You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by re...@apache.org on 2023/05/29 15:48:51 UTC
[cxf] branch 3.5.x-fixes updated (94623e1f34 -> 0e6eef7411)
This is an automated email from the ASF dual-hosted git repository.
reta pushed a change to branch 3.5.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
from 94623e1f34 Fix ValidatorTest due to certificate expiration
new 70960c4a0c CXF-8884: Update commons-jexl3 to 3.3 (#1280)
new 5307523d51 Recording .gitmergeinfo Changes
new 0e6eef7411 Bump github/codeql-action from 2.3.3 to 2.3.5 (#1284)
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.github/workflows/codeql-analysis.yml | 4 ++--
.gitmergeinfo | 2 ++
parent/pom.xml | 2 +-
services/sts/sts-core/pom.xml | 5 -----
.../java/org/apache/cxf/sts/claims/mapper/JexlClaimsMapper.java | 8 +++++++-
5 files changed, 12 insertions(+), 9 deletions(-)
[cxf] 02/03: Recording .gitmergeinfo Changes
Posted by re...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 3.5.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 5307523d510cf93cfca0254865c00b1e2585e344
Author: Andriy Redko <dr...@gmail.com>
AuthorDate: Mon May 29 11:47:14 2023 -0400
Recording .gitmergeinfo Changes
---
.gitmergeinfo | 2 ++
1 file changed, 2 insertions(+)
diff --git a/.gitmergeinfo b/.gitmergeinfo
index d4e46a4428..38aa67dc2e 100644
--- a/.gitmergeinfo
+++ b/.gitmergeinfo
@@ -184,6 +184,7 @@ B ad496ed008ae0b0d2636bc307559749fc28287c1
B ae865c4aeb8d3ed8019fd0d23b0bbc38f0e66506
B af151eef0f4c90a9a538ca31023198c370164e99
B af49d9674ab595a3241083cece8fb42c4a17a4df
+B afd0b5ea960d1b910e72b0d66b879357a6ee6328
B afdde046d98bcfe3b1864d2789339b835feaf3c4
B b176e8e4a5a6bb6097c4e399ee0fa843f81e4b32
B b2ec57436a90b0d094f9c8700340368d0a096c80
@@ -430,6 +431,7 @@ M d86920ce70dfe74836f18180dc5d47c8437f0250
M d891059f0de95a27e69179a0bfa0e80eb251bb3f
M db6fcc8871fd8469907f3bfadfa6f1824e52a966
M e272423b0ab885aa886901850360c04d11eb5ba2
+M e2f56083cb79b8b6dc4aa099d795222c8164428a
M e60d84d2ad4a4e95be19eb5d326dcae1133eefb3
M e6fd52bd53f8b16082d5532a7276b5165463a8a5
M ec2d67972cf26ab674fde8aa11a56512b196275d
[cxf] 03/03: Bump github/codeql-action from 2.3.3 to 2.3.5 (#1284)
Posted by re...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 3.5.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 0e6eef74111ed1f84ac891389980943587b2d73d
Author: dependabot[bot] <49...@users.noreply.github.com>
AuthorDate: Mon May 29 09:23:38 2023 -0400
Bump github/codeql-action from 2.3.3 to 2.3.5 (#1284)
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.3.3 to 2.3.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/29b1f65c5e92e24fe6b6647da1eaabe529cec70f...0225834cc549ee0ca93cb085b92954821a145866)
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <su...@github.com>
Co-authored-by: dependabot[bot] <49...@users.noreply.github.com>
---
.github/workflows/codeql-analysis.yml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 1675be8f63..2f1263b204 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -49,7 +49,7 @@ jobs:
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
- uses: github/codeql-action/init@29b1f65c5e92e24fe6b6647da1eaabe529cec70f # v2.3.3
+ uses: github/codeql-action/init@0225834cc549ee0ca93cb085b92954821a145866 # v2.3.5
with:
languages: ${{ matrix.language }}
#config-file: ./.github/codeql/codeql-cxf-config.yml
@@ -77,4 +77,4 @@ jobs:
# make release
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@29b1f65c5e92e24fe6b6647da1eaabe529cec70f # v2.3.3
+ uses: github/codeql-action/analyze@0225834cc549ee0ca93cb085b92954821a145866 # v2.3.5
[cxf] 01/03: CXF-8884: Update commons-jexl3 to 3.3 (#1280)
Posted by re...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 3.5.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 70960c4a0cd89be903115a798caa0fcbbc7b5620
Author: Andriy Redko <dr...@gmail.com>
AuthorDate: Sun May 28 22:03:18 2023 -0400
CXF-8884: Update commons-jexl3 to 3.3 (#1280)
(cherry picked from commit 254586ce54966d15dffd9933f76c6d7581142c18)
# Conflicts:
# parent/pom.xml
(cherry picked from commit e2f56083cb79b8b6dc4aa099d795222c8164428a)
# Conflicts:
# parent/pom.xml
---
parent/pom.xml | 2 +-
services/sts/sts-core/pom.xml | 5 -----
.../java/org/apache/cxf/sts/claims/mapper/JexlClaimsMapper.java | 8 +++++++-
3 files changed, 8 insertions(+), 7 deletions(-)
diff --git a/parent/pom.xml b/parent/pom.xml
index c1f60b6cfe..6d1d6a7010 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -155,7 +155,7 @@
<cxf.jetty.osgi.version>[9.2,10)</cxf.jetty.osgi.version>
<cxf.jetty9.version>9.4.51.v20230217</cxf.jetty9.version>
<cxf.jetty.version>${cxf.jetty9.version}</cxf.jetty.version>
- <cxf.jexl.version>3.2.1</cxf.jexl.version>
+ <cxf.jexl.version>3.3</cxf.jexl.version>
<cxf.joda.time.version>2.10.10</cxf.joda.time.version>
<cxf.johnzon.version>1.2.20</cxf.johnzon.version>
<cxf.json.api.version>1.1.6</cxf.json.api.version>
diff --git a/services/sts/sts-core/pom.xml b/services/sts/sts-core/pom.xml
index fb70cfef10..1d1d32acbb 100644
--- a/services/sts/sts-core/pom.xml
+++ b/services/sts/sts-core/pom.xml
@@ -105,11 +105,6 @@
<artifactId>jcl-over-slf4j</artifactId>
<scope>test</scope>
</dependency>
- <dependency>
- <groupId>org.slf4j</groupId>
- <artifactId>slf4j-jdk14</artifactId>
- <scope>test</scope>
- </dependency>
<dependency>
<groupId>${cxf.servlet-api.group}</groupId>
<artifactId>${cxf.servlet-api.artifact}</artifactId>
diff --git a/services/sts/sts-core/src/main/java/org/apache/cxf/sts/claims/mapper/JexlClaimsMapper.java b/services/sts/sts-core/src/main/java/org/apache/cxf/sts/claims/mapper/JexlClaimsMapper.java
index b01dc98703..dffa1f6a00 100644
--- a/services/sts/sts-core/src/main/java/org/apache/cxf/sts/claims/mapper/JexlClaimsMapper.java
+++ b/services/sts/sts-core/src/main/java/org/apache/cxf/sts/claims/mapper/JexlClaimsMapper.java
@@ -32,6 +32,7 @@ import org.apache.commons.jexl3.JexlContext;
import org.apache.commons.jexl3.JexlEngine;
import org.apache.commons.jexl3.JexlScript;
import org.apache.commons.jexl3.MapContext;
+import org.apache.commons.jexl3.introspection.JexlPermissions.ClassPermissions;
import org.apache.cxf.common.classloader.ClassLoaderUtils;
import org.apache.cxf.common.logging.LogUtils;
import org.apache.cxf.sts.claims.ClaimsMapper;
@@ -52,7 +53,12 @@ public class JexlClaimsMapper implements ClaimsMapper {
Map<String, Object> functions = new HashMap<>();
functions.put("claims", new ClaimUtils());
functions.put("LOG", LOG);
- jexlEngine = new JexlBuilder().silent(false).namespaces(functions).create();
+ jexlEngine = new JexlBuilder()
+ .silent(false)
+ .namespaces(functions)
+ .permissions(new ClassPermissions(java.net.URI.class)
+ .compose("org.apache.cxf.*"))
+ .create();
}
public JexlClaimsMapper(String script) throws IOException {