rishabhdaim opened a new pull request, #445: URL: https://github.com/apache/jackrabbit-filevault/pull/445
## Summary Backport JCRVLT-856 to 3.2.x: check installation permissions before registering install hooks, so package-supplied classes cannot be loaded or instantiated before authorization. ## Changes - Detect hook jars and installhook properties through archive listing and cached metadata, without loading hook classes. - Apply the existing 3.2.x administrative permission rules before hook registration, without introducing the newer security configuration API. - Retain the post-registration check for custom processors and preserve dry-run behavior. - Add 15 JUnit 4 tests covering detection, listing failures, authorization order, permitted installs, custom processors, and dry runs. ## Test Plan - [x] Confirm the three authorization-order regression tests fail against the unpatched 3.2.x implementation. - [x] Confirm all 15 hook regression tests pass with the backport. - [x] Run all current-branch vault-core tests on Java 8 against both backends: 619 cases on Oak (14 skipped) and 619 on Jackrabbit (18 skipped), with zero failures or errors. - [x] Check the patch for whitespace errors. Test selection explicitly includes classes present in this branch's source tree to exclude stale compiled tests from other branches in the local build directory. Spotless is not configured on this branch. ## Links - JIRA: https://issues.apache.org/jira/browse/JCRVLT-856 Co-Authored-By: GitHub Copilot <[email protected]> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
