/tobago-example/tobago-example-test/src/main/webapp/test/mediator/tomahawk-inputHtml.xhtml b/tobago-example/tobago-example-test/src/main/webapp/test/mediator/tomahawk-inputHtml.xhtml
deleted file mode 100644
index a7d96f9..0000000
--- a/tobago-example/tobago-example-test/src/main/webapp/test/mediator/tomahawk-inputHtml.xhtml
+++ /dev/null
@@ -1,50 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
--->
-
-<f:view
- xmlns:tc="http://myfaces.apache.org/tobago/component"
- xmlns:tx="http://myfaces.apache.org/tobago/extension"
- xmlns:ui="http://java.sun.com/jsf/facelets"
- xmlns:f="http://java.sun.com/jsf/core"
- xmlns:tomahawk="http://myfaces.apache.org/tomahawk">
-
- <tc:page id="page">
- <tc:gridLayoutConstraint width="600px" height="300px"/>
- <f:facet name="layout">
- <tc:gridLayout columns="*;3*" rows="50px;*;auto"/>
- </f:facet>
-
-
- <tc:textarea value="Header">
- <tc:gridLayoutConstraint columnSpan="2"/>
- </tc:textarea>
-
- <tc:textarea value="Navigation">
- <tc:gridLayoutConstraint rowSpan="2"/>
- </tc:textarea>
-
- <tc:mediator>
- <tomahawk:inputHtml value="#{tomahawkInputHtml.inputHtml}"/>
- </tc:mediator>
-
- <tc:panel>
- <tc:button label="Submit"/>
- </tc:panel>
-
- </tc:page>
-</f:view>
[myfaces-tobago] 01/02: build: CVE fix
Posted by we...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
weber pushed a commit to branch TOBAGO-1999_Select2
in repository https://gitbox.apache.org/repos/asf/myfaces-tobago.git
commit cd02ffdb8e12495fcec6453f1b1264629192edcd
Author: Udo Schnurpfeil <ud...@irian.eu>
AuthorDate: Thu May 6 08:44:17 2021 +0200
build: CVE fix
* define maven-core version (because of CVE-2021-26291)
* define guava version (because of CVE-2020-8908)
---
tobago-tool/tobago-theme-plugin/pom.xml | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/tobago-tool/tobago-theme-plugin/pom.xml b/tobago-tool/tobago-theme-plugin/pom.xml
index d86a362..ecd33fd 100644
--- a/tobago-tool/tobago-theme-plugin/pom.xml
+++ b/tobago-tool/tobago-theme-plugin/pom.xml
@@ -51,7 +51,7 @@
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-archiver</artifactId>
- <version>3.5.0</version>
+ <version>3.5.1</version>
</dependency>
<dependency>
<groupId>org.codehaus.plexus</groupId>
@@ -69,6 +69,24 @@
<version>1.5.3</version>
</dependency>
</dependencies>
+ <dependencyManagement>
+ <dependencies>
+ <!-- maven-core is a dependency of maven-archiver (set explicitly, because of
+ setting the version, because of CVE-2021-26291) -->
+ <dependency>
+ <groupId>org.apache.maven</groupId>
+ <artifactId>maven-core</artifactId>
+ <version>3.8.1</version>
+ </dependency>
+ <!-- guava is a dependency of maven-core (set explicitly, because of
+ setting the version, because of CVE-2020-8908) -->
+ <dependency>
+ <groupId>com.google.guava</groupId>
+ <artifactId>guava</artifactId>
+ <version>30.1.1-android</version>
+ </dependency>
+ </dependencies>
+ </dependencyManagement>
<build>
<pluginManagement>
<plugins>