You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@jackrabbit.apache.org by "Konrad Windszus (Jira)" <ji...@apache.org> on 2025/11/03 07:59:00 UTC

[jira] [Resolved] (JCRVLT-825) Remove Patch Support (extracting files from packages to filesystem)

     [ https://issues.apache.org/jira/browse/JCRVLT-825?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Konrad Windszus resolved JCRVLT-825.
------------------------------------
    Resolution: Fixed

Fixed in https://github.com/apache/jackrabbit-filevault/commit/4dd65c925b282991f8e0cebb280fb6cfa393e8a0.

> Remove Patch Support (extracting files from packages to filesystem)
> -------------------------------------------------------------------
>
>                 Key: JCRVLT-825
>                 URL: https://issues.apache.org/jira/browse/JCRVLT-825
>             Project: Jackrabbit FileVault
>          Issue Type: Improvement
>          Components: vlt
>    Affects Versions: 4.1.4
>            Reporter: Konrad Windszus
>            Assignee: Konrad Windszus
>            Priority: Major
>             Fix For: 4.2.0
>
>
> The patch handling in https://github.com/apache/jackrabbit-filevault/blob/983bdec48b5772d6888d76c1b86899a90de735ef/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/Importer.java#L1264 allows to deserialize files from packages to the underlying filesystem.
> To enable that one needs to programmatically install the package with the right import options. By default this is disabled.
> However this mechanism is no longer used and potentially can be abused by consumers (via API) to open a way to place something on the filesystem via custom package installations. Therefore it should be removed.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)