diff --git a/.gitignore b/.gitignore index 1cc4c39..b93409f 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/resteasy-2.3.5.Final.tgz +SOURCES/resteasy-3.0.6.Final.tar.gz diff --git a/.resteasy-base.metadata b/.resteasy-base.metadata index 0bd58b7..41cc6ab 100644 --- a/.resteasy-base.metadata +++ b/.resteasy-base.metadata @@ -1 +1 @@ -673504436c9fab2397d483af0a1cadeaf8635296 SOURCES/resteasy-2.3.5.Final.tgz +e1e269887f5636ef7f05a07232c2697a23162db4 SOURCES/resteasy-3.0.6.Final.tar.gz diff --git a/SOURCES/0001-Mime4j-0.7.2-support.patch b/SOURCES/0001-Mime4j-0.7.2-support.patch new file mode 100644 index 0000000..6acf60d --- /dev/null +++ b/SOURCES/0001-Mime4j-0.7.2-support.patch @@ -0,0 +1,246 @@ +From 0e66cb23968c8ec56e4c26566790a8f09f380bca Mon Sep 17 00:00:00 2001 +From: Marek Goldmann +Date: Tue, 16 Jul 2013 14:14:07 +0200 +Subject: [PATCH] Mime4j 0.7.2 support + +--- + jaxrs/pom.xml | 14 ++++- + jaxrs/providers/multipart/pom.xml | 12 ++++- + .../multipart/MultipartFormDataInputImpl.java | 6 +-- + .../providers/multipart/MultipartInputImpl.java | 61 ++++++++++------------ + .../multipart/MultipartRelatedInputImpl.java | 4 +- + jaxrs/security/resteasy-crypto/pom.xml | 10 +++- + 6 files changed, 64 insertions(+), 43 deletions(-) + mode change 100755 => 100644 jaxrs/pom.xml + +diff --git a/jaxrs/pom.xml b/jaxrs/pom.xml +old mode 100755 +new mode 100644 +index 062e8da..45e5e8d +--- a/jaxrs/pom.xml ++++ b/jaxrs/pom.xml +@@ -251,8 +251,18 @@ + + + org.apache.james +- apache-mime4j +- 0.6 ++ apache-mime4j-core ++ 0.7.2 ++ ++ ++ org.apache.james ++ apache-mime4j-storage ++ 0.7.2 ++ ++ ++ org.apache.james ++ apache-mime4j-dom ++ 0.7.2 + + + junit +diff --git a/jaxrs/providers/multipart/pom.xml b/jaxrs/providers/multipart/pom.xml +index 16bdbd2..a6b25f0 100755 +--- a/jaxrs/providers/multipart/pom.xml ++++ b/jaxrs/providers/multipart/pom.xml +@@ -34,7 +34,15 @@ + + + org.apache.james +- apache-mime4j ++ apache-mime4j-core ++ ++ ++ org.apache.james ++ apache-mime4j-dom ++ ++ ++ org.apache.james ++ apache-mime4j-storage + + + javax.servlet +@@ -81,4 +89,4 @@ + + + +- +\ No newline at end of file ++ +diff --git a/jaxrs/providers/multipart/src/main/java/org/jboss/resteasy/plugins/providers/multipart/MultipartFormDataInputImpl.java b/jaxrs/providers/multipart/src/main/java/org/jboss/resteasy/plugins/providers/multipart/MultipartFormDataInputImpl.java +index d9ed2ad..b7aab17 100644 +--- a/jaxrs/providers/multipart/src/main/java/org/jboss/resteasy/plugins/providers/multipart/MultipartFormDataInputImpl.java ++++ b/jaxrs/providers/multipart/src/main/java/org/jboss/resteasy/plugins/providers/multipart/MultipartFormDataInputImpl.java +@@ -1,9 +1,9 @@ + package org.jboss.resteasy.plugins.providers.multipart; + +-import org.apache.james.mime4j.field.ContentDispositionField; +-import org.apache.james.mime4j.field.FieldName; ++import org.apache.james.mime4j.dom.field.ContentDispositionField; ++import org.apache.james.mime4j.dom.field.FieldName; + import org.apache.james.mime4j.message.BodyPart; +-import org.apache.james.mime4j.parser.Field; ++import org.apache.james.mime4j.stream.Field; + import org.jboss.resteasy.util.GenericType; + + import javax.ws.rs.core.MediaType; +diff --git a/jaxrs/providers/multipart/src/main/java/org/jboss/resteasy/plugins/providers/multipart/MultipartInputImpl.java b/jaxrs/providers/multipart/src/main/java/org/jboss/resteasy/plugins/providers/multipart/MultipartInputImpl.java +index 938c88e..01ddfa1 100644 +--- a/jaxrs/providers/multipart/src/main/java/org/jboss/resteasy/plugins/providers/multipart/MultipartInputImpl.java ++++ b/jaxrs/providers/multipart/src/main/java/org/jboss/resteasy/plugins/providers/multipart/MultipartInputImpl.java +@@ -4,22 +4,22 @@ import org.apache.james.mime4j.MimeException; + import org.apache.james.mime4j.MimeIOException; + import org.apache.james.mime4j.codec.Base64InputStream; + import org.apache.james.mime4j.codec.QuotedPrintableInputStream; +-import org.apache.james.mime4j.descriptor.BodyDescriptor; +-import org.apache.james.mime4j.field.ContentTypeField; +-import org.apache.james.mime4j.message.BinaryBody; +-import org.apache.james.mime4j.message.Body; ++import org.apache.james.mime4j.message.MessageImpl; ++import org.apache.james.mime4j.parser.AbstractContentHandler; ++import org.apache.james.mime4j.stream.BodyDescriptor; + import org.apache.james.mime4j.message.BodyFactory; ++import org.apache.james.mime4j.dom.MessageBuilder; ++import org.apache.james.mime4j.dom.MessageServiceFactory; ++import org.apache.james.mime4j.dom.field.ContentTypeField; ++import org.apache.james.mime4j.dom.BinaryBody; ++import org.apache.james.mime4j.dom.Body; ++import org.apache.james.mime4j.dom.Entity; + import org.apache.james.mime4j.message.BodyPart; +-import org.apache.james.mime4j.message.Entity; +-import org.apache.james.mime4j.message.Message; +-import org.apache.james.mime4j.message.MessageBuilder; +-import org.apache.james.mime4j.message.Multipart; +-import org.apache.james.mime4j.message.TextBody; +-import org.apache.james.mime4j.parser.Field; ++import org.apache.james.mime4j.dom.Message; ++import org.apache.james.mime4j.dom.Multipart; ++import org.apache.james.mime4j.dom.TextBody; ++import org.apache.james.mime4j.stream.Field; + import org.apache.james.mime4j.parser.MimeStreamParser; +-import org.apache.james.mime4j.storage.DefaultStorageProvider; +-import org.apache.james.mime4j.storage.StorageProvider; +-import org.apache.james.mime4j.util.CharsetUtil; + import org.apache.james.mime4j.util.MimeUtil; + import org.jboss.resteasy.spi.HttpRequest; + import org.jboss.resteasy.spi.ResteasyProviderFactory; +@@ -43,6 +43,7 @@ import java.lang.annotation.Annotation; + import java.lang.reflect.InvocationTargetException; + import java.lang.reflect.Method; + import java.lang.reflect.Type; ++import java.nio.charset.Charset; + import java.util.ArrayList; + import java.util.HashMap; + import java.util.Iterator; +@@ -65,7 +66,7 @@ public class MultipartInputImpl implements MultipartInput + protected String defaultPartCharset = null; + + // We hack MIME4j so that it always returns a BinaryBody so we don't have to deal with Readers and their charset conversions +- private static class BinaryOnlyMessageBuilder extends MessageBuilder ++ private static class BinaryOnlyMessageBuilder extends AbstractContentHandler + { + private Method expectMethod; + private java.lang.reflect.Field bodyFactoryField; +@@ -88,18 +89,6 @@ public class MultipartInputImpl implements MultipartInput + } + } + +- private BinaryOnlyMessageBuilder(Entity entity) +- { +- super(entity); +- init(); +- } +- +- private BinaryOnlyMessageBuilder(Entity entity, StorageProvider storageProvider) +- { +- super(entity, storageProvider); +- init(); +- } +- + @Override + public void body(BodyDescriptor bd, InputStream is) throws MimeException, IOException + { +@@ -143,13 +132,13 @@ public class MultipartInputImpl implements MultipartInput + } + } + +- private static class BinaryMessage extends Message ++ private static class BinaryMessage extends MessageImpl + { + private BinaryMessage(InputStream is) throws IOException, MimeIOException + { + try { +- MimeStreamParser parser = new MimeStreamParser(null); +- parser.setContentHandler(new BinaryOnlyMessageBuilder(this, DefaultStorageProvider.getInstance())); ++ MimeStreamParser parser = new MimeStreamParser(); ++ parser.setContentHandler(new BinaryOnlyMessageBuilder()); + parser.parse(is); + } catch (MimeException e) { + throw new MimeIOException(e); +@@ -194,8 +183,14 @@ public class MultipartInputImpl implements MultipartInput + + public void parse(InputStream is) throws IOException + { +- mimeMessage = new BinaryMessage(addHeaderToHeadlessStream(is)); +- extractParts(); ++ try { ++ MessageServiceFactory factory = MessageServiceFactory.newInstance(); ++ MessageBuilder builder = factory.newMessageBuilder(); ++ mimeMessage = builder.parseMessage(addHeaderToHeadlessStream(is)); ++ extractParts(); ++ } catch (MimeException e) { ++ throw new IOException("Couldn't parse message", e); ++ } + } + + protected InputStream addHeaderToHeadlessStream(InputStream is) +@@ -225,8 +220,8 @@ public class MultipartInputImpl implements MultipartInput + protected void extractParts() throws IOException + { + Multipart multipart = (Multipart) mimeMessage.getBody(); +- for (BodyPart bodyPart : multipart.getBodyParts()) +- parts.add(extractPart(bodyPart)); ++ for (Entity bodyPart : multipart.getBodyParts()) ++ parts.add(extractPart((BodyPart) bodyPart)); + } + + protected InputPart extractPart(BodyPart bodyPart) throws IOException +diff --git a/jaxrs/providers/multipart/src/main/java/org/jboss/resteasy/plugins/providers/multipart/MultipartRelatedInputImpl.java b/jaxrs/providers/multipart/src/main/java/org/jboss/resteasy/plugins/providers/multipart/MultipartRelatedInputImpl.java +index 698f937..fa2d889 100644 +--- a/jaxrs/providers/multipart/src/main/java/org/jboss/resteasy/plugins/providers/multipart/MultipartRelatedInputImpl.java ++++ b/jaxrs/providers/multipart/src/main/java/org/jboss/resteasy/plugins/providers/multipart/MultipartRelatedInputImpl.java +@@ -1,7 +1,7 @@ + package org.jboss.resteasy.plugins.providers.multipart; + +-import org.apache.james.mime4j.field.ContentTypeField; +-import org.apache.james.mime4j.field.FieldName; ++import org.apache.james.mime4j.dom.field.ContentTypeField; ++import org.apache.james.mime4j.dom.field.FieldName; + import org.apache.james.mime4j.message.BodyPart; + + import javax.ws.rs.core.MediaType; +diff --git a/jaxrs/security/resteasy-crypto/pom.xml b/jaxrs/security/resteasy-crypto/pom.xml +index 855f791..bd23c9f 100755 +--- a/jaxrs/security/resteasy-crypto/pom.xml ++++ b/jaxrs/security/resteasy-crypto/pom.xml +@@ -70,7 +70,15 @@ + + + org.apache.james +- apache-mime4j ++ apache-mime4j-dom ++ ++ ++ org.apache.james ++ apache-mime4j-core ++ ++ ++ org.apache.james ++ apache-mime4j-storage + + + +-- +1.8.3.1 + diff --git a/SOURCES/0002-bcmail-api-change.patch b/SOURCES/0002-bcmail-api-change.patch new file mode 100644 index 0000000..381b2e5 --- /dev/null +++ b/SOURCES/0002-bcmail-api-change.patch @@ -0,0 +1,129 @@ +diff -up ./jaxrs/security/resteasy-crypto/src/main/java/org/jboss/resteasy/security/smime/EnvelopedInputImpl.java.ade1 ./jaxrs/security/resteasy-crypto/src/main/java/org/jboss/resteasy/security/smime/EnvelopedInputImpl.java +--- ./jaxrs/security/resteasy-crypto/src/main/java/org/jboss/resteasy/security/smime/EnvelopedInputImpl.java.ade1 2014-06-26 16:24:28.166315424 +0800 ++++ ./jaxrs/security/resteasy-crypto/src/main/java/org/jboss/resteasy/security/smime/EnvelopedInputImpl.java 2014-06-26 17:32:29.632936971 +0800 +@@ -3,6 +3,7 @@ package org.jboss.resteasy.security.smim + import org.bouncycastle.cms.RecipientInformation; + import org.bouncycastle.cms.RecipientInformationStore; + import org.bouncycastle.cms.jcajce.JceKeyTransRecipientId; ++import org.bouncycastle.cms.jcajce.JceKeyTransEnvelopedRecipient; + import org.bouncycastle.mail.smime.SMIMEEnveloped; + import org.bouncycastle.mail.smime.SMIMEUtil; + import org.jboss.resteasy.core.Headers; +@@ -159,7 +160,8 @@ public class EnvelopedInputImpl implemen + RecipientInformationStore recipients = m.getRecipientInfos(); + RecipientInformation recipient = recipients.get(recId); + +- decrypted = SMIMEUtil.toMimeBodyPart(recipient.getContent(pKey, "BC")); ++ decrypted = SMIMEUtil.toMimeBodyPart(recipient.getContent( ++ new JceKeyTransEnvelopedRecipient(pKey).setProvider("BC"))); + } + catch (Exception e1) + { +diff -up ./jaxrs/security/resteasy-crypto/src/main/java/org/jboss/resteasy/security/smime/MultipartSignedInputImpl.java.ade1 ./jaxrs/security/resteasy-crypto/src/main/java/org/jboss/resteasy/security/smime/MultipartSignedInputImpl.java +--- ./jaxrs/security/resteasy-crypto/src/main/java/org/jboss/resteasy/security/smime/MultipartSignedInputImpl.java.ade1 2014-06-26 17:07:37.679401083 +0800 ++++ ./jaxrs/security/resteasy-crypto/src/main/java/org/jboss/resteasy/security/smime/MultipartSignedInputImpl.java 2014-06-26 17:11:10.734149755 +0800 +@@ -2,6 +2,7 @@ package org.jboss.resteasy.security.smim + + import org.bouncycastle.cms.SignerInformation; + import org.bouncycastle.cms.SignerInformationStore; ++import org.bouncycastle.cms.jcajce.JcaSimpleSignerInfoVerifierBuilder; + import org.bouncycastle.mail.smime.SMIMESigned; + import org.jboss.resteasy.util.GenericType; + +@@ -157,7 +158,8 @@ public class MultipartSignedInputImpl im + + SignerInformationStore signers = signed.getSignerInfos(); + SignerInformation signer = (SignerInformation) signers.getSigners().iterator().next(); +- return signer.verify(publicKey, "BC"); ++ return signer.verify(new JcaSimpleSignerInfoVerifierBuilder() ++ .setProvider("BC").build(publicKey)); + + } + +diff -up ./jaxrs/security/resteasy-crypto/src/main/java/org/jboss/resteasy/security/smime/PKCS7SignatureInput.java.ade1 ./jaxrs/security/resteasy-crypto/src/main/java/org/jboss/resteasy/security/smime/PKCS7SignatureInput.java +--- ./jaxrs/security/resteasy-crypto/src/main/java/org/jboss/resteasy/security/smime/PKCS7SignatureInput.java.ade1 2014-06-26 16:36:24.564853001 +0800 ++++ ./jaxrs/security/resteasy-crypto/src/main/java/org/jboss/resteasy/security/smime/PKCS7SignatureInput.java 2014-06-26 18:52:43.301108577 +0800 +@@ -3,6 +3,7 @@ package org.jboss.resteasy.security.smim + import org.bouncycastle.cms.CMSException; + import org.bouncycastle.cms.CMSSignedData; + import org.bouncycastle.cms.SignerInformation; ++import org.bouncycastle.cms.jcajce.JcaSimpleSignerInfoVerifierBuilder; + import org.jboss.resteasy.specimpl.MultivaluedMapImpl; + import org.jboss.resteasy.util.Base64; + import org.jboss.resteasy.util.GenericType; +@@ -206,7 +207,8 @@ public class PKCS7SignatureInput + for (Object info : data.getSignerInfos().getSigners()) + { + SignerInformation signer = (SignerInformation)info; +- if (signer.verify(certificate, "BC")) ++ if (signer.verify(new JcaSimpleSignerInfoVerifierBuilder() ++ .setProvider("BC").build(certificate))) + { + return true; + } +@@ -218,7 +220,8 @@ public class PKCS7SignatureInput + for (Object info : data.getSignerInfos().getSigners()) + { + SignerInformation signer = (SignerInformation)info; +- if (signer.verify(publicKey, "BC")) ++ if (signer.verify(new JcaSimpleSignerInfoVerifierBuilder() ++ .setProvider("BC").build(publicKey))) + { + return true; + } +diff -up ./jaxrs/security/resteasy-crypto/src/main/java/org/jboss/resteasy/security/smime/PKCS7SignatureWriter.java.ade1 ./jaxrs/security/resteasy-crypto/src/main/java/org/jboss/resteasy/security/smime/PKCS7SignatureWriter.java +--- ./jaxrs/security/resteasy-crypto/src/main/java/org/jboss/resteasy/security/smime/PKCS7SignatureWriter.java.ade1 2014-06-24 23:38:42.464516920 +0800 ++++ ./jaxrs/security/resteasy-crypto/src/main/java/org/jboss/resteasy/security/smime/PKCS7SignatureWriter.java 2014-06-26 18:05:06.601349666 +0800 +@@ -4,7 +4,13 @@ import org.bouncycastle.cms.CMSException + import org.bouncycastle.cms.CMSProcessable; + import org.bouncycastle.cms.CMSProcessableByteArray; + import org.bouncycastle.cms.CMSSignedData; ++import org.bouncycastle.cms.CMSTypedData; + import org.bouncycastle.cms.CMSSignedDataGenerator; ++import org.bouncycastle.operator.ContentSigner; ++import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder; ++import org.bouncycastle.cms.jcajce.JcaSignerInfoGeneratorBuilder; ++import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder; ++import org.bouncycastle.operator.OperatorCreationException; + import org.jboss.resteasy.security.BouncyIntegration; + import org.jboss.resteasy.specimpl.MultivaluedMapImpl; + import org.jboss.resteasy.spi.WriterException; +@@ -25,6 +31,7 @@ import java.lang.reflect.Type; + import java.security.NoSuchAlgorithmException; + import java.security.NoSuchProviderException; + import java.security.cert.X509Certificate; ++import java.security.cert.CertificateEncodingException; + + /** + * @author Bill Burke +@@ -70,7 +77,7 @@ public class PKCS7SignatureWriter implem + } + } + +- public static byte[] sign(Providers providers, SignedOutput out) throws IOException, NoSuchAlgorithmException, NoSuchProviderException, CMSException ++ public static byte[] sign(Providers providers, SignedOutput out) throws IOException, NoSuchAlgorithmException, NoSuchProviderException, CMSException, OperatorCreationException, CertificateEncodingException + { + ByteArrayOutputStream bodyOs = new ByteArrayOutputStream(); + MessageBodyWriter writer = providers.getMessageBodyWriter(out.getType(), out.getGenericType(), null, out.getMediaType()); +@@ -82,11 +89,18 @@ public class PKCS7SignatureWriter implem + bodyHeaders.add("Content-Type", out.getMediaType().toString()); + writer.writeTo(out.getEntity(), out.getType(), out.getGenericType(), null, out.getMediaType(), bodyHeaders, bodyOs); + CMSSignedDataGenerator signGen = new CMSSignedDataGenerator(); +- signGen.addSigner(out.getPrivateKey(), (X509Certificate)out.getCertificate(), CMSSignedDataGenerator.DIGEST_SHA1); ++ ++ ContentSigner sha1Signer = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC").build(out.getPrivateKey()); ++ signGen.addSignerInfoGenerator( ++ new JcaSignerInfoGeneratorBuilder( ++ new JcaDigestCalculatorProviderBuilder().setProvider("BC").build()) ++ .build(sha1Signer, (X509Certificate)out.getCertificate())); ++ ++ //signGen.addSigner(out.getPrivateKey(), (X509Certificate)out.getCertificate(), CMSSignedDataGenerator.DIGEST_SHA1); + //signGen.addCertificatesAndCRLs(certs); +- CMSProcessable content = new CMSProcessableByteArray(bodyOs.toByteArray()); ++ CMSTypedData content = new CMSProcessableByteArray(bodyOs.toByteArray()); + +- CMSSignedData signedData = signGen.generate(content, true, "BC"); ++ CMSSignedData signedData = signGen.generate(content, true); + return signedData.getEncoded(); + } + } diff --git a/SOURCES/resteasy-2.3.5.Final-resteasy-1073.patch b/SOURCES/resteasy-2.3.5.Final-resteasy-1073.patch deleted file mode 100644 index 3fa8b63..0000000 --- a/SOURCES/resteasy-2.3.5.Final-resteasy-1073.patch +++ /dev/null @@ -1,497 +0,0 @@ -diff -Nurb resteasy-2.3.5.Final.orig/arquillian/pom.xml resteasy-2.3.5.Final/arquillian/pom.xml ---- resteasy-2.3.5.Final.orig/arquillian/pom.xml 2014-07-25 15:36:38.637079327 -0400 -+++ resteasy-2.3.5.Final/arquillian/pom.xml 2014-07-25 15:52:17.575397163 -0400 -@@ -15,6 +15,7 @@ - - RESTEASY-752-jetty - RESTEASY-760-jetty -+ RESTEASY-1073-WF8 - - - arquillian -diff -Nurb resteasy-2.3.5.Final.orig/arquillian/RESTEASY-1073-WF8/pom.xml resteasy-2.3.5.Final/arquillian/RESTEASY-1073-WF8/pom.xml ---- resteasy-2.3.5.Final.orig/arquillian/RESTEASY-1073-WF8/pom.xml 1969-12-31 19:00:00.000000000 -0500 -+++ resteasy-2.3.5.Final/arquillian/RESTEASY-1073-WF8/pom.xml 2014-07-25 15:38:04.783298392 -0400 -@@ -0,0 +1,189 @@ -+ -+ -+ 4.0.0 -+ -+ -+ org.jboss.resteasy -+ resteasy-jaxrs-all -+ 3.0.8.Final -+ ../../pom.xml -+ -+ -+ RESTEASY-1073-WF8 -+ jar -+ RESTEASY-1073-WF8 -+ http://maven.apache.org -+ -+ -+ UTF-8 -+ 8.0.0.Final -+ -+ -+ -+ -+ -+ org.apache.maven.plugins -+ maven-compiler-plugin -+ 2.3.2 -+ -+ 1.6 -+ 1.6 -+ -+ -+ -+ maven-surefire-plugin -+ 2.12 -+ -+ -+ maven-dependency-plugin -+ -+ -+ unpack -+ process-test-classes -+ -+ unpack -+ -+ -+ -+ -+ org.wildfly -+ wildfly-dist -+ ${as-version} -+ zip -+ false -+ target -+ -+ -+ -+ -+ -+ -+ -+ org.apache.maven.plugins -+ maven-antrun-plugin -+ 1.6 -+ -+ -+ unpack resteasy -+ process-test-classes -+ -+ -+ -+ -+ -+ -+ run -+ -+ -+ -+ -+ -+ -+ org.apache.maven.plugins -+ maven-war-plugin -+ -+ -+ -+ -+ javax.xml.bind.api -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ org.jboss.arquillian -+ arquillian-bom -+ 1.0.3.Final -+ import -+ pom -+ -+ -+ -+ -+ -+ -+ org.jboss.spec -+ jboss-javaee-6.0 -+ 1.0.0.Final -+ pom -+ provided -+ -+ -+ junit -+ junit -+ 4.8.1 -+ test -+ -+ -+ org.jboss.arquillian.junit -+ arquillian-junit-container -+ test -+ -+ -+ org.wildfly -+ wildfly-arquillian-container-managed -+ 8.0.0.Alpha1 -+ test -+ -+ -+ org.jboss.arquillian.protocol -+ arquillian-protocol-servlet -+ test -+ -+ -+ org.jboss.resteasy -+ jaxrs-api -+ ${project.version} -+ -+ -+ org.jboss.resteasy -+ resteasy-jaxrs -+ ${project.version} -+ -+ -+ org.jboss.resteasy -+ resteasy-validator-provider-11 -+ ${project.version} -+ -+ -+ javax.validation -+ validation-api -+ 1.1.0.Final -+ -+ -+ org.hibernate -+ hibernate-validator -+ 5.0.1.Final -+ -+ -+ javax.el -+ javax.el-api -+ 2.2.4 -+ -+ -+ org.glassfish.web -+ javax.el -+ 2.2.4 -+ -+ -+ org.jboss.spec.javax.xml.bind -+ jboss-jaxb-api_2.2_spec -+ 1.0.4.Final -+ -+ -+ org.jboss.resteasy -+ resteasy-jaxb-provider -+ ${project.version} -+ test -+ -+ -+ -diff -Nurb resteasy-2.3.5.Final.orig/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestApplication.java resteasy-2.3.5.Final/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestApplication.java ---- resteasy-2.3.5.Final.orig/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestApplication.java 1969-12-31 19:00:00.000000000 -0500 -+++ resteasy-2.3.5.Final/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestApplication.java 2014-07-25 15:40:28.833658314 -0400 -@@ -0,0 +1,16 @@ -+package org.jboss.resteasy.resteasy1073; -+ -+import java.util.HashSet; -+import java.util.Set; -+ -+import javax.ws.rs.core.Application; -+ -+public class TestApplication extends Application -+{ -+ @Override -+ public Set> getClasses() { -+ HashSet> set = new HashSet>(); -+ set.add(TestResource.class); -+ return set; -+ } -+} -diff -Nurb resteasy-2.3.5.Final.orig/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestResource.java resteasy-2.3.5.Final/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestResource.java ---- resteasy-2.3.5.Final.orig/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestResource.java 1969-12-31 19:00:00.000000000 -0500 -+++ resteasy-2.3.5.Final/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestResource.java 2014-07-25 15:41:14.393770993 -0400 -@@ -0,0 +1,26 @@ -+package org.jboss.resteasy.resteasy1073; -+ -+import javax.ws.rs.Consumes; -+import javax.ws.rs.POST; -+import javax.ws.rs.Path; -+import javax.ws.rs.core.MediaType; -+ -+/** -+* RESTEASY-1073 -+* -+* @author Ron Sigal -+* @version $Revision: 1.1 $ -+* -+* Copyright July 19, 2014 -+*/ -+@Path("") -+public class TestResource -+{ -+ @POST -+ @Path("test") -+ @Consumes(MediaType.APPLICATION_XML) -+ public String post(TestWrapper wrapper) -+ { -+ return wrapper.getName(); -+ } -+} -diff -Nurb resteasy-2.3.5.Final.orig/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestWrapper.java resteasy-2.3.5.Final/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestWrapper.java ---- resteasy-2.3.5.Final.orig/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestWrapper.java 1969-12-31 19:00:00.000000000 -0500 -+++ resteasy-2.3.5.Final/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestWrapper.java 2014-07-25 15:41:52.762865571 -0400 -@@ -0,0 +1,17 @@ -+package org.jboss.resteasy.resteasy1073; -+ -+import javax.xml.bind.annotation.XmlRootElement; -+ -+@XmlRootElement -+public class TestWrapper -+{ -+ private String name; -+ public String getName() -+ { -+ return name; -+ } -+ public void setName(String name) -+ { -+ this.name = name; -+ } -+} -diff -Nurb resteasy-2.3.5.Final.orig/arquillian/RESTEASY-1073-WF8/src/test/java/org/jboss/resteasy/test/resteasy1073/TestExternalParameterEntity.java resteasy-2.3.5.Final/arquillian/RESTEASY-1073-WF8/src/test/java/org/jboss/resteasy/test/resteasy1073/TestExternalParameterEntity.java ---- resteasy-2.3.5.Final.orig/arquillian/RESTEASY-1073-WF8/src/test/java/org/jboss/resteasy/test/resteasy1073/TestExternalParameterEntity.java 1969-12-31 19:00:00.000000000 -0500 -+++ resteasy-2.3.5.Final/arquillian/RESTEASY-1073-WF8/src/test/java/org/jboss/resteasy/test/resteasy1073/TestExternalParameterEntity.java 2014-07-25 15:43:11.465058832 -0400 -@@ -0,0 +1,96 @@ -+package org.jboss.resteasy.test.resteasy1073; -+ -+import java.io.File; -+ -+import javax.ws.rs.core.MediaType; -+ -+import junit.framework.Assert; -+ -+import org.jboss.arquillian.container.test.api.Deployment; -+import org.jboss.arquillian.junit.Arquillian; -+import org.jboss.resteasy.client.ClientRequest; -+import org.jboss.resteasy.client.ClientResponse; -+import org.jboss.resteasy.resteasy1073.TestApplication; -+import org.jboss.resteasy.resteasy1073.TestResource; -+import org.jboss.resteasy.resteasy1073.TestWrapper; -+import org.jboss.shrinkwrap.api.Archive; -+import org.jboss.shrinkwrap.api.ShrinkWrap; -+import org.jboss.shrinkwrap.api.spec.WebArchive; -+import org.junit.Test; -+import org.junit.runner.RunWith; -+ -+/** -+ * RESTEASY-1073. -+ * -+ * @author Ron Sigal -+ * @version $Revision: 1.1 $ -+ * -+ * Created July 19, 2014 -+ */ -+@RunWith(Arquillian.class) -+public class TestExternalParameterEntity -+{ -+ @Deployment(name="war_expand", order=1) -+ public static Archive createTestArchive1() -+ { -+ WebArchive war = ShrinkWrap.create(WebArchive.class, "RESTEASY-1073-expand.war") -+ .addClasses(TestApplication.class) -+ .addClasses(TestResource.class, TestWrapper.class) -+ .addAsWebInfResource("web_expand.xml", "web.xml") -+ ; -+ System.out.println(war.toString(true)); -+ return war; -+ } -+ -+ @Deployment(name="war_no_expand", order=2) -+ public static Archive createTestArchive2() -+ { -+ WebArchive war = ShrinkWrap.create(WebArchive.class, "RESTEASY-1073-no-expand.war") -+ .addClasses(TestApplication.class) -+ .addClasses(TestResource.class, TestWrapper.class) -+ .addAsWebInfResource("web_no_expand.xml", "web.xml") -+ ; -+ System.out.println(war.toString(true)); -+ return war; -+ } -+ -+ private String passwdFile = new File("src/test/resources/passwd").getAbsolutePath(); -+ private String dtdFile = new File("src/test/resources/test.dtd").getAbsolutePath(); -+ -+ private String text = -+"\r" + -+" \r" + -+" \">\r" + -+" \r" + -+"%dtd;\r" + -+"]>\r" + -+"&xxe;"; -+ -+ @Test -+ public void testExternalParameterEntityExpand() throws Exception -+ { -+ ClientRequest request = new ClientRequest("http://localhost:8080/RESTEASY-1073-expand/test"); -+ System.out.println(text); -+ request.body(MediaType.APPLICATION_XML, text); -+ ClientResponse response = request.post(); -+ Assert.assertEquals(200, response.getStatus()); -+ String entity = response.getEntity(String.class); -+ System.out.println("Result: " + entity); -+ Assert.assertEquals("root:x:0:0:root:/root:/bin/bash", entity.trim()); -+ } -+ -+ @Test -+ public void testExternalParameterEntityNoExpand() throws Exception -+ { -+ ClientRequest request = new ClientRequest("http://localhost:8080/RESTEASY-1073-no-expand/test"); -+ System.out.println(text); -+ request.body(MediaType.APPLICATION_XML, text); -+ ClientResponse response = request.post(); -+ Assert.assertEquals(200, response.getStatus()); -+ String entity = response.getEntity(String.class); -+ System.out.println("Result: " + entity); -+ Assert.assertEquals("", entity.trim()); -+ } -+} -+ -diff -Nurb resteasy-2.3.5.Final.orig/arquillian/RESTEASY-1073-WF8/src/test/resources/arquillian.xml resteasy-2.3.5.Final/arquillian/RESTEASY-1073-WF8/src/test/resources/arquillian.xml ---- resteasy-2.3.5.Final.orig/arquillian/RESTEASY-1073-WF8/src/test/resources/arquillian.xml 1969-12-31 19:00:00.000000000 -0500 -+++ resteasy-2.3.5.Final/arquillian/RESTEASY-1073-WF8/src/test/resources/arquillian.xml 2014-07-25 15:44:43.551284000 -0400 -@@ -0,0 +1,23 @@ -+ -+ -+ -+ -+ -+ -+ target/deployments -+ -+ -+ -+ -+ target/wildfly-8.0.0.Final -+ -+ standalone-full.xml -+ -+ -+ -+ -+ -diff -Nurb resteasy-2.3.5.Final.orig/arquillian/RESTEASY-1073-WF8/src/test/resources/passwd resteasy-2.3.5.Final/arquillian/RESTEASY-1073-WF8/src/test/resources/passwd ---- resteasy-2.3.5.Final.orig/arquillian/RESTEASY-1073-WF8/src/test/resources/passwd 1969-12-31 19:00:00.000000000 -0500 -+++ resteasy-2.3.5.Final/arquillian/RESTEASY-1073-WF8/src/test/resources/passwd 2014-07-25 15:49:38.648001614 -0400 -@@ -0,0 +1 @@ -+root:x:0:0:root:/root:/bin/bash -diff -Nurb resteasy-2.3.5.Final.orig/arquillian/RESTEASY-1073-WF8/src/test/resources/test.dtd resteasy-2.3.5.Final/arquillian/RESTEASY-1073-WF8/src/test/resources/test.dtd ---- resteasy-2.3.5.Final.orig/arquillian/RESTEASY-1073-WF8/src/test/resources/test.dtd 1969-12-31 19:00:00.000000000 -0500 -+++ resteasy-2.3.5.Final/arquillian/RESTEASY-1073-WF8/src/test/resources/test.dtd 2014-07-25 15:50:14.822089344 -0400 -@@ -0,0 +1 @@ -+ -diff -Nurb resteasy-2.3.5.Final.orig/arquillian/RESTEASY-1073-WF8/src/test/resources/web_expand.xml resteasy-2.3.5.Final/arquillian/RESTEASY-1073-WF8/src/test/resources/web_expand.xml ---- resteasy-2.3.5.Final.orig/arquillian/RESTEASY-1073-WF8/src/test/resources/web_expand.xml 1969-12-31 19:00:00.000000000 -0500 -+++ resteasy-2.3.5.Final/arquillian/RESTEASY-1073-WF8/src/test/resources/web_expand.xml 2014-07-25 15:50:50.589177751 -0400 -@@ -0,0 +1,29 @@ -+ -+ -+ RESTEASY-1073-Expand -+ -+ -+ resteasy.document.expand.entity.references -+ true -+ -+ -+ -+ Resteasy -+ -+ -+ org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher -+ -+ -+ javax.ws.rs.Application -+ org.jboss.resteasy.resteasy1073.TestApplication -+ -+ -+ -+ -+ Resteasy -+ /* -+ -+ -+ -diff -Nurb resteasy-2.3.5.Final.orig/arquillian/RESTEASY-1073-WF8/src/test/resources/web_no_expand.xml resteasy-2.3.5.Final/arquillian/RESTEASY-1073-WF8/src/test/resources/web_no_expand.xml ---- resteasy-2.3.5.Final.orig/arquillian/RESTEASY-1073-WF8/src/test/resources/web_no_expand.xml 1969-12-31 19:00:00.000000000 -0500 -+++ resteasy-2.3.5.Final/arquillian/RESTEASY-1073-WF8/src/test/resources/web_no_expand.xml 2014-07-25 15:51:27.218270317 -0400 -@@ -0,0 +1,29 @@ -+ -+ -+ RESTEASY-1073-NoExpand -+ -+ -+ resteasy.document.expand.entity.references -+ false -+ -+ -+ -+ Resteasy -+ -+ -+ org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher -+ -+ -+ javax.ws.rs.Application -+ org.jboss.resteasy.resteasy1073.TestApplication -+ -+ -+ -+ -+ Resteasy -+ /* -+ -+ -+ -diff -Nurb resteasy-2.3.5.Final.orig/providers/jaxb/src/main/java/org/jboss/resteasy/plugins/providers/jaxb/ExternalEntityUnmarshaller.java resteasy-2.3.5.Final/providers/jaxb/src/main/java/org/jboss/resteasy/plugins/providers/jaxb/ExternalEntityUnmarshaller.java ---- resteasy-2.3.5.Final.orig/providers/jaxb/src/main/java/org/jboss/resteasy/plugins/providers/jaxb/ExternalEntityUnmarshaller.java 2014-07-25 15:36:38.989080230 -0400 -+++ resteasy-2.3.5.Final/providers/jaxb/src/main/java/org/jboss/resteasy/plugins/providers/jaxb/ExternalEntityUnmarshaller.java 2014-07-25 15:54:25.056716412 -0400 -@@ -150,6 +150,7 @@ - XMLReader xmlReader = XMLReaderFactory.createXMLReader(); - xmlReader.setFeature("http://xml.org/sax/features/validation", false); - xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", false); -+ xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false); - SAXSource saxSource = new SAXSource(xmlReader, source); - return delegate.unmarshal(saxSource); - } -@@ -188,6 +189,7 @@ - XMLReader xmlReader = XMLReaderFactory.createXMLReader(); - xmlReader.setFeature("http://xml.org/sax/features/validation", false); - xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", false); -+ xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false); - ((SAXSource) source).setXMLReader(xmlReader); - return delegate.unmarshal(source, declaredType); - } diff --git a/SOURCES/resteasy-3.0.6.Final-resteasy-1073.patch b/SOURCES/resteasy-3.0.6.Final-resteasy-1073.patch new file mode 100644 index 0000000..70c5485 --- /dev/null +++ b/SOURCES/resteasy-3.0.6.Final-resteasy-1073.patch @@ -0,0 +1,497 @@ +diff -Nurb resteasy-3.0.6.Final/jaxrs/arquillian/RESTEASY-1073-WF8/pom.xml resteasy-2.3.5.Final/jaxrs/arquillian/RESTEASY-1073-WF8/pom.xml +--- resteasy-3.0.6.Final/jaxrs/arquillian/RESTEASY-1073-WF8/pom.xml 1969-12-31 19:00:00.000000000 -0500 ++++ resteasy-2.3.5.Final/jaxrs/arquillian/RESTEASY-1073-WF8/pom.xml 2014-07-25 15:38:04.783298392 -0400 +@@ -0,0 +1,189 @@ ++ ++ ++ 4.0.0 ++ ++ ++ org.jboss.resteasy ++ resteasy-jaxrs-all ++ 3.0.8.Final ++ ../../pom.xml ++ ++ ++ RESTEASY-1073-WF8 ++ jar ++ RESTEASY-1073-WF8 ++ http://maven.apache.org ++ ++ ++ UTF-8 ++ 8.0.0.Final ++ ++ ++ ++ ++ ++ org.apache.maven.plugins ++ maven-compiler-plugin ++ 2.3.2 ++ ++ 1.6 ++ 1.6 ++ ++ ++ ++ maven-surefire-plugin ++ 2.12 ++ ++ ++ maven-dependency-plugin ++ ++ ++ unpack ++ process-test-classes ++ ++ unpack ++ ++ ++ ++ ++ org.wildfly ++ wildfly-dist ++ ${as-version} ++ zip ++ false ++ target ++ ++ ++ ++ ++ ++ ++ ++ org.apache.maven.plugins ++ maven-antrun-plugin ++ 1.6 ++ ++ ++ unpack resteasy ++ process-test-classes ++ ++ ++ ++ ++ ++ ++ run ++ ++ ++ ++ ++ ++ ++ org.apache.maven.plugins ++ maven-war-plugin ++ ++ ++ ++ ++ javax.xml.bind.api ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ org.jboss.arquillian ++ arquillian-bom ++ 1.0.3.Final ++ import ++ pom ++ ++ ++ ++ ++ ++ ++ org.jboss.spec ++ jboss-javaee-6.0 ++ 1.0.0.Final ++ pom ++ provided ++ ++ ++ junit ++ junit ++ 4.8.1 ++ test ++ ++ ++ org.jboss.arquillian.junit ++ arquillian-junit-container ++ test ++ ++ ++ org.wildfly ++ wildfly-arquillian-container-managed ++ 8.0.0.Alpha1 ++ test ++ ++ ++ org.jboss.arquillian.protocol ++ arquillian-protocol-servlet ++ test ++ ++ ++ org.jboss.resteasy ++ jaxrs-api ++ ${project.version} ++ ++ ++ org.jboss.resteasy ++ resteasy-jaxrs ++ ${project.version} ++ ++ ++ org.jboss.resteasy ++ resteasy-validator-provider-11 ++ ${project.version} ++ ++ ++ javax.validation ++ validation-api ++ 1.1.0.Final ++ ++ ++ org.hibernate ++ hibernate-validator ++ 5.0.1.Final ++ ++ ++ javax.el ++ javax.el-api ++ 2.2.4 ++ ++ ++ org.glassfish.web ++ javax.el ++ 2.2.4 ++ ++ ++ org.jboss.spec.javax.xml.bind ++ jboss-jaxb-api_2.2_spec ++ 1.0.4.Final ++ ++ ++ org.jboss.resteasy ++ resteasy-jaxb-provider ++ ${project.version} ++ test ++ ++ ++ +diff -Nurb resteasy-3.0.6.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestApplication.java resteasy-2.3.5.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestApplication.java +--- resteasy-3.0.6.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestApplication.java 1969-12-31 19:00:00.000000000 -0500 ++++ resteasy-2.3.5.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestApplication.java 2014-07-25 15:40:28.833658314 -0400 +@@ -0,0 +1,16 @@ ++package org.jboss.resteasy.resteasy1073; ++ ++import java.util.HashSet; ++import java.util.Set; ++ ++import javax.ws.rs.core.Application; ++ ++public class TestApplication extends Application ++{ ++ @Override ++ public Set> getClasses() { ++ HashSet> set = new HashSet>(); ++ set.add(TestResource.class); ++ return set; ++ } ++} +diff -Nurb resteasy-3.0.6.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestResource.java resteasy-2.3.5.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestResource.java +--- resteasy-3.0.6.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestResource.java 1969-12-31 19:00:00.000000000 -0500 ++++ resteasy-2.3.5.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestResource.java 2014-07-25 15:41:14.393770993 -0400 +@@ -0,0 +1,26 @@ ++package org.jboss.resteasy.resteasy1073; ++ ++import javax.ws.rs.Consumes; ++import javax.ws.rs.POST; ++import javax.ws.rs.Path; ++import javax.ws.rs.core.MediaType; ++ ++/** ++* RESTEASY-1073 ++* ++* @author Ron Sigal ++* @version $Revision: 1.1 $ ++* ++* Copyright July 19, 2014 ++*/ ++@Path("") ++public class TestResource ++{ ++ @POST ++ @Path("test") ++ @Consumes(MediaType.APPLICATION_XML) ++ public String post(TestWrapper wrapper) ++ { ++ return wrapper.getName(); ++ } ++} +diff -Nurb resteasy-3.0.6.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestWrapper.java resteasy-2.3.5.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestWrapper.java +--- resteasy-3.0.6.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestWrapper.java 1969-12-31 19:00:00.000000000 -0500 ++++ resteasy-2.3.5.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/main/java/org/jboss/resteasy/resteasy1073/TestWrapper.java 2014-07-25 15:41:52.762865571 -0400 +@@ -0,0 +1,17 @@ ++package org.jboss.resteasy.resteasy1073; ++ ++import javax.xml.bind.annotation.XmlRootElement; ++ ++@XmlRootElement ++public class TestWrapper ++{ ++ private String name; ++ public String getName() ++ { ++ return name; ++ } ++ public void setName(String name) ++ { ++ this.name = name; ++ } ++} +diff -Nurb resteasy-3.0.6.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/java/org/jboss/resteasy/test/resteasy1073/TestExternalParameterEntity.java resteasy-2.3.5.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/java/org/jboss/resteasy/test/resteasy1073/TestExternalParameterEntity.java +--- resteasy-3.0.6.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/java/org/jboss/resteasy/test/resteasy1073/TestExternalParameterEntity.java 1969-12-31 19:00:00.000000000 -0500 ++++ resteasy-2.3.5.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/java/org/jboss/resteasy/test/resteasy1073/TestExternalParameterEntity.java 2014-07-25 15:43:11.465058832 -0400 +@@ -0,0 +1,96 @@ ++package org.jboss.resteasy.test.resteasy1073; ++ ++import java.io.File; ++ ++import javax.ws.rs.core.MediaType; ++ ++import junit.framework.Assert; ++ ++import org.jboss.arquillian.container.test.api.Deployment; ++import org.jboss.arquillian.junit.Arquillian; ++import org.jboss.resteasy.client.ClientRequest; ++import org.jboss.resteasy.client.ClientResponse; ++import org.jboss.resteasy.resteasy1073.TestApplication; ++import org.jboss.resteasy.resteasy1073.TestResource; ++import org.jboss.resteasy.resteasy1073.TestWrapper; ++import org.jboss.shrinkwrap.api.Archive; ++import org.jboss.shrinkwrap.api.ShrinkWrap; ++import org.jboss.shrinkwrap.api.spec.WebArchive; ++import org.junit.Test; ++import org.junit.runner.RunWith; ++ ++/** ++ * RESTEASY-1073. ++ * ++ * @author Ron Sigal ++ * @version $Revision: 1.1 $ ++ * ++ * Created July 19, 2014 ++ */ ++@RunWith(Arquillian.class) ++public class TestExternalParameterEntity ++{ ++ @Deployment(name="war_expand", order=1) ++ public static Archive createTestArchive1() ++ { ++ WebArchive war = ShrinkWrap.create(WebArchive.class, "RESTEASY-1073-expand.war") ++ .addClasses(TestApplication.class) ++ .addClasses(TestResource.class, TestWrapper.class) ++ .addAsWebInfResource("web_expand.xml", "web.xml") ++ ; ++ System.out.println(war.toString(true)); ++ return war; ++ } ++ ++ @Deployment(name="war_no_expand", order=2) ++ public static Archive createTestArchive2() ++ { ++ WebArchive war = ShrinkWrap.create(WebArchive.class, "RESTEASY-1073-no-expand.war") ++ .addClasses(TestApplication.class) ++ .addClasses(TestResource.class, TestWrapper.class) ++ .addAsWebInfResource("web_no_expand.xml", "web.xml") ++ ; ++ System.out.println(war.toString(true)); ++ return war; ++ } ++ ++ private String passwdFile = new File("src/test/resources/passwd").getAbsolutePath(); ++ private String dtdFile = new File("src/test/resources/test.dtd").getAbsolutePath(); ++ ++ private String text = ++"\r" + ++" \r" + ++" \">\r" + ++" \r" + ++"%dtd;\r" + ++"]>\r" + ++"&xxe;"; ++ ++ @Test ++ public void testExternalParameterEntityExpand() throws Exception ++ { ++ ClientRequest request = new ClientRequest("http://localhost:8080/RESTEASY-1073-expand/test"); ++ System.out.println(text); ++ request.body(MediaType.APPLICATION_XML, text); ++ ClientResponse response = request.post(); ++ Assert.assertEquals(200, response.getStatus()); ++ String entity = response.getEntity(String.class); ++ System.out.println("Result: " + entity); ++ Assert.assertEquals("root:x:0:0:root:/root:/bin/bash", entity.trim()); ++ } ++ ++ @Test ++ public void testExternalParameterEntityNoExpand() throws Exception ++ { ++ ClientRequest request = new ClientRequest("http://localhost:8080/RESTEASY-1073-no-expand/test"); ++ System.out.println(text); ++ request.body(MediaType.APPLICATION_XML, text); ++ ClientResponse response = request.post(); ++ Assert.assertEquals(200, response.getStatus()); ++ String entity = response.getEntity(String.class); ++ System.out.println("Result: " + entity); ++ Assert.assertEquals("", entity.trim()); ++ } ++} ++ +diff -Nurb resteasy-3.0.6.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/resources/arquillian.xml resteasy-2.3.5.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/resources/arquillian.xml +--- resteasy-3.0.6.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/resources/arquillian.xml 1969-12-31 19:00:00.000000000 -0500 ++++ resteasy-2.3.5.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/resources/arquillian.xml 2014-07-25 15:44:43.551284000 -0400 +@@ -0,0 +1,23 @@ ++ ++ ++ ++ ++ ++ ++ target/deployments ++ ++ ++ ++ ++ target/wildfly-8.0.0.Final ++ ++ standalone-full.xml ++ ++ ++ ++ ++ +diff -Nurb resteasy-3.0.6.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/resources/passwd resteasy-2.3.5.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/resources/passwd +--- resteasy-3.0.6.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/resources/passwd 1969-12-31 19:00:00.000000000 -0500 ++++ resteasy-2.3.5.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/resources/passwd 2014-07-25 15:49:38.648001614 -0400 +@@ -0,0 +1 @@ ++root:x:0:0:root:/root:/bin/bash +diff -Nurb resteasy-3.0.6.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/resources/test.dtd resteasy-2.3.5.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/resources/test.dtd +--- resteasy-3.0.6.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/resources/test.dtd 1969-12-31 19:00:00.000000000 -0500 ++++ resteasy-2.3.5.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/resources/test.dtd 2014-07-25 15:50:14.822089344 -0400 +@@ -0,0 +1 @@ ++ +diff -Nurb resteasy-3.0.6.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/resources/web_expand.xml resteasy-2.3.5.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/resources/web_expand.xml +--- resteasy-3.0.6.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/resources/web_expand.xml 1969-12-31 19:00:00.000000000 -0500 ++++ resteasy-2.3.5.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/resources/web_expand.xml 2014-07-25 15:50:50.589177751 -0400 +@@ -0,0 +1,29 @@ ++ ++ ++ RESTEASY-1073-Expand ++ ++ ++ resteasy.document.expand.entity.references ++ true ++ ++ ++ ++ Resteasy ++ ++ ++ org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher ++ ++ ++ javax.ws.rs.Application ++ org.jboss.resteasy.resteasy1073.TestApplication ++ ++ ++ ++ ++ Resteasy ++ /* ++ ++ ++ +diff -Nurb resteasy-3.0.6.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/resources/web_no_expand.xml resteasy-2.3.5.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/resources/web_no_expand.xml +--- resteasy-3.0.6.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/resources/web_no_expand.xml 1969-12-31 19:00:00.000000000 -0500 ++++ resteasy-2.3.5.Final/jaxrs/arquillian/RESTEASY-1073-WF8/src/test/resources/web_no_expand.xml 2014-07-25 15:51:27.218270317 -0400 +@@ -0,0 +1,29 @@ ++ ++ ++ RESTEASY-1073-NoExpand ++ ++ ++ resteasy.document.expand.entity.references ++ false ++ ++ ++ ++ Resteasy ++ ++ ++ org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher ++ ++ ++ javax.ws.rs.Application ++ org.jboss.resteasy.resteasy1073.TestApplication ++ ++ ++ ++ ++ Resteasy ++ /* ++ ++ ++ +diff -up Resteasy-3.0.6.Final/jaxrs/providers/jaxb/src/main/java/org/jboss/resteasy/plugins/providers/jaxb/ExternalEntityUnmarshaller.java.orig11 Resteasy-3.0.6.Final/jaxrs/providers/jaxb/src/main/java/org/jboss/resteasy/plugins/providers/jaxb/ExternalEntityUnmarshaller.java +--- Resteasy-3.0.6.Final/jaxrs/providers/jaxb/src/main/java/org/jboss/resteasy/plugins/providers/jaxb/ExternalEntityUnmarshaller.java.orig11 2014-09-08 01:47:47.756852292 -0400 ++++ Resteasy-3.0.6.Final/jaxrs/providers/jaxb/src/main/java/org/jboss/resteasy/plugins/providers/jaxb/ExternalEntityUnmarshaller.java 2014-09-08 01:48:37.604972096 -0400 +@@ -154,6 +154,7 @@ public class ExternalEntityUnmarshaller + XMLReader xmlReader = sp.getXMLReader(); + xmlReader.setFeature("http://xml.org/sax/features/validation", false); + xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", false); ++ xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + SAXSource saxSource = new SAXSource(xmlReader, source); + return delegate.unmarshal(saxSource); + } +@@ -198,6 +199,7 @@ public class ExternalEntityUnmarshaller + XMLReader xmlReader = sp.getXMLReader(); + xmlReader.setFeature("http://xml.org/sax/features/validation", false); + xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", false); ++ xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + ((SAXSource) source).setXMLReader(xmlReader); + return delegate.unmarshal(source, declaredType); + } +diff -up Resteasy-3.0.6.Final/jaxrs/arquillian/pom.xml.orig11 Resteasy-3.0.6.Final/jaxrs/arquillian/pom.xml +--- Resteasy-3.0.6.Final/jaxrs/arquillian/pom.xml.orig11 2014-09-08 01:54:49.780400392 -0400 ++++ Resteasy-3.0.6.Final/jaxrs/arquillian/pom.xml 2014-09-08 01:55:22.955814600 -0400 +@@ -21,6 +21,7 @@ + + + ValidationTest-AS7 ++ RESTEASY-1073-WF8 + + + arquillian diff --git a/SPECS/resteasy-base.spec b/SPECS/resteasy-base.spec index 8ccb5cc..dc87ecd 100644 --- a/SPECS/resteasy-base.spec +++ b/SPECS/resteasy-base.spec @@ -3,17 +3,19 @@ %global prodname resteasy Name: resteasy-base -Version: 2.3.5 -Release: 3%{?dist} +Version: 3.0.6 +Release: 1%{?dist} Summary: Framework for RESTful Web services and Java applications License: ASL 2.0 and CDDL URL: http://www.jboss.org/resteasy # git clone git://github.com/resteasy/Resteasy.git # cd Resteasy -# git archive --prefix=resteasy-2.3.5.Final/ --output=resteasy-2.3.5.Final.tgz 2.3.5.Final -Source0: %{prodname}-%{namedversion}.tgz -Patch0: %{prodname}-%{namedversion}-resteasy-1073.patch +# git archive --prefix=resteasy-3.0.6.Final/ --output=resteasy-3.0.6.Final.tar.gz 3.0.6.Final +Source0: %{prodname}-%{namedversion}.tar.gz +Patch0: 0001-Mime4j-0.7.2-support.patch +Patch1: 0002-bcmail-api-change.patch +Patch2: %{prodname}-%{namedversion}-resteasy-1073.patch BuildArch: noarch @@ -49,6 +51,8 @@ Requires: resteasy-base-jaxrs = %{version}-%{release} Requires: resteasy-base-jaxrs-all = %{version}-%{release} Requires: resteasy-base-jettison-provider = %{version}-%{release} Requires: resteasy-base-tjws = %{version}-%{release} +Requires: resteasy-base-client = %{version}-%{release} +Requires: resteasy-base-resteasy-pom = %{version}-%{release} %description @@ -121,65 +125,97 @@ Summary: Module tjws for %{name} %description tjws %{extdesc} %{summary}. +%package client +Summary: Client for %{name} -%prep -%setup -q -n %{prodname}-%{namedversion} -%patch0 -p1 +%description client +%{extdesc} %{summary}. -# remove unneeded modules -%pom_disable_module resteasy-jaxrs-war -%pom_disable_module resteasy-cache -%pom_disable_module eagledns -%pom_disable_module security -%pom_disable_module resteasy-links -%pom_disable_module arquillian -%pom_disable_module async-http-jbossweb -%pom_disable_module async-http-tomcat -%pom_disable_module resteasy-spring -%pom_disable_module war-tests -%pom_disable_module examples -%pom_disable_module profiling-tests -%pom_disable_module resteasy-test-data -%pom_disable_module resteasy-bom -%pom_disable_module resteasy-guice -%pom_disable_module resteasy-jsapi -%pom_disable_module async-http-servlet-3.0 -%pom_disable_module resteasy-cdi -%pom_disable_module jboss-modules -%pom_disable_module server-adapters - -%pom_disable_module fastinfoset providers -%pom_disable_module multipart providers -%pom_disable_module yaml providers -%pom_disable_module resteasy-html providers -%pom_disable_module test-resteasy-html providers -%pom_disable_module test-all-jaxb providers -%pom_disable_module test-jackson-jaxb-coexistence providers -%pom_disable_module resteasy-hibernatevalidator-provider providers - -%pom_remove_dep net.jcip:jcip-annotations -%pom_remove_dep net.jcip:jcip-annotations resteasy-jaxrs - -%pom_remove_plugin com.atlassian.maven.plugins:maven-clover2-plugin -%pom_remove_plugin com.atlassian.maven.plugins:maven-clover2-plugin resteasy-jaxrs - -# Fix gId:aId javax.servlet:servlet-api -> -# org.jboss.spec.javax.servlet:jboss-servlet-api_2.5_spec -# in resteasy-jaxrs/pom.xml: -%pom_xpath_replace "pom:dependency[pom:artifactId[text()='servlet-api']]" \ - " - org.jboss.spec.javax.servlet - jboss-servlet-api_2.5_spec - provided - " resteasy-jaxrs -# in tjws/pom.xml: -%pom_xpath_replace "pom:dependency[pom:artifactId[text()='servlet-api']]" \ - " - org.jboss.spec.javax.servlet - jboss-servlet-api_2.5_spec - provided - " tjws +%package resteasy-pom +Summary: Module pom for %{name} +%description resteasy-pom +%{extdesc} %{summary}. + +%prep +%setup -q -n Resteasy-%{namedversion} + +# Disable unnecesary modules +%pom_disable_module examples jaxrs/pom.xml +%pom_disable_module profiling-tests jaxrs/pom.xml +%pom_disable_module resteasy-test-data jaxrs/pom.xml +%pom_disable_module war-tests jaxrs/pom.xml +%pom_disable_module resteasy-links jaxrs/pom.xml +%pom_disable_module jboss-modules jaxrs/pom.xml + +%pom_disable_module resteasy-cache jaxrs/pom.xml +%pom_disable_module security jaxrs/pom.xml +%pom_disable_module resteasy-spring jaxrs/pom.xml +%pom_disable_module resteasy-bom jaxrs/pom.xml +%pom_disable_module resteasy-guice jaxrs/pom.xml +%pom_disable_module resteasy-jsapi jaxrs/pom.xml +%pom_disable_module async-http-servlet-3.0 jaxrs/pom.xml +%pom_disable_module resteasy-cdi jaxrs/pom.xml +%pom_disable_module server-adapters jaxrs/pom.xml +%pom_disable_module resteasy-jaxrs-testsuite jaxrs/pom.xml +%pom_disable_module resteasy-servlet-initializer jaxrs/pom.xml + +%pom_disable_module resteasy-oauth jaxrs/security/pom.xml +%pom_disable_module login-module-authenticator jaxrs/security/pom.xml +%pom_disable_module skeleton-key-idm jaxrs/security/pom.xml +%pom_disable_module keystone/keystone-as7 jaxrs/security/pom.xml +%pom_disable_module keystone/keystone-as7-modules jaxrs/security/pom.xml + +%pom_disable_module async-http-servlet-3.0-test jaxrs/async-http-servlet-3.0/pom.xml +%pom_disable_module callback-test jaxrs/async-http-servlet-3.0/pom.xml + +%pom_disable_module fastinfoset jaxrs/providers/pom.xml +%pom_disable_module multipart jaxrs/providers/pom.xml +%pom_disable_module yaml jaxrs/providers/pom.xml +%pom_disable_module resteasy-html jaxrs/providers/pom.xml +%pom_disable_module test-resteasy-html jaxrs/providers/pom.xml +%pom_disable_module test-all-jaxb jaxrs/providers/pom.xml +%pom_disable_module test-jackson-jaxb-coexistence jaxrs/providers/pom.xml +%pom_disable_module resteasy-hibernatevalidator-provider jaxrs/providers/pom.xml +%pom_disable_module jackson2 jaxrs/providers/pom.xml +%pom_disable_module json-p-ee7 jaxrs/providers/pom.xml +%pom_disable_module resteasy-validator-provider-11 jaxrs/providers/pom.xml + +# Leave Netty 3, disable Netty 4 +%pom_disable_module resteasy-netty4 jaxrs/server-adapters/pom.xml + +# Replace 2.5 servlet with the jboss-servlet-2.5-api provides +for m in jaxrs/tjws; do +%pom_remove_dep "javax.servlet:servlet-api" ${m}/pom.xml +%pom_add_dep "org.jboss.spec.javax.servlet:jboss-servlet-api_2.5_spec" ${m}/pom.xml +done + +# Need to be patched to work with Jetty 9 +rm jaxrs/resteasy-spring/src/main/java/org/jboss/resteasy/springmvc/JettyLifecycleManager.java + +%pom_remove_dep "org.springframework:spring-test" jaxrs/resteasy-spring/pom.xml +%pom_remove_dep "org.mortbay.jetty:jetty" jaxrs/resteasy-spring/pom.xml +%pom_add_dep "org.eclipse.jetty:jetty-server" jaxrs/resteasy-spring/pom.xml +%pom_remove_dep net.jcip:jcip-annotations jaxrs/pom.xml +%pom_remove_dep net.jcip:jcip-annotations jaxrs/resteasy-jaxrs/pom.xml +%pom_remove_plugin com.atlassian.maven.plugins:maven-clover2-plugin jaxrs/pom.xml +%pom_remove_plugin com.atlassian.maven.plugins:maven-clover2-plugin jaxrs/resteasy-jaxrs/pom.xml + +# Fixing JDK7 ASCII issues +files=' +jaxrs/resteasy-jsapi/src/main/java/org/jboss/resteasy/jsapi/JSAPIWriter.java +jaxrs/resteasy-jsapi/src/main/java/org/jboss/resteasy/jsapi/JSAPIServlet.java +jaxrs/resteasy-jsapi/src/main/java/org/jboss/resteasy/jsapi/ServiceRegistry.java +jaxrs/providers/jaxb/src/main/java/org/jboss/resteasy/plugins/providers/jaxb/ExternalEntityUnmarshaller.java +' + +for f in ${files}; do +native2ascii -encoding UTF8 ${f} ${f} +done + +%patch0 -p1 +%patch1 -p0 +%patch2 -p1 # additional gId:aId for jaxrs-api %mvn_alias ":jaxrs-api" "org.jboss.spec.javax.ws.rs:jboss-jaxrs-api_1.1_spec" @@ -188,39 +224,25 @@ Summary: Module tjws for %{name} # build, skip tests, singleton packaging %mvn_build -f -s +# Create Jandex index file(s) +# Not all files are required by JBoss AS7, but let's create indexes for all of them +find -name 'resteasy-*-%{namedversion}.jar' | while read f; do + java -cp $(build-classpath jandex) org.jboss.jandex.Main -j ${f} +done + %install -# Install jars, poms and dependencies maps %mvn_install -# Create also the Jandex index files -# Required by JBoss AS7 -while read module_path artifact_id additional_aid_gid -do - base_name=${module_path}/target/${artifact_id}-%{namedversion} - jandex_file=${base_name}-jandex.jar - if [ -f ${base_name}.jar ]; then - java -cp $(build-classpath jandex) org.jboss.jandex.Main -j ${base_name}.jar - install -pm 644 ${jandex_file} %{buildroot}%{_javadir}/%{name}/${artifact_id}-jandex.jar - fi -done <<'.' -. jaxrs-all -jaxrs-api jaxrs-api org.jboss.spec.javax.ws.rs:jboss-jaxrs-api_1.1_spec -providers/jackson resteasy-jackson-provider -providers/jaxb resteasy-jaxb-provider -providers/jettison resteasy-jettison-provider -providers/resteasy-atom resteasy-atom-provider -resteasy-jaxrs resteasy-jaxrs -tjws tjws -. - +find -name "resteasy-*-jandex.jar" | while read f; do + install -pm 644 ${f} %{buildroot}%{_javadir}/%{name}/$(basename -s "-%{namedversion}-jandex.jar" $f)-jandex.jar +done %files -f .mfiles %dir %{_javadir}/%{name} -%doc License.html README.html +%doc jaxrs/License.html jaxrs/README.html %files jaxrs-all -f .mfiles-resteasy-jaxrs-all %files providers-pom -f .mfiles-providers-pom %files jaxrs-api -f .mfiles-jaxrs-api -%{_javadir}/%{name}/jaxrs-api-jandex.jar %files atom-provider -f .mfiles-resteasy-atom-provider %{_javadir}/%{name}/resteasy-atom-provider-jandex.jar %files jackson-provider -f .mfiles-resteasy-jackson-provider @@ -232,14 +254,19 @@ tjws tjws %files jettison-provider -f .mfiles-resteasy-jettison-provider %{_javadir}/%{name}/resteasy-jettison-provider-jandex.jar %files tjws -f .mfiles-tjws -%{_javadir}/%{name}/tjws-jandex.jar %files javadoc -f .mfiles-javadoc -%doc License.html +%doc jaxrs/License.html +%files client -f .mfiles-resteasy-client +%{_javadir}/%{name}/resteasy-client-jandex.jar +%files resteasy-pom -f .mfiles-resteasy-pom %changelog -* Fri Jul 25 2014 Ade Lee - 2.3.5-3 -- Resolves: rhbz1121917 - CVE-2014-3490: XXE via parameter entities +* Sun Sep 7 2014 Ade Lee - 3.0.6-1 +- Resolves: rhbz1139067 - rebase to 3.0.6 + +* Mon Aug 25 2014 Ade Lee - 2.3.5-3 +- Resolves: rhbz1121918 - CVE-2014-3490: XXE via parameter entities * Fri Dec 27 2013 Daniel Mach - 2.3.5-2 - Mass rebuild 2013-12-27