BlazeDS 4.8.0 - flex.messaging.services.xxx

[吉川威雄 / YOSHIKAWA，TAKAO <ta...@hitachi.com>]

Hi,



What is the reason why the following class features have been removed from BlazeDS 4.8.0?

Are there any alternative solutions or countermeasures for this?



flex.messaging.services.HTTPProxyService

flex.messaging.services.http.HTTPProxyAdapter

flex.messaging.services.http.SOAPProxyAdapter



Thanks,

Takao

RE: Re: BlazeDS 4.8.0 - flex.messaging.services.xxx

[吉川威雄 / YOSHIKAWA，TAKAO <ta...@hitachi.com>]

Hi,

We understood the reason, thank you!

Thanks,
Takao

Re: BlazeDS 4.8.0 - flex.messaging.services.xxx

[Josh Tynjala <jo...@bowlerhat.dev>]

The "flex-messaging-proxy" module relied on the commons-httpclient 3.1
library, which had CVE security vulnerabilities. To update
flex-messaging-proxy, this dependency would need to be replaced by the
newer org.apache.httpcomponents.httpclient, which has a different API (and
no migration guide from the older version). It was found that some of the
features of the proxy service exposed commons-httpclient internals that
seem to no longer exist in org.apache.httpcomponents.httpclient. This made
it very difficult to upgrade flex-messaging-proxy, so we decided to disable
it instead, so that other BlazeDS features could be updated and released to
fix other security vulnerabilities.

However, we would be open to a community contribution that upgrades
flex-messaging-proxy to use org.apache.httpcomponents.httpclient. The
original source code can be found in the blazeds-4.7.3 tag.

--
Josh Tynjala
Bowler Hat LLC <https://bowlerhat.dev>


On Thu, Aug 24, 2023 at 11:49 PM 吉川威雄 / YOSHIKAWA，TAKAO <
takao.yoshikawa.je@hitachi.com> wrote:

> Hi,
>
>
>
> What is the reason why the following class features have been removed from
> BlazeDS 4.8.0?
>
> Are there any alternative solutions or countermeasures for this?
>
>
>
> flex.messaging.services.HTTPProxyService
>
> flex.messaging.services.http.HTTPProxyAdapter
>
> flex.messaging.services.http.SOAPProxyAdapter
>
>
>
> Thanks,
>
> Takao
>