Hi,

As discussed mainly here in JIRA
https://issues.apache.org/jira/browse/DMAP-54 it seems advisable to
separate the "Console" (Main class) from the actual Java Client.

An optional W3C module on top of it already suggests bit of modularization,
so a small optional module (pretty much similar to the "Console Example"
which is the actual subject of DMAP-54) would further improve this.

Most importantly baking a console shell into the client library poses a
security risk because it requires little more than a batch or shell script
to run UA queries against that and it runs in a Java SE context. All known
Java vulnerabilities of the last months and years affect Java SE in a
standalone/desktop environment, a proper EE container is usually well
protected as well as code running inside it. While a JAR that exposes
console functionality may be abused via scripts much more easily.

Regards,

Werner

Reply via email to