You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@shiro.apache.org by GitBox <gi...@apache.org> on 2020/03/27 08:47:27 UTC
[GitHub] [shiro] fpapon opened a new pull request #206: Remove unused and
unsecure XMLSerializer
fpapon opened a new pull request #206: Remove unused and unsecure XMLSerializer
URL: https://github.com/apache/shiro/pull/206
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [shiro] fpapon commented on issue #206: Remove unused and unsecure
XMLSerializer
Posted by GitBox <gi...@apache.org>.
fpapon commented on issue #206: Remove unused and unsecure XMLSerializer
URL: https://github.com/apache/shiro/pull/206#issuecomment-604974052
@bmhm yes I saw the error on Jenkins, I'm checking
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [shiro] fpapon commented on issue #206: Deprecate unsecure
XMLSerializer
Posted by GitBox <gi...@apache.org>.
fpapon commented on issue #206: Deprecate unsecure XMLSerializer
URL: https://github.com/apache/shiro/pull/206#issuecomment-612049734
@bdemers done
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [shiro] fpapon commented on issue #206: Remove unused and unsecure
XMLSerializer
Posted by GitBox <gi...@apache.org>.
fpapon commented on issue #206: Remove unused and unsecure XMLSerializer
URL: https://github.com/apache/shiro/pull/206#issuecomment-604991715
@coheigea it make sense
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [shiro] coheigea removed a comment on issue #206: Remove unused and
unsecure XMLSerializer
Posted by GitBox <gi...@apache.org>.
coheigea removed a comment on issue #206: Remove unused and unsecure XMLSerializer
URL: https://github.com/apache/shiro/pull/206#issuecomment-604986557
Maybe we could log a WARNING saying that it's insecure to use and just remove it for the next major release?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [shiro] bdemers commented on issue #206: Remove unused and unsecure
XMLSerializer
Posted by GitBox <gi...@apache.org>.
bdemers commented on issue #206: Remove unused and unsecure XMLSerializer
URL: https://github.com/apache/shiro/pull/206#issuecomment-604984552
It could be use by an ini configured RemeberMeManager. We should just deprecate it.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [shiro] fpapon commented on issue #206: Deprecate unsecure
XMLSerializer
Posted by GitBox <gi...@apache.org>.
fpapon commented on issue #206: Deprecate unsecure XMLSerializer
URL: https://github.com/apache/shiro/pull/206#issuecomment-612091516
retest this please
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [shiro] fpapon commented on issue #206: Remove unused and unsecure
XMLSerializer
Posted by GitBox <gi...@apache.org>.
fpapon commented on issue #206: Remove unused and unsecure XMLSerializer
URL: https://github.com/apache/shiro/pull/206#issuecomment-604986509
@bdemers ok, thanks for the tips ;)
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [shiro] fpapon merged pull request #206: Deprecate unsecure
XMLSerializer
Posted by GitBox <gi...@apache.org>.
fpapon merged pull request #206: Deprecate unsecure XMLSerializer
URL: https://github.com/apache/shiro/pull/206
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [shiro] fpapon commented on issue #206: Deprecate unsecure
XMLSerializer
Posted by GitBox <gi...@apache.org>.
fpapon commented on issue #206: Deprecate unsecure XMLSerializer
URL: https://github.com/apache/shiro/pull/206#issuecomment-611871821
@bdemers can you review please?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [shiro] fpapon removed a comment on issue #206: Remove unused and
unsecure XMLSerializer
Posted by GitBox <gi...@apache.org>.
fpapon removed a comment on issue #206: Remove unused and unsecure XMLSerializer
URL: https://github.com/apache/shiro/pull/206#issuecomment-604991715
@coheigea it make sense
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [shiro] bdemers commented on a change in pull request #206:
Deprecate unsecure XMLSerializer
Posted by GitBox <gi...@apache.org>.
bdemers commented on a change in pull request #206: Deprecate unsecure XMLSerializer
URL: https://github.com/apache/shiro/pull/206#discussion_r406773094
##########
File path: lang/src/main/java/org/apache/shiro/io/XmlSerializer.java
##########
@@ -34,7 +34,9 @@
* JavaBeans compatible!
*
* @since 0.9
+ * @deprecated This class should not be used because of unsecure XMLEncoder/XMLDecoder usage.
Review comment:
```suggestion
* @deprecated This class should not be used directly because of unsecure XMLEncoder/XMLDecoder usage.
```
You might want to say "used directly" 🤔
if/when this is wrapped in encryption most of the risk is removed.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [shiro] bmhm commented on issue #206: Remove unused and unsecure
XMLSerializer
Posted by GitBox <gi...@apache.org>.
bmhm commented on issue #206: Remove unused and unsecure XMLSerializer
URL: https://github.com/apache/shiro/pull/206#issuecomment-604943334
It says:
```
[ERROR] Failed to execute goal com.github.siom79.japicmp:japicmp-maven-plugin:0.14.1:cmp (japicmp) on project shiro-lang: There is at least one incompatibility: org.apache.shiro.io.XmlSerializer.XmlSerializer():CONSTRUCTOR_REMOVED,org.apache.shiro.io.Serializer[org.apache.shiro.io.Serializer]:INTERFACE_REMOVED,org.apache.shiro.io.XmlSerializer:SUPERCLASS_REMOVED,org.apache.shiro.io.XmlSerializer:CLASS_REMOVED -> [Help 1]
```
Can we find out if someone is using it?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [shiro] fpapon commented on a change in pull request #206:
Deprecate unsecure XMLSerializer
Posted by GitBox <gi...@apache.org>.
fpapon commented on a change in pull request #206: Deprecate unsecure XMLSerializer
URL: https://github.com/apache/shiro/pull/206#discussion_r406776173
##########
File path: lang/src/main/java/org/apache/shiro/io/XmlSerializer.java
##########
@@ -34,7 +34,9 @@
* JavaBeans compatible!
*
* @since 0.9
+ * @deprecated This class should not be used because of unsecure XMLEncoder/XMLDecoder usage.
Review comment:
@bdemers good catch ;)
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [shiro] coheigea commented on issue #206: Remove unused and
unsecure XMLSerializer
Posted by GitBox <gi...@apache.org>.
coheigea commented on issue #206: Remove unused and unsecure XMLSerializer
URL: https://github.com/apache/shiro/pull/206#issuecomment-604986557
Maybe we could log a WARNING saying that it's insecure to use and just remove it for the next major release?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services