You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@syncope.apache.org by il...@apache.org on 2025/11/24 13:27:10 UTC
(syncope) branch 3_0_X updated (c777177d2a -> bfef214104)
This is an automated email from the ASF dual-hosted git repository.
ilgrosso pushed a change to branch 3_0_X
in repository https://gitbox.apache.org/repos/asf/syncope.git
from c777177d2a prepare for next development iteration
new 15e5d1a432 Better explanation for security.groovyBlacklist Core property
new bfef214104 Upgrading Swagger JAX-RS
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
core/starter/src/main/resources/core.properties | 2 ++
pom.xml | 2 +-
src/main/asciidoc/reference-guide/concepts/implementations.adoc | 3 +++
.../reference-guide/configuration/configurationparameters.adoc | 5 +++--
4 files changed, 9 insertions(+), 3 deletions(-)
(syncope) 01/02: Better explanation for security.groovyBlacklist Core property
Posted by il...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
ilgrosso pushed a commit to branch 3_0_X
in repository https://gitbox.apache.org/repos/asf/syncope.git
commit 15e5d1a4321454ee80805c6a12b3ccfc30f52891
Author: Francesco Chicchiriccò <il...@apache.org>
AuthorDate: Fri Nov 21 11:44:41 2025 +0100
Better explanation for security.groovyBlacklist Core property
---
core/starter/src/main/resources/core.properties | 2 ++
src/main/asciidoc/reference-guide/concepts/implementations.adoc | 3 +++
.../reference-guide/configuration/configurationparameters.adoc | 5 +++--
3 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/core/starter/src/main/resources/core.properties b/core/starter/src/main/resources/core.properties
index cb962828a5..997e47545d 100644
--- a/core/starter/src/main/resources/core.properties
+++ b/core/starter/src/main/resources/core.properties
@@ -105,6 +105,8 @@ security.jwsKey=${jwsKey}
# Shorter keys will be padded to the nearest longer option available; keys > 32 will be trucated
security.aesSecretKey=${secretKey}
+security.groovyBlacklist=classpath:META-INF/groovy.blacklist
+
# default for LDAP / RFC2307 SSHA
security.digester.saltIterations=1
security.digester.saltSizeBytes=8
diff --git a/src/main/asciidoc/reference-guide/concepts/implementations.adoc b/src/main/asciidoc/reference-guide/concepts/implementations.adoc
index d74ed98c1d..ae75c890c3 100644
--- a/src/main/asciidoc/reference-guide/concepts/implementations.adoc
+++ b/src/main/asciidoc/reference-guide/concepts/implementations.adoc
@@ -44,4 +44,7 @@ ifeval::["{snapshotOrRelease}" == "snapshot"]
https://github.com/ilgrosso/syncope/blob/4_0_X/core/spring/src/main/resources/META-INF/groovy.blacklist[groovy.blacklist^]
endif::[]
.
+
+The default Groovy sandbox controls can be tweaked by configuring a local copy of `groovy.blacklist`, which will then
+have to be referenced by adjusting the value of the `security.groovyBlacklist` property in the `core.properties` file.
====
diff --git a/src/main/asciidoc/reference-guide/configuration/configurationparameters.adoc b/src/main/asciidoc/reference-guide/configuration/configurationparameters.adoc
index 1f7d15b623..8fdfeed4ee 100644
--- a/src/main/asciidoc/reference-guide/configuration/configurationparameters.adoc
+++ b/src/main/asciidoc/reference-guide/configuration/configurationparameters.adoc
@@ -24,9 +24,10 @@ Most run-time configuration options are available as parameters and can be tuned
* `password.cipher.algorithm` - which cipher algorithm shall be used for encrypting password values; supported
algorithms include `SHA-1`, `SHA-256`, `SHA-512`, `AES`, `S-MD5`, `S-SHA-1`, `S-SHA-256`, `S-SHA-512` and `BCRYPT`;
salting options are available in the `core.properties` file;
-* `security.aesSecretKey` - used for AES-based encryption / decryption: besides password values, this is also used
-whenever reversible encryption is needed, throughout the whole system;
[WARNING]
+The value of the `security.aesSecretKey` property in the `core.properties` file is used for AES-based encryption /
+decryption: besides password values, this is also used whenever reversible encryption is needed, throughout the whole
+system. +
The actual length of the `security.aesSecretKey` value is used to drive the AES algorithm variant selection:
16 characters implies `AES-128`, 24 selects `AES-192` and 32 configures `AES-256`. +
When the `security.aesSecretKey` value has length less than 16, between 17 and 23 or between 25 and 31, it is
(syncope) 02/02: Upgrading Swagger JAX-RS
Posted by il...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
ilgrosso pushed a commit to branch 3_0_X
in repository https://gitbox.apache.org/repos/asf/syncope.git
commit bfef214104998d7bf4e9e09e9b3925da9367e855
Author: Francesco Chicchiriccò <il...@apache.org>
AuthorDate: Mon Nov 24 14:27:01 2025 +0100
Upgrading Swagger JAX-RS
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index ae2ab6855d..7056b8b40d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -449,7 +449,7 @@ under the License.
<h2.version>2.3.232</h2.version>
- <swagger-core.version>2.2.40</swagger-core.version>
+ <swagger-core.version>2.2.41</swagger-core.version>
<swagger-ui.version>5.30.2</swagger-ui.version>
<jquery-slimscroll.version>1.3.8</jquery-slimscroll.version>