Colm O hEigeartaigh created CXF-9263:
----------------------------------------
Summary: Review and remove deprecated JAX-RS code
Key: CXF-9263
URL: https://issues.apache.org/jira/browse/CXF-9263
Project: CXF
Issue Type: Improvement
Reporter: Colm O hEigeartaigh
Assignee: Colm O hEigeartaigh
Fix For: 4.3.0
||Candidate||Module / Location||Systest usage||Rationale||Suggested action||
|\{{org.apache.cxf.rs.security.oauth2.tokens.hawk}} package (11
classes)|cxf-rt-rs-security-oauth2|None|Hawk was an abandoned draft and never
became a standard.|Deprecate in 4.2.x, remove in 4.3.0|
|\{{DirectAuthorizationService}}|cxf-rt-rs-security-oauth2
(services)|None|Non-standard "direct_token" grant that issues tokens directly
from an authenticated request. Nothing else references it.|Deprecate in 4.2.x,
remove in 4.3.0|
|\{{OOBResponseDeliverer}} and OOB redirect support in
\{{AuthorizationCodeGrantService}}|cxf-rt-rs-security-oauth2 (provider,
services)|None|Out-of-band redirect has been deprecated across the
industry.|Deprecate in 4.2.x, remove in 4.3.0|
|\{{ModelEncryptionSupport}}, \{{DefaultEncryptingOAuthDataProvider}},
\{{DefaultEncryptingCodeDataProvider}}|cxf-rt-rs-security-oauth2 (utils.crypto,
provider, grants.code)|None|Home-grown way to store tokens as encrypted
strings, with a custom tokenizer (about 600 LOC). Several recent fixes (PRs
3345, 3347, 3408). JPA and JCache providers already cover this.|Deprecate in
4.2.x, remove in 4.3.0|
|\{{JoseSessionTokenProvider}},
\{{JoseClientCodeStateManager}}|cxf-rt-rs-security-oauth2 (provider, client)|4
systests|Prototype-style ways to keep session and state data in JOSE. The
in-memory and session-based options already exist.|Deprecate in 4.2.x, remove
in 4.3.0, migrate systests|
|\{{ResourceOwnerGrant}}, \{{ResourceOwnerGrantHandler}},
\{{ResourceOwnerLoginHandler}},
\{{JAASResourceOwnerLoginHandler}}|cxf-rt-rs-security-oauth2
(grants.owner)|About 20 systests|The password grant is removed in OAuth 2.1 and
the OAuth Security BCP.|Deprecate in 4.2.x, remove in 4.3.0, migrate systests|
|\{{ImplicitGrantService}}, \{{AbstractImplicitGrantService}},
\{{OidcImplicitService}} (possibly
\{{OidcHybridService}})|cxf-rt-rs-security-oauth2 (services),
cxf-rt-rs-security-sso-oidc (idp)|About 14 systests (oauth2), 9 (oidc)|The
implicit flow is removed in OAuth 2.1 and the Security BCP. The hybrid flow
alone needed several fixes (PRs 3228, 3230).|Deprecate in 4.2.x, remove in
4.3.0, migrate systests|
|\{{org.apache.cxf.jaxrs.provider.jsonp}} package (\{{JsonpInInterceptor}},
\{{JsonpPreStreamInterceptor}}, \{{JsonpPostStreamInterceptor}},
\{{JsonpJaxrsWriterInterceptor}},
\{{AbstractJsonpOutInterceptor}})|cxf-rt-rs-extension-providers|1 systest|Made
obsolete by CORS. It is reflected-script injection by design (PR
3628).|Deprecate in 4.2.x, remove in 4.3.0|
|\{{ODataParser}}|cxf-rt-rs-extension-search (odata)|1 systest|Depends on
Apache Olingo OData2, which is effectively dead.|Deprecate in 4.2.x, remove in
4.3.0, drop olingo dependency|
|\{{TikaContentExtractor}}, \{{TikaLuceneContentExtractor}},
\{{LuceneDocumentMetadata}}, \{{LuceneQueryVisitor}}|cxf-rt-rs-extension-search
(tika, lucene)|1 systest, 1 sample|Prototype integrations that pull in heavy
dependencies (Tika parsers, Lucene) for little use.|Deprecate in 4.2.x, remove
in 4.3.0, drop tika and lucene dependencies|
|\{{DOM4JProvider}}|cxf-rt-rs-extension-providers (dom4j)|None|Niche, with no
tests or samples using it.|Deprecate in 4.2.x, remove in 4.3.0, drop dom4j
dependency|
|\{{AegisElementProvider}},
\{{AbstractAegisProvider}}|cxf-rt-rs-extension-providers (aegis)|3
systests|Niche. Aegis already had CVE-2024-28752.|Deprecate in 4.2.x, remove in
4.3.0|
|\{{XPathProvider}}|cxf-rt-frontend-jaxrs (provider)|None|The XPath path keeps
needing XML resolver and XXE hardening.|Deprecate in 4.2.x, remove in 4.3.0|
|\{{XSLTJaxbProvider}}|cxf-rt-frontend-jaxrs (provider)|3 systests|The XSLT
path keeps needing stylesheet resolver hardening (PR 3512).|Deprecate in 4.2.x,
remove in 4.3.0|
|\{{XMLSource}}, \{{XSLTTransform}} (optional)|cxf-rt-frontend-jaxrs
(ext.xml)|About 7 systests|Same XML and XSLT risk area, but used more
widely.|Deprecate in 4.2.x, decide on removal later|
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
