You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by re...@apache.org on 2025/09/04 03:06:08 UTC
(cxf) branch 4.0.x-fixes updated (94fa502b66 -> ea432f28cf)
This is an automated email from the ASF dual-hosted git repository.
reta pushed a change to branch 4.0.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
from 94fa502b66 Recording .gitmergeinfo Changes
new ae08c3ca27 Bump org.webjars:swagger-ui from 5.27.1 to 5.28.0 (#2580)
new 007a910fb1 Update Jackson Databind to 2.20.0
new 5a7a78aaa7 [CXF-9160] Make JMS allowed JNDI protocols whitelist configurable
new ea432f28cf Recording .gitmergeinfo Changes
The 4 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.gitmergeinfo | 3 ++
distribution/src/main/release/samples/pom.xml | 2 +-
parent/pom.xml | 7 +++--
.../apache/cxf/transport/jms/util/JndiHelper.java | 36 ++++++++++++++++++++--
4 files changed, 41 insertions(+), 7 deletions(-)
(cxf) 02/04: Update Jackson Databind to 2.20.0
Posted by re...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 4.0.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 007a910fb1df168766c9c6f3ae5f3bd24cf7bb02
Author: Andriy Redko <dr...@gmail.com>
AuthorDate: Wed Sep 3 08:00:25 2025 -0400
Update Jackson Databind to 2.20.0
(cherry picked from commit 155e2286b0ac952bf321679497978cd681c296aa)
# Conflicts:
# parent/pom.xml
---
parent/pom.xml | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/parent/pom.xml b/parent/pom.xml
index 24334b072c..89d03694fe 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -131,8 +131,9 @@
<cxf.httpcomponents.core.version>4.4.16</cxf.httpcomponents.core.version>
<cxf.httpcomponents.client5.version>5.3.1</cxf.httpcomponents.client5.version>
<cxf.httpcomponents.core5.version>5.2.5</cxf.httpcomponents.core5.version>
- <cxf.jackson.version>2.19.2</cxf.jackson.version>
+ <cxf.jackson.version>2.20.0</cxf.jackson.version>
<cxf.jackson.databind.version>2.20.0</cxf.jackson.databind.version>
+ <cxf.jackson.annotations.version>2.20</cxf.jackson.annotations.version>
<cxf.jacorb.version>3.9</cxf.jacorb.version>
<cxf.jaeger.version>1.8.1</cxf.jaeger.version>
<cxf.jakarta.activation.version>2.1.3</cxf.jakarta.activation.version>
@@ -1557,7 +1558,7 @@
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-annotations</artifactId>
- <version>${cxf.jackson.version}</version>
+ <version>${cxf.jackson.annotations.version}</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.module</groupId>
(cxf) 03/04: [CXF-9160] Make JMS allowed JNDI protocols whitelist configurable
Posted by re...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 4.0.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 5a7a78aaa7bd6118be995aba27fa1bbf37d4e520
Author: Richard Opálka <op...@gmail.com>
AuthorDate: Fri Aug 22 15:22:09 2025 +0200
[CXF-9160] Make JMS allowed JNDI protocols whitelist configurable
(cherry picked from commit 7393edb431b1368f2060d287dfbf0d6d05f47b6a)
---
.../apache/cxf/transport/jms/util/JndiHelper.java | 36 ++++++++++++++++++++--
1 file changed, 33 insertions(+), 3 deletions(-)
diff --git a/rt/transports/jms/src/main/java/org/apache/cxf/transport/jms/util/JndiHelper.java b/rt/transports/jms/src/main/java/org/apache/cxf/transport/jms/util/JndiHelper.java
index 81ff0f6a57..ef98b6b3e5 100644
--- a/rt/transports/jms/src/main/java/org/apache/cxf/transport/jms/util/JndiHelper.java
+++ b/rt/transports/jms/src/main/java/org/apache/cxf/transport/jms/util/JndiHelper.java
@@ -18,21 +18,50 @@
*/
package org.apache.cxf.transport.jms.util;
+import java.util.ArrayList;
import java.util.Arrays;
+import java.util.Collections;
import java.util.List;
import java.util.Properties;
+import java.util.function.Predicate;
import javax.naming.Context;
import javax.naming.InitialContext;
import javax.naming.NameNotFoundException;
import javax.naming.NamingException;
+import org.apache.cxf.common.util.StringUtils;
+import org.apache.cxf.common.util.SystemPropertyAction;
+
public class JndiHelper {
- private static final List<String> ALLOWED_PROTOCOLS = Arrays.asList(
- "vm://", "tcp://", "nio://", "ssl://", "http://", "https://", "ws://", "wss://");
+ /**
+ * JVM/System property name holding allowed jms protocols.
+ */
+ private static final String CONFIGURED_JMS_PROTOCOLS = "jms.protocols";
+ /**
+ * Constant holding default allowed jms protocols.
+ */
+ private static final String DEFAULT_JMS_PROTOCOLS = "vm,tcp,nio,ssl,http,https,ws,wss";
+ private static final List<String> ALLOWED_PROTOCOLS;
private Properties environment;
+ static {
+ final String jmsProtocols = SystemPropertyAction.getProperty(CONFIGURED_JMS_PROTOCOLS, DEFAULT_JMS_PROTOCOLS);
+ if (StringUtils.isEmpty(jmsProtocols)) {
+ ALLOWED_PROTOCOLS = Collections.emptyList();
+ } else {
+ final List<String> allowedProtocols = new ArrayList<>();
+ Arrays
+ .stream(jmsProtocols.split(","))
+ .map(String::trim)
+ .filter(Predicate.not(String::isEmpty))
+ .map(s -> s + "://")
+ .forEach(allowedProtocols::add);
+ ALLOWED_PROTOCOLS = Collections.unmodifiableList(allowedProtocols);
+ }
+ }
+
/**
* Create a new JndiTemplate instance, using the given environment.
*/
@@ -41,7 +70,8 @@ public class JndiHelper {
// Avoid unsafe protocols if they are somehow misconfigured
String providerUrl = environment.getProperty(Context.PROVIDER_URL);
- if (providerUrl != null && !ALLOWED_PROTOCOLS.stream().anyMatch(providerUrl::startsWith)) {
+ if (providerUrl != null && !providerUrl.isEmpty()
+ && !ALLOWED_PROTOCOLS.stream().anyMatch(providerUrl::startsWith)) {
throw new IllegalArgumentException("Unsafe protocol in JNDI URL: " + providerUrl);
}
}
(cxf) 01/04: Bump org.webjars:swagger-ui from 5.27.1 to 5.28.0 (#2580)
Posted by re...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 4.0.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit ae08c3ca270f29eb71834f5969b78147a720f91f
Author: dependabot[bot] <49...@users.noreply.github.com>
AuthorDate: Wed Sep 3 07:47:18 2025 -0400
Bump org.webjars:swagger-ui from 5.27.1 to 5.28.0 (#2580)
Bumps [org.webjars:swagger-ui](https://github.com/swagger-api/swagger-ui) from 5.27.1 to 5.28.0.
- [Release notes](https://github.com/swagger-api/swagger-ui/releases)
- [Changelog](https://github.com/swagger-api/swagger-ui/blob/master/.releaserc)
- [Commits](https://github.com/swagger-api/swagger-ui/compare/v5.27.1...v5.28.0)
---
updated-dependencies:
- dependency-name: org.webjars:swagger-ui
dependency-version: 5.28.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <su...@github.com>
Co-authored-by: dependabot[bot] <49...@users.noreply.github.com>
(cherry picked from commit bfdeefacb121fcd295cbc92a94dd7d7b3a10f721)
# Conflicts:
# distribution/src/main/release/samples/pom.xml
---
distribution/src/main/release/samples/pom.xml | 2 +-
parent/pom.xml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/distribution/src/main/release/samples/pom.xml b/distribution/src/main/release/samples/pom.xml
index f09f5e376f..13a271f64e 100644
--- a/distribution/src/main/release/samples/pom.xml
+++ b/distribution/src/main/release/samples/pom.xml
@@ -36,7 +36,7 @@
<cxf.jetty11.version>11.0.26</cxf.jetty11.version>
<cxf.netty.version>4.1.124.Final</cxf.netty.version>
<cxf.httpcomponents.client.version>4.5.14</cxf.httpcomponents.client.version>
- <cxf.swagger.ui.version>5.27.1</cxf.swagger.ui.version>
+ <cxf.swagger.ui.version>5.28.0</cxf.swagger.ui.version>
<cxf.tika.version>2.9.1</cxf.tika.version>
<cxf.tomcat.version>10.1.44</cxf.tomcat.version>
<cxf.jboss.weld.version>4.0.3.Final</cxf.jboss.weld.version>
diff --git a/parent/pom.xml b/parent/pom.xml
index f77aef72b6..24334b072c 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -216,7 +216,7 @@
<cxf.spring.security.version>6.1.9</cxf.spring.security.version>
<cxf.spring.version>6.0.23</cxf.spring.version>
<cxf.stax-ex.version>1.8.3</cxf.stax-ex.version>
- <cxf.swagger.ui.version>5.27.1</cxf.swagger.ui.version>
+ <cxf.swagger.ui.version>5.28.0</cxf.swagger.ui.version>
<cxf.swagger.v3.version>2.2.36</cxf.swagger.v3.version>
<cxf.tika.version>2.9.1</cxf.tika.version>
<cxf.tomcat.version>10.1.44</cxf.tomcat.version>
(cxf) 04/04: Recording .gitmergeinfo Changes
Posted by re...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 4.0.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit ea432f28cffbc5119ed4d316dfdfa37fc5134c2f
Author: Andriy Redko <dr...@gmail.com>
AuthorDate: Wed Sep 3 22:57:55 2025 -0400
Recording .gitmergeinfo Changes
---
.gitmergeinfo | 3 +++
1 file changed, 3 insertions(+)
diff --git a/.gitmergeinfo b/.gitmergeinfo
index 0e3dc4cdc0..12cb04dcc1 100644
--- a/.gitmergeinfo
+++ b/.gitmergeinfo
@@ -60,6 +60,7 @@ M 12706c141d9bed18a3701eb4657574c00fbbe5d2
M 13142ef111886d12b0257cf021809a5784481d84
M 138ea01e28f86fe29bb004efcf1a0e26c1752b76
M 13f8d7c37d241e79cf0f4fbcd6d1a280700bf0bf
+M 155e2286b0ac952bf321679497978cd681c296aa
M 1560ab660324c233e3c8f13a68654ab01e33ea27
M 159f0e1eb48d9f185c41b748feb5da92d1d04dcb
M 160f9708fd9ad62965e22c5106284ecd2a9bf4c3
@@ -389,6 +390,7 @@ M 961cae16ac2c15514f0047c7890bffb06f51dd95
M 964c4cf65fff7901d0d51f8637e1e64cfabfd971
M 96717fda5668ba3b3730fb8fbd09ab1bf6781bf6
M 96788dca979ef5711efbfe4c96c513788bd89df5
+M 972edae1c468946beda622d65483645f762ddaa7
M 9732c6d9d4b4fb085fbb17256a1b9262f28a5985
M 9756ab897d93ffd28cbd86487abd3ae0df19ec47
M 97d3e0643545be2c363f4ca3b7f4723d7fdcd102
@@ -476,6 +478,7 @@ M be13c31b5852a59a033990abbddc9be20e201b62
M bea3fd5397c92199692e7dfd0738214c3ec8a4ce
M bf231e5145f75e2b07c1c36fa0e541070efe09d2
M bf85ae46a5000c4534452235cb652ca3d0e5c386
+M bfdeefacb121fcd295cbc92a94dd7d7b3a10f721
M c0a889298a6588dd198610b5dcf57c1ad70367ae
M c0d42fd697b224f06426af86936123f42fb8109f
M c38a804af4fd8341f784b331bbb6af0a5f64453f