You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@felix.apache.org by ol...@apache.org on 2019/12/08 15:29:04 UTC
svn commit: r1871047 - in /felix/trunk/webconsole: changelog.txt
src/main/java/org/apache/felix/webconsole/internal/configuration/ConfigAdminSupport.java
src/main/java/org/apache/felix/webconsole/internal/configuration/MetaTypeSupport.java
Author: olli
Date: Sun Dec 8 15:29:03 2019
New Revision: 1871047
URL: http://svn.apache.org/viewvc?rev=1871047&view=rev
Log:
FELIX-5661 The heuristic to derive the password type from the metatype id does not work reliably
Consider proper attribute definition for passwords only
Modified:
felix/trunk/webconsole/changelog.txt
felix/trunk/webconsole/src/main/java/org/apache/felix/webconsole/internal/configuration/ConfigAdminSupport.java
felix/trunk/webconsole/src/main/java/org/apache/felix/webconsole/internal/configuration/MetaTypeSupport.java
Modified: felix/trunk/webconsole/changelog.txt
URL: http://svn.apache.org/viewvc/felix/trunk/webconsole/changelog.txt?rev=1871047&r1=1871046&r2=1871047&view=diff
==============================================================================
--- felix/trunk/webconsole/changelog.txt (original)
+++ felix/trunk/webconsole/changelog.txt Sun Dec 8 15:29:03 2019
@@ -2,7 +2,7 @@ Changes in 4.3.18
-----------------
** Bug
* [FELIX-6185] - jQuery <3.4.0 is vulnerable to prototype pollution attacks
-
+ * [FELIX-5661] - The heuristic to derive the password type from the metatype id does not work reliably
Changes in 4.3.16
-----------------
Modified: felix/trunk/webconsole/src/main/java/org/apache/felix/webconsole/internal/configuration/ConfigAdminSupport.java
URL: http://svn.apache.org/viewvc/felix/trunk/webconsole/src/main/java/org/apache/felix/webconsole/internal/configuration/ConfigAdminSupport.java?rev=1871047&r1=1871046&r2=1871047&view=diff
==============================================================================
--- felix/trunk/webconsole/src/main/java/org/apache/felix/webconsole/internal/configuration/ConfigAdminSupport.java (original)
+++ felix/trunk/webconsole/src/main/java/org/apache/felix/webconsole/internal/configuration/ConfigAdminSupport.java Sun Dec 8 15:29:03 2019
@@ -220,11 +220,11 @@ class ConfigAdminSupport
int attributeType = MetaTypeSupport.getAttributeType( ad );
if ( ad == null
- || ( ad.getCardinality() == 0 && ( attributeType == AttributeDefinition.STRING || attributeType == MetaTypeServiceSupport.ATTRIBUTE_TYPE_PASSWORD ) ) )
+ || ( ad.getCardinality() == 0 && ( attributeType == AttributeDefinition.STRING || attributeType == AttributeDefinition.PASSWORD ) ) )
{
String prop = request.getParameter( paramName );
if ( prop != null
- && ( attributeType != MetaTypeSupport.ATTRIBUTE_TYPE_PASSWORD || !MetaTypeSupport.PASSWORD_PLACEHOLDER_VALUE.equals( prop ) ) )
+ && ( attributeType != AttributeDefinition.PASSWORD || !MetaTypeSupport.PASSWORD_PLACEHOLDER_VALUE.equals( prop ) ) )
{
props.put( propName, prop );
}
@@ -253,7 +253,7 @@ class ConfigAdminSupport
String[] properties = request.getParameterValues( paramName );
if ( properties != null )
{
- if ( attributeType == MetaTypeSupport.ATTRIBUTE_TYPE_PASSWORD )
+ if ( attributeType == AttributeDefinition.PASSWORD )
{
MetaTypeSupport.setPasswordProps( vec, properties, props.get( propName ) );
}
Modified: felix/trunk/webconsole/src/main/java/org/apache/felix/webconsole/internal/configuration/MetaTypeSupport.java
URL: http://svn.apache.org/viewvc/felix/trunk/webconsole/src/main/java/org/apache/felix/webconsole/internal/configuration/MetaTypeSupport.java?rev=1871047&r1=1871046&r2=1871047&view=diff
==============================================================================
--- felix/trunk/webconsole/src/main/java/org/apache/felix/webconsole/internal/configuration/MetaTypeSupport.java (original)
+++ felix/trunk/webconsole/src/main/java/org/apache/felix/webconsole/internal/configuration/MetaTypeSupport.java Sun Dec 8 15:29:03 2019
@@ -42,13 +42,6 @@ import org.osgi.service.metatype.Attribu
class MetaTypeSupport
{
- /**
- * Attribute type code for PASSWORD attributes as defined in
- * Metatype Service Specification 1.2. Since we cannot yet refer
- * to the 1.2 API package we just replicate the type code here. Once
- * the API is available and can be referred to, we should use it.
- */
- static final int ATTRIBUTE_TYPE_PASSWORD = 12;
/**
* Marker value of password fields used as dummy values and
@@ -128,7 +121,7 @@ class MetaTypeSupport
}
// unless the property is of password type, send it
- final boolean isPassword = propertyType == ATTRIBUTE_TYPE_PASSWORD;
+ final boolean isPassword = propertyType == AttributeDefinition.PASSWORD;
if ( ad.getCardinality() == 0 )
{
// scalar
@@ -178,12 +171,6 @@ class MetaTypeSupport
}
- private static boolean isPasswordProperty( String name )
- {
- return name == null ? false : name.toLowerCase().indexOf( "password" ) != -1; //$NON-NLS-1$
- }
-
-
private static List toList( Object value )
{
if ( value instanceof Vector )
@@ -289,10 +276,6 @@ class MetaTypeSupport
static int getAttributeType( final PropertyDescriptor ad )
{
- if ( ad.getType() == AttributeDefinition.STRING && isPasswordProperty( ad.getID() ) )
- {
- return ATTRIBUTE_TYPE_PASSWORD;
- }
return ad.getType();
}
@@ -324,7 +307,7 @@ class MetaTypeSupport
return Short.valueOf( value );
default:
// includes AttributeDefinition.STRING
- // includes ATTRIBUTE_TYPE_PASSWORD/AttributeDefinition.PASSWORD
+ // includes AttributeDefinition.PASSWORD
return value;
}
}
@@ -355,7 +338,7 @@ class MetaTypeSupport
int size = values.size();
// short cut for string array
- if ( type == AttributeDefinition.STRING || type == ATTRIBUTE_TYPE_PASSWORD )
+ if ( type == AttributeDefinition.STRING || type == AttributeDefinition.PASSWORD )
{
return values.toArray( new String[size] );
}