You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by co...@apache.org on 2022/02/18 07:38:56 UTC
[camel] branch camel-3.11.x updated (b6706191 -> eabbb51)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a change to branch camel-3.11.x
in repository https://gitbox.apache.org/repos/asf/camel.git.
from b6706191 CAMEL-17650: camel-vertx-websocket: sendToAll operation should consider the path WebSocket clients are connected to
new ac909fb Upgrade XStream to version 1.4.18
new fb77e8e Upgrade to xstream 1.4.19
new eabbb51 Fixup previous commit
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
camel-dependencies/pom.xml | 4 +-
.../xstream/MarshalMapCVE202026217Test.java | 131 +++++++++++++++++++++
parent/pom.xml | 2 +-
3 files changed, 134 insertions(+), 3 deletions(-)
create mode 100644 components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/MarshalMapCVE202026217Test.java
[camel] 03/03: Fixup previous commit
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch camel-3.11.x
in repository https://gitbox.apache.org/repos/asf/camel.git
commit eabbb511a3a999f767e1bfa7bd0e5c9e74b306ab
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Fri Feb 18 07:38:00 2022 +0000
Fixup previous commit
---
camel-dependencies/pom.xml | 9 ++-------
.../camel/dataformat/xstream/MarshalMapCVE202026217Test.java | 2 +-
2 files changed, 3 insertions(+), 8 deletions(-)
diff --git a/camel-dependencies/pom.xml b/camel-dependencies/pom.xml
index 494ca66..cca7bdd 100644
--- a/camel-dependencies/pom.xml
+++ b/camel-dependencies/pom.xml
@@ -561,7 +561,7 @@
<xbean-spring-version>4.17</xbean-spring-version>
<xchange-guava-version>29.0-jre</xchange-guava-version>
<xchange-version>5.0.11</xchange-version>
- <xerces-version>2.12.0</xerces-version>
+ <xerces-version>2.12.2</xerces-version>
<xml-apis-ext-version>1.3.04</xml-apis-ext-version>
<xml-apis-version>1.4.01</xml-apis-version>
<xml-resolver-version>1.2</xml-resolver-version>
@@ -569,13 +569,8 @@
<xmlsec-version>2.1.7</xmlsec-version>
<xmlunit-version>2.6.3</xmlunit-version>
<xpp3-version>1.1.4c</xpp3-version>
-<<<<<<< HEAD
- <xstream-version>1.4.17</xstream-version>
- <yetus-audience-annotations-version>0.11.0</yetus-audience-annotations-version>
-=======
<xstream-version>1.4.19</xstream-version>
- <yetus-audience-annotations-version>0.13.0</yetus-audience-annotations-version>
->>>>>>> 37a061d13e0 (Upgrade to xstream 1.4.19)
+ <yetus-audience-annotations-version>0.11.0</yetus-audience-annotations-version>
<zendesk-client-version>0.14.1</zendesk-client-version>
<zipkin-reporter-version>2.16.3</zipkin-reporter-version>
<zipkin-version>2.23.2</zipkin-version>
diff --git a/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/MarshalMapCVE202026217Test.java b/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/MarshalMapCVE202026217Test.java
index 8c5d38f..322c880 100644
--- a/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/MarshalMapCVE202026217Test.java
+++ b/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/MarshalMapCVE202026217Test.java
@@ -55,7 +55,7 @@ public class MarshalMapCVE202026217Test extends CamelTestSupport {
Exception exception = assertThrows(CamelExecutionException.class,
() -> template.sendBodyAndProperty("direct:in", body, Exchange.CHARSET_NAME, "ISO-8859-1"));
- Assertions.assertInstanceOf(ForbiddenClassException.class, exception.getCause());
+ Assertions.assertTrue(exception.getCause() instanceof ForbiddenClassException);
}
@Override
[camel] 01/03: Upgrade XStream to version 1.4.18
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch camel-3.11.x
in repository https://gitbox.apache.org/repos/asf/camel.git
commit ac909fbace9997b10f21349e375588f6b5fa1d35
Author: Andrea Cosentino <an...@gmail.com>
AuthorDate: Thu Aug 26 13:24:02 2021 +0200
Upgrade XStream to version 1.4.18
---
parent/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/parent/pom.xml b/parent/pom.xml
index 4b5ab35..b1f2c09 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -558,7 +558,7 @@
<xmlsec-version>2.1.7</xmlsec-version>
<xmlunit-version>2.6.3</xmlunit-version>
<xpp3-version>1.1.4c</xpp3-version>
- <xstream-version>1.4.17</xstream-version>
+ <xstream-version>1.4.18</xstream-version>
<yetus-audience-annotations-version>0.11.0</yetus-audience-annotations-version>
<zendesk-client-version>0.14.1</zendesk-client-version>
<zipkin-reporter-version>2.16.3</zipkin-reporter-version>
[camel] 02/03: Upgrade to xstream 1.4.19
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch camel-3.11.x
in repository https://gitbox.apache.org/repos/asf/camel.git
commit fb77e8e1f37f147d66cf5bea9138089b653905f8
Author: Claus Ibsen <cl...@gmail.com>
AuthorDate: Thu Feb 3 20:18:44 2022 +0100
Upgrade to xstream 1.4.19
---
camel-dependencies/pom.xml | 5 +
.../xstream/MarshalMapCVE202026217Test.java | 131 +++++++++++++++++++++
parent/pom.xml | 2 +-
3 files changed, 137 insertions(+), 1 deletion(-)
diff --git a/camel-dependencies/pom.xml b/camel-dependencies/pom.xml
index 8840bc6..494ca66 100644
--- a/camel-dependencies/pom.xml
+++ b/camel-dependencies/pom.xml
@@ -569,8 +569,13 @@
<xmlsec-version>2.1.7</xmlsec-version>
<xmlunit-version>2.6.3</xmlunit-version>
<xpp3-version>1.1.4c</xpp3-version>
+<<<<<<< HEAD
<xstream-version>1.4.17</xstream-version>
<yetus-audience-annotations-version>0.11.0</yetus-audience-annotations-version>
+=======
+ <xstream-version>1.4.19</xstream-version>
+ <yetus-audience-annotations-version>0.13.0</yetus-audience-annotations-version>
+>>>>>>> 37a061d13e0 (Upgrade to xstream 1.4.19)
<zendesk-client-version>0.14.1</zendesk-client-version>
<zipkin-reporter-version>2.16.3</zipkin-reporter-version>
<zipkin-version>2.23.2</zipkin-version>
diff --git a/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/MarshalMapCVE202026217Test.java b/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/MarshalMapCVE202026217Test.java
new file mode 100644
index 0000000..8c5d38f
--- /dev/null
+++ b/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/MarshalMapCVE202026217Test.java
@@ -0,0 +1,131 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.dataformat.xstream;
+
+import java.util.HashMap;
+
+import com.thoughtworks.xstream.security.ForbiddenClassException;
+import org.apache.camel.CamelExecutionException;
+import org.apache.camel.EndpointInject;
+import org.apache.camel.Exchange;
+import org.apache.camel.Processor;
+import org.apache.camel.builder.RouteBuilder;
+import org.apache.camel.component.mock.MockEndpoint;
+import org.apache.camel.test.junit5.CamelTestSupport;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.condition.EnabledOnJre;
+import org.junit.jupiter.api.condition.JRE;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+/**
+ * Marshal tests with Map. Related to https://x-stream.github.io/CVE-2020-26217.html
+ */
+public class MarshalMapCVE202026217Test extends CamelTestSupport {
+
+ @EndpointInject("mock:result")
+ MockEndpoint mock;
+
+ @Test
+ @EnabledOnJre({ JRE.JAVA_11 })
+ public void testMarshalListJDK11() throws Exception {
+
+ mock.expectedMessageCount(1);
+ mock.expectedBodiesReceived("<?xml version='1.0' encoding='ISO-8859-1'?>"
+ + "<map><entry><string>Test</string><string>21</string></entry></map>");
+
+ HashMap<Object, Object> body = new HashMap<Object, Object>();
+ body.put("Test", "21");
+
+ Exception exception = assertThrows(CamelExecutionException.class,
+ () -> template.sendBodyAndProperty("direct:in", body, Exchange.CHARSET_NAME, "ISO-8859-1"));
+
+ Assertions.assertInstanceOf(ForbiddenClassException.class, exception.getCause());
+ }
+
+ @Override
+ protected RouteBuilder createRouteBuilder() throws Exception {
+ return new RouteBuilder() {
+ public void configure() throws Exception {
+ XStreamDataFormat xStreamDataFormat = new XStreamDataFormat();
+
+ from("direct:in").marshal(xStreamDataFormat).process(new Processor() {
+ @Override
+ public void process(Exchange exchange) throws Exception {
+ exchange.getIn().setBody("<map>\n" +
+ " <entry>\n" +
+ " <jdk.nashorn.internal.objects.NativeString>\n" +
+ " <flags>0</flags>\n" +
+ " <value class='com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data'>\n"
+ +
+ " <dataHandler>\n" +
+ " <dataSource class='com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource'>\n"
+ +
+ " <contentType>text/plain</contentType>\n" +
+ " <is class='java.io.SequenceInputStream'>\n" +
+ " <e class='javax.swing.MultiUIDefaults$MultiUIDefaultsEnumerator'>\n"
+ +
+ " <iterator class='javax.imageio.spi.FilterIterator'>\n" +
+ " <iter class='java.util.ArrayList$Itr'>\n" +
+ " <cursor>0</cursor>\n" +
+ " <lastRet>-1</lastRet>\n" +
+ " <expectedModCount>1</expectedModCount>\n" +
+ " <outer-class>\n" +
+ " <java.lang.ProcessBuilder>\n" +
+ " <command>\n" +
+ " <string>calc</string>\n" +
+ " </command>\n" +
+ " </java.lang.ProcessBuilder>\n" +
+ " </outer-class>\n" +
+ " </iter>\n" +
+ " <filter class='javax.imageio.ImageIO$ContainsFilter'>\n" +
+ " <method>\n" +
+ " <class>java.lang.ProcessBuilder</class>\n" +
+ " <name>start</name>\n" +
+ " <parameter-types/>\n" +
+ " </method>\n" +
+ " <name>start</name>\n" +
+ " </filter>\n" +
+ " <next/>\n" +
+ " </iterator>\n" +
+ " <type>KEYS</type>\n" +
+ " </e>\n" +
+ " <in class='java.io.ByteArrayInputStream'>\n" +
+ " <buf></buf>\n" +
+ " <pos>0</pos>\n" +
+ " <mark>0</mark>\n" +
+ " <count>0</count>\n" +
+ " </in>\n" +
+ " </is>\n" +
+ " <consumed>false</consumed>\n" +
+ " </dataSource>\n" +
+ " <transferFlavors/>\n" +
+ " </dataHandler>\n" +
+ " <dataLen>0</dataLen>\n" +
+ " </value>\n" +
+ " </jdk.nashorn.internal.objects.NativeString>\n" +
+ " <string>test</string>\n" +
+ " </entry>\n" +
+ "</map>");
+ }
+ }).unmarshal(xStreamDataFormat).to(mock);
+ }
+ };
+ }
+
+}
diff --git a/parent/pom.xml b/parent/pom.xml
index b1f2c09..affe24f 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -558,7 +558,7 @@
<xmlsec-version>2.1.7</xmlsec-version>
<xmlunit-version>2.6.3</xmlunit-version>
<xpp3-version>1.1.4c</xpp3-version>
- <xstream-version>1.4.18</xstream-version>
+ <xstream-version>1.4.19</xstream-version>
<yetus-audience-annotations-version>0.11.0</yetus-audience-annotations-version>
<zendesk-client-version>0.14.1</zendesk-client-version>
<zipkin-reporter-version>2.16.3</zipkin-reporter-version>