You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by "robinkarlberg (via GitHub)" <gi...@apache.org> on 2026/02/25 15:18:03 UTC
[PR] Fix RESTRICTED_TOKENS typo: " javax" (leading space) fails to prevent javax binding [cloudstack]
robinkarlberg opened a new pull request, #12709:
URL: https://github.com/apache/cloudstack/pull/12709
### Description
<!--- Describe your changes in DETAIL - And how has behaviour functionally changed. -->
`RESTRICTED_TOKENS` is used to blacklist tokens for the JavaScript engine, used for rules etc. However, I saw that one of the entries `" javax"` has an accidental space in it, it should most likely be `"javax"`.
As far as I understand, the typo does not lead to any security impact as the `--no-java` flag disables `javax` access, so that's why I'm creating an issue here on GitHub, and not a vulnerability disclosure. Consider this more of a little cleanup of the code.
<!-- For new features, provide link to FS, dev ML discussion etc. -->
<!-- In case of bug fix, the expected and actual behaviours, steps to reproduce. -->
<!-- When "Fixes: #<id>" is specified, the issue/PR will automatically be closed when this PR gets merged -->
<!-- For addressing multiple issues/PRs, use multiple "Fixes: #<id>" -->
<!-- Fixes: # -->
<!--- ******************************************************************************* -->
<!--- NOTE: AUTOMATION USES THE DESCRIPTIONS TO SET LABELS AND PRODUCE DOCUMENTATION. -->
<!--- PLEASE PUT AN 'X' in only **ONE** box -->
<!--- ******************************************************************************* -->
### Types of changes
- [ ] Breaking change (fix or feature that would cause existing functionality to change)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] Enhancement (improves an existing feature and functionality)
- [x] Cleanup (Code refactoring and cleanup, that may add test cases)
- [ ] Build/CI
- [ ] Test (unit or integration test code)
### How Has This Been Tested?
Test still pass.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix RESTRICTED_TOKENS typo: " javax" (leading space) fails to prevent javax binding [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #12709:
URL: https://github.com/apache/cloudstack/pull/12709#issuecomment-4835105465
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18412
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix RESTRICTED_TOKENS typo: " javax" (leading space) fails to prevent javax binding [cloudstack]
Posted by "winterhazel (via GitHub)" <gi...@apache.org>.
winterhazel merged PR #12709:
URL: https://github.com/apache/cloudstack/pull/12709
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix RESTRICTED_TOKENS typo: " javax" (leading space) fails to prevent javax binding [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #12709:
URL: https://github.com/apache/cloudstack/pull/12709#issuecomment-4834592696
@winterhazel a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix RESTRICTED_TOKENS typo: " javax" (leading space) fails to prevent javax binding [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on PR #12709:
URL: https://github.com/apache/cloudstack/pull/12709#issuecomment-4833611168
@GutoVeronezi @winterhazel , can you advise: not sure if we need testing for such a trivial change but also not what kind of testing would be applicable.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix RESTRICTED_TOKENS typo: " javax" (leading space) fails to prevent javax binding [cloudstack]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on PR #12709:
URL: https://github.com/apache/cloudstack/pull/12709#issuecomment-3960020649
Congratulations on your first Pull Request and welcome to the Apache CloudStack community! If you have any issues or are unsure about any anything please check our Contribution Guide (https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md)
Here are some useful points:
- In case of a new feature add useful documentation (raise doc PR at https://github.com/apache/cloudstack-documentation)
- Be patient and persistent. It might take some time to get a review or get the final approval from the committers.
- Pay attention to the quality of your code, ensure tests are passing and your PR doesn't have conflicts.
- Please follow [ASF Code of Conduct](https://github.com/apache/.github/blob/main/.github/CODE_OF_CONDUCT.md) for all communication including (but not limited to) comments on Pull Requests, Issues, Mailing list and Slack.
- Be sure to read the [CloudStack Coding Conventions](https://cwiki.apache.org/confluence/display/CLOUDSTACK/Coding+conventions).
Apache CloudStack is a community-driven project and together we are making it better 🚀.
In case of doubts contact the developers at:
Mailing List: dev@cloudstack.apache.org (https://cloudstack.apache.org/mailing-lists.html)
Slack: https://apachecloudstack.slack.com/
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix RESTRICTED_TOKENS typo: " javax" (leading space) fails to prevent javax binding [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #12709:
URL: https://github.com/apache/cloudstack/pull/12709#issuecomment-4834749430
> > @GutoVeronezi @winterhazel , can you advise: not sure if we need testing for such a trivial change but also not what kind of testing would be applicable.
>
> @DaanHoogland As this one is a fairly trivial change and there's no way to test it without changing the code to allow `javax` access, we can merge this one once the build finishes successfully.
since the code was added in commit https://github.com/robinkarlberg/cloudstack/commit/03a4b9f4fd33d69717e2a21e5963e5f26612df90
it would be nice if @shwstppr can review
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix RESTRICTED_TOKENS typo: " javax" (leading space) fails to prevent javax binding [cloudstack]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on PR #12709:
URL: https://github.com/apache/cloudstack/pull/12709#issuecomment-4837181588
Awesome work, congrats on your first merged pull request!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix RESTRICTED_TOKENS typo: " javax" (leading space) fails to prevent javax binding [cloudstack]
Posted by "robinkarlberg (via GitHub)" <gi...@apache.org>.
robinkarlberg commented on PR #12709:
URL: https://github.com/apache/cloudstack/pull/12709#issuecomment-4398682998
Hi, sorry I forgot about this issue. You can just merge here and it will go in 23 and up. I don't think it has to be in 4.20 as it's not very critical.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix RESTRICTED_TOKENS typo: " javax" (leading space) fails to prevent javax binding [cloudstack]
Posted by "winterhazel (via GitHub)" <gi...@apache.org>.
winterhazel commented on PR #12709:
URL: https://github.com/apache/cloudstack/pull/12709#issuecomment-4834584682
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix RESTRICTED_TOKENS typo: " javax" (leading space) fails to prevent javax binding [cloudstack]
Posted by "winterhazel (via GitHub)" <gi...@apache.org>.
winterhazel commented on PR #12709:
URL: https://github.com/apache/cloudstack/pull/12709#issuecomment-4834602087
> @GutoVeronezi @winterhazel , can you advise: not sure if we need testing for such a trivial change but also not what kind of testing would be applicable.
@DaanHoogland As this one is a fairly trivial change and there's no way to test it without changing the code to allow `javax` access, we can merge this one once the build finishes successfully.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix RESTRICTED_TOKENS typo: " javax" (leading space) fails to prevent javax binding [cloudstack]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #12709:
URL: https://github.com/apache/cloudstack/pull/12709#discussion_r3203235467
##########
utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/JsInterpreter.java:
##########
@@ -62,7 +62,7 @@ public class JsInterpreter implements Closeable {
protected Logger logger = LogManager.getLogger(JsInterpreter.class);
protected static final List<String> RESTRICTED_TOKENS = Arrays.asList( "engine", "context", "factory",
- "Java", "java", "Packages"," javax", "load", "loadWithNewGlobal", "print", "factory", "getClass",
+ "Java", "java", "Packages", "javax", "load", "loadWithNewGlobal", "print", "factory", "getClass",
"runCommand", "Runtime", "exec", "ProcessBuilder", "Thread", "thread", "Threads", "Class", "class");
Review Comment:
Consider adding a regression unit test for the restricted-token masking to cover the "javax" entry (e.g., assert that scripts cannot resolve/use `javax` because it is explicitly bound to null via ENGINE_SCOPE bindings). This would prevent reintroducing whitespace/typo issues in `RESTRICTED_TOKENS` and strengthen coverage for this security-hardening behavior.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org