You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by jl...@apache.org on 2024/10/28 13:51:34 UTC
(ofbiz-framework) branch trunk updated (a1472b3c52 -> 97aee6d8b0)
This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a change to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
from a1472b3c52 Improve Parameter Encoding in MacroMenuRenderer (OFBIZ-13162)
new a24df9752a Improved: Prevent URL parameters manipulation (OFBIZ-13147)
new 23ec946b9a Fixed: Allow GroovyDSL in FlexibleStringExpander (OFBIZ-13133)
new 7bdf4b5c92 Improved: Fix some bugs SpotBugs reports (OFBIZ-12386)
new 1bacac99e4 Improved: Fix some bugs SpotBugs reports (OFBIZ-12386)
new 97aee6d8b0 Improved: small improvements in SecurityUtilTest
The 5 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../base/src/main/java/org/apache/ofbiz/base/util/GroovyUtil.java | 2 +-
.../src/main/java/org/apache/ofbiz/entity/jdbc/DatabaseUtil.java | 4 +++-
.../src/test/java/org/apache/ofbiz/security/SecurityUtilTest.java | 4 ++--
.../src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java | 3 +++
spotbugs/exclude.xml | 4 ++--
5 files changed, 11 insertions(+), 6 deletions(-)
(ofbiz-framework) 01/05: Improved: Prevent URL parameters manipulation (OFBIZ-13147)
Posted by jl...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit a24df9752ac5de07f71c18d9e42f46f2c48c07b8
Author: Jacques Le Roux <ja...@les7arts.com>
AuthorDate: Fri Oct 25 04:04:12 2024 +0200
Improved: Prevent URL parameters manipulation (OFBIZ-13147)
Document ControlFilter::isSolrTest
---
.../src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java | 3 +++
1 file changed, 3 insertions(+)
diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
index a4c0e59400..d4b077b5b1 100644
--- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
+++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
@@ -131,6 +131,9 @@ public class ControlFilter extends HttpFilter {
: Arrays.stream(paths.split(":")).collect(Collectors.toSet());
}
+ /**
+ * Allows Solr tests
+ */
private static boolean isSolrTest() {
return !GenericValue.getStackTraceAsString().contains("ControlFilterTests")
&& null == System.getProperty("SolrDispatchFilter");
(ofbiz-framework) 02/05: Fixed: Allow GroovyDSL in FlexibleStringExpander (OFBIZ-13133)
Posted by jl...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 23ec946b9a71ae9050098ed3f4d572ce149b71b7
Author: Jacques Le Roux <ja...@les7arts.com>
AuthorDate: Sun Oct 27 20:53:16 2024 +0100
Fixed: Allow GroovyDSL in FlexibleStringExpander (OFBIZ-13133)
Fixes a bug, there GROOVY_CLASS_LOADER is null, hence possible NPE.
"groovyClassLoader" should be used
---
framework/base/src/main/java/org/apache/ofbiz/base/util/GroovyUtil.java | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/framework/base/src/main/java/org/apache/ofbiz/base/util/GroovyUtil.java b/framework/base/src/main/java/org/apache/ofbiz/base/util/GroovyUtil.java
index 457d36c17e..0a6e10ce6f 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/GroovyUtil.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/GroovyUtil.java
@@ -198,7 +198,7 @@ public final class GroovyUtil {
return GROOVY_CLASS_LOADER.parseClass(text);
} else {
GroovyClassLoader groovyClassLoader = new GroovyClassLoader();
- Class<?> classLoader = GROOVY_CLASS_LOADER.parseClass(text);
+ Class<?> classLoader = groovyClassLoader.parseClass(text);
groovyClassLoader.close();
return classLoader;
}
(ofbiz-framework) 05/05: Improved: small improvements in SecurityUtilTest
Posted by jl...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 97aee6d8b0bf532ab5ae92257d8113085456ae6e
Author: Jacques Le Roux <ja...@les7arts.com>
AuthorDate: Mon Oct 28 14:24:19 2024 +0100
Improved: small improvements in SecurityUtilTest
Just comments improvements
---
.../src/test/java/org/apache/ofbiz/security/SecurityUtilTest.java | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/framework/security/src/test/java/org/apache/ofbiz/security/SecurityUtilTest.java b/framework/security/src/test/java/org/apache/ofbiz/security/SecurityUtilTest.java
index 2354a60b0c..7afc7f9966 100644
--- a/framework/security/src/test/java/org/apache/ofbiz/security/SecurityUtilTest.java
+++ b/framework/security/src/test/java/org/apache/ofbiz/security/SecurityUtilTest.java
@@ -64,7 +64,7 @@ public class SecurityUtilTest {
chmod,mkdir,fopen,fclose,new file,upload,getfilename,download,getoutputstring,readfile,iframe,object,embed,onload,build,\
python,perl ,/perl,ruby ,/ruby,process,function,class,InputStream,to_server,wget ,static,assign,webappPath,\
ifconfig,route,crontab,netstat,uname ,hostname,iptables,whoami,"cmd",*cmd|,+cmd|,=cmd|,localhost,thread,require,gzdeflate,\
- execute,println,calc,touch,curl,base64,tcp
+ execute,println,calc,touch,curl,base64,tcp,4444
*/
try {
List<String> allowed = new ArrayList<>();
@@ -138,7 +138,7 @@ public class SecurityUtilTest {
assertFalse(SecuredUpload.isValidText("hostname", allowed));
assertFalse(SecuredUpload.isValidText("iptables", allowed));
assertFalse(SecuredUpload.isValidText("whoami", allowed));
- // ip, ls, nc, ip, cat and pwd can't be used, too short
+ // ip, ls, nc, ip, cat and pwd can't be used, too short for allowing some images
assertFalse(SecuredUpload.isValidText("\"cmd\"", allowed));
assertFalse(SecuredUpload.isValidText("*cmd|", allowed));
assertFalse(SecuredUpload.isValidText("+cmd|", allowed));
(ofbiz-framework) 04/05: Improved: Fix some bugs SpotBugs reports (OFBIZ-12386)
Posted by jl...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 1bacac99e4b5cd2701c34c721fb42155cf90db00
Author: Jacques Le Roux <ja...@les7arts.com>
AuthorDate: Mon Oct 28 12:25:31 2024 +0100
Improved: Fix some bugs SpotBugs reports (OFBIZ-12386)
After https://gitbox.apache.org/repos/asf?p=ofbiz-framework.git;h=33fc03fa10
I thought the problem was fixed since it's excluded. But it was not because
there was a typo (a trailing blank in
<Bug pattern="SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR " />)
So I fixed that, but to my surprise it still does not work, weird :/
Fixes a possible NPE in DatabaseUtil::getTableNames
---
.../src/main/java/org/apache/ofbiz/entity/jdbc/DatabaseUtil.java | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/framework/entity/src/main/java/org/apache/ofbiz/entity/jdbc/DatabaseUtil.java b/framework/entity/src/main/java/org/apache/ofbiz/entity/jdbc/DatabaseUtil.java
index d166a892b0..595cece9f3 100644
--- a/framework/entity/src/main/java/org/apache/ofbiz/entity/jdbc/DatabaseUtil.java
+++ b/framework/entity/src/main/java/org/apache/ofbiz/entity/jdbc/DatabaseUtil.java
@@ -1091,7 +1091,9 @@ public class DatabaseUtil {
if (messages != null) messages.add(message);
} finally {
try {
- tableSet.close();
+ if (tableSet != null) {
+ tableSet.close();
+ }
} catch (SQLException e) {
String message = "Unable to close ResultSet for table list, continuing anyway... Error was:" + e.toString();
Debug.logError(message, MODULE);
(ofbiz-framework) 03/05: Improved: Fix some bugs SpotBugs reports (OFBIZ-12386)
Posted by jl...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 7bdf4b5c925f41610f5c81bf3773b93efff168cb
Author: Jacques Le Roux <ja...@les7arts.com>
AuthorDate: Mon Oct 28 12:08:09 2024 +0100
Improved: Fix some bugs SpotBugs reports (OFBIZ-12386)
After https://gitbox.apache.org/repos/asf?p=ofbiz-framework.git;h=33fc03fa10
I thought the problem was fixed since it's excluded. But it was not because
there was a typo (a trailing blank in
<Bug pattern="SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR " />)
So I fixed that, but to my surprise it still does not work, weird :/
---
spotbugs/exclude.xml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/spotbugs/exclude.xml b/spotbugs/exclude.xml
index ec37597473..bd57d274fa 100644
--- a/spotbugs/exclude.xml
+++ b/spotbugs/exclude.xml
@@ -193,9 +193,9 @@ under the License.
<Bug pattern="EQ_CHECK_FOR_OPERAND_NOT_COMPATIBLE_WITH_THIS" />
</Match><!-- ^ ^ not a problem, false positives -->
<Match>
- <!-- As it's also used by WebAppCacheTest class I made it package. That's safer but not enough so it's also here -->
+ <!-- As it's also used by WebAppCacheTest class I made it package. That's safer but not enough as private so it's here -->
<Class name="org.apache.ofbiz.webapp.WebAppCache" />
<Method name="WebAppCache" />
- <Bug pattern="SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR " />
+ <Bug pattern="SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR" />
</Match>
</FindBugsFilter>