[
https://issues.apache.org/jira/browse/CXF-9263?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Colm O hEigeartaigh updated CXF-9263:
-------------------------------------
Description:
||Candidate||Module / Location||Systest usage||Rationale||
|{{org.apache.cxf.rs.security.oauth2.tokens.hawk}} package (11
classes)|cxf-rt-rs-security-oauth2|None|Hawk was an abandoned draft and never
became a standard.|
|{Unknown macro: \{DirectAuthorizationService}
}|cxf-rt-rs-security-oauth2 (services)|None|Non-standard "direct_token" grant
that issues tokens directly from an authenticated request. Nothing else
references it.|
|{{OOBResponseDeliverer}} and OOB redirect support in {
Unknown macro: \{AuthorizationCodeGrantService}
}|cxf-rt-rs-security-oauth2 (provider, services)|None|Out-of-band redirect has
been deprecated across the industry.|
|{{{}ModelEncryptionSupport{}}}, {{{}DefaultEncryptingOAuthDataProvider{}}}, {
Unknown macro: \{DefaultEncryptingCodeDataProvider}
}|cxf-rt-rs-security-oauth2 (utils.crypto, provider,
grants.code)|None|Home-grown way to store tokens as encrypted strings, with a
custom tokenizer (about 600 LOC). Several recent fixes (PRs 3345, 3347, 3408).
JPA and JCache providers already cover this.|
|{{{}JoseSessionTokenProvider{}}}, {
Unknown macro: \{JoseClientCodeStateManager}
}|cxf-rt-rs-security-oauth2 (provider, client)|4 systests|Prototype-style ways
to keep session and state data in JOSE. The in-memory and session-based options
already exist.|
|{{{}ResourceOwnerGrant{}}}, {{{}ResourceOwnerGrantHandler{}}},
{{{}ResourceOwnerLoginHandler{}}}, {
Unknown macro: \{JAASResourceOwnerLoginHandler}
}|cxf-rt-rs-security-oauth2 (grants.owner)|About 20 systests|The password grant
is removed in OAuth 2.1 and the OAuth Security BCP.|
|{{{}ImplicitGrantService{}}}, {{{}AbstractImplicitGrantService{}}},
{{OidcImplicitService}} |cxf-rt-rs-security-oauth2 (services),
cxf-rt-rs-security-sso-oidc (idp)|About 14 systests (oauth2), 9 (oidc)|The
implicit flow is removed in OAuth 2.1 and the Security BCP.|
|{{org.apache.cxf.jaxrs.provider.jsonp}} package ({{{}JsonpInInterceptor{}}},
{{{}JsonpPreStreamInterceptor{}}}, {{{}JsonpPostStreamInterceptor{}}},
{{{}JsonpJaxrsWriterInterceptor{}}},
{{{}AbstractJsonpOutInterceptor{}}})|cxf-rt-rs-extension-providers|1
systest|Made obsolete by CORS. It is reflected-script injection by design (PR
3628).|
|{Unknown macro: \{ODataParser}
}|cxf-rt-rs-extension-search (odata)|1 systest|Depends on Apache Olingo OData2,
which is effectively dead.|
|{{{}TikaContentExtractor{}}}, {{{}TikaLuceneContentExtractor{}}},
{{{}LuceneDocumentMetadata{}}}, {
Unknown macro: \{LuceneQueryVisitor}
}|cxf-rt-rs-extension-search (tika, lucene)|1 systest, 1 sample|Prototype
integrations that pull in heavy dependencies (Tika parsers, Lucene) for little
use.|
|{Unknown macro: \{DOM4JProvider}
}|cxf-rt-rs-extension-providers (dom4j)|None|Niche, with no tests or samples
using it.|
|{{{}AegisElementProvider{}}}, {
Unknown macro: \{AbstractAegisProvider}
}|cxf-rt-rs-extension-providers (aegis)|3 systests|Niche. Aegis already had
CVE-2024-28752.|
|{Unknown macro: \{XPathProvider}
}|cxf-rt-frontend-jaxrs (provider)|None|The XPath path keeps needing XML
resolver and XXE hardening.|
|{Unknown macro: \{XSLTJaxbProvider}
}|cxf-rt-frontend-jaxrs (provider)|3 systests|The XSLT path keeps needing
stylesheet resolver hardening (PR 3512).|
|{{{}XMLSource{}}}, {{XSLTTransform}} (optional)|cxf-rt-frontend-jaxrs
(ext.xml)|About 7 systests|Same XML and XSLT risk area, but used more widely.|
was:
||Candidate||Module / Location||Systest usage||Rationale||Suggested action||
|\{{org.apache.cxf.rs.security.oauth2.tokens.hawk}} package (11
classes)|cxf-rt-rs-security-oauth2|None|Hawk was an abandoned draft and never
became a standard.|Deprecate in 4.2.x, remove in 4.3.0|
|\{{DirectAuthorizationService}}|cxf-rt-rs-security-oauth2
(services)|None|Non-standard "direct_token" grant that issues tokens directly
from an authenticated request. Nothing else references it.|Deprecate in 4.2.x,
remove in 4.3.0|
|\{{OOBResponseDeliverer}} and OOB redirect support in
\{{AuthorizationCodeGrantService}}|cxf-rt-rs-security-oauth2 (provider,
services)|None|Out-of-band redirect has been deprecated across the
industry.|Deprecate in 4.2.x, remove in 4.3.0|
|\{{ModelEncryptionSupport}}, \{{DefaultEncryptingOAuthDataProvider}},
\{{DefaultEncryptingCodeDataProvider}}|cxf-rt-rs-security-oauth2 (utils.crypto,
provider, grants.code)|None|Home-grown way to store tokens as encrypted
strings, with a custom tokenizer (about 600 LOC). Several recent fixes (PRs
3345, 3347, 3408). JPA and JCache providers already cover this.|Deprecate in
4.2.x, remove in 4.3.0|
|\{{JoseSessionTokenProvider}},
\{{JoseClientCodeStateManager}}|cxf-rt-rs-security-oauth2 (provider, client)|4
systests|Prototype-style ways to keep session and state data in JOSE. The
in-memory and session-based options already exist.|Deprecate in 4.2.x, remove
in 4.3.0, migrate systests|
|\{{ResourceOwnerGrant}}, \{{ResourceOwnerGrantHandler}},
\{{ResourceOwnerLoginHandler}},
\{{JAASResourceOwnerLoginHandler}}|cxf-rt-rs-security-oauth2
(grants.owner)|About 20 systests|The password grant is removed in OAuth 2.1 and
the OAuth Security BCP.|Deprecate in 4.2.x, remove in 4.3.0, migrate systests|
|\{{ImplicitGrantService}}, \{{AbstractImplicitGrantService}},
\{{OidcImplicitService}} (possibly
\{{OidcHybridService}})|cxf-rt-rs-security-oauth2 (services),
cxf-rt-rs-security-sso-oidc (idp)|About 14 systests (oauth2), 9 (oidc)|The
implicit flow is removed in OAuth 2.1 and the Security BCP. The hybrid flow
alone needed several fixes (PRs 3228, 3230).|Deprecate in 4.2.x, remove in
4.3.0, migrate systests|
|\{{org.apache.cxf.jaxrs.provider.jsonp}} package (\{{JsonpInInterceptor}},
\{{JsonpPreStreamInterceptor}}, \{{JsonpPostStreamInterceptor}},
\{{JsonpJaxrsWriterInterceptor}},
\{{AbstractJsonpOutInterceptor}})|cxf-rt-rs-extension-providers|1 systest|Made
obsolete by CORS. It is reflected-script injection by design (PR
3628).|Deprecate in 4.2.x, remove in 4.3.0|
|\{{ODataParser}}|cxf-rt-rs-extension-search (odata)|1 systest|Depends on
Apache Olingo OData2, which is effectively dead.|Deprecate in 4.2.x, remove in
4.3.0, drop olingo dependency|
|\{{TikaContentExtractor}}, \{{TikaLuceneContentExtractor}},
\{{LuceneDocumentMetadata}}, \{{LuceneQueryVisitor}}|cxf-rt-rs-extension-search
(tika, lucene)|1 systest, 1 sample|Prototype integrations that pull in heavy
dependencies (Tika parsers, Lucene) for little use.|Deprecate in 4.2.x, remove
in 4.3.0, drop tika and lucene dependencies|
|\{{DOM4JProvider}}|cxf-rt-rs-extension-providers (dom4j)|None|Niche, with no
tests or samples using it.|Deprecate in 4.2.x, remove in 4.3.0, drop dom4j
dependency|
|\{{AegisElementProvider}},
\{{AbstractAegisProvider}}|cxf-rt-rs-extension-providers (aegis)|3
systests|Niche. Aegis already had CVE-2024-28752.|Deprecate in 4.2.x, remove in
4.3.0|
|\{{XPathProvider}}|cxf-rt-frontend-jaxrs (provider)|None|The XPath path keeps
needing XML resolver and XXE hardening.|Deprecate in 4.2.x, remove in 4.3.0|
|\{{XSLTJaxbProvider}}|cxf-rt-frontend-jaxrs (provider)|3 systests|The XSLT
path keeps needing stylesheet resolver hardening (PR 3512).|Deprecate in 4.2.x,
remove in 4.3.0|
|\{{XMLSource}}, \{{XSLTTransform}} (optional)|cxf-rt-frontend-jaxrs
(ext.xml)|About 7 systests|Same XML and XSLT risk area, but used more
widely.|Deprecate in 4.2.x, decide on removal later|
> Review and remove deprecated JAX-RS code
> ----------------------------------------
>
> Key: CXF-9263
> URL: https://issues.apache.org/jira/browse/CXF-9263
> Project: CXF
> Issue Type: Improvement
> Reporter: Colm O hEigeartaigh
> Assignee: Colm O hEigeartaigh
> Priority: Major
> Fix For: 4.3.0
>
>
> ||Candidate||Module / Location||Systest usage||Rationale||
> |{{org.apache.cxf.rs.security.oauth2.tokens.hawk}} package (11
> classes)|cxf-rt-rs-security-oauth2|None|Hawk was an abandoned draft and never
> became a standard.|
> |{Unknown macro: \{DirectAuthorizationService}
> }|cxf-rt-rs-security-oauth2 (services)|None|Non-standard "direct_token" grant
> that issues tokens directly from an authenticated request. Nothing else
> references it.|
> |{{OOBResponseDeliverer}} and OOB redirect support in {
> Unknown macro: \{AuthorizationCodeGrantService}
> }|cxf-rt-rs-security-oauth2 (provider, services)|None|Out-of-band redirect
> has been deprecated across the industry.|
> |{{{}ModelEncryptionSupport{}}}, {{{}DefaultEncryptingOAuthDataProvider{}}}, {
> Unknown macro: \{DefaultEncryptingCodeDataProvider}
> }|cxf-rt-rs-security-oauth2 (utils.crypto, provider,
> grants.code)|None|Home-grown way to store tokens as encrypted strings, with a
> custom tokenizer (about 600 LOC). Several recent fixes (PRs 3345, 3347,
> 3408). JPA and JCache providers already cover this.|
> |{{{}JoseSessionTokenProvider{}}}, {
> Unknown macro: \{JoseClientCodeStateManager}
> }|cxf-rt-rs-security-oauth2 (provider, client)|4 systests|Prototype-style
> ways to keep session and state data in JOSE. The in-memory and session-based
> options already exist.|
> |{{{}ResourceOwnerGrant{}}}, {{{}ResourceOwnerGrantHandler{}}},
> {{{}ResourceOwnerLoginHandler{}}}, {
> Unknown macro: \{JAASResourceOwnerLoginHandler}
> }|cxf-rt-rs-security-oauth2 (grants.owner)|About 20 systests|The password
> grant is removed in OAuth 2.1 and the OAuth Security BCP.|
> |{{{}ImplicitGrantService{}}}, {{{}AbstractImplicitGrantService{}}},
> {{OidcImplicitService}} |cxf-rt-rs-security-oauth2 (services),
> cxf-rt-rs-security-sso-oidc (idp)|About 14 systests (oauth2), 9 (oidc)|The
> implicit flow is removed in OAuth 2.1 and the Security BCP.|
> |{{org.apache.cxf.jaxrs.provider.jsonp}} package ({{{}JsonpInInterceptor{}}},
> {{{}JsonpPreStreamInterceptor{}}}, {{{}JsonpPostStreamInterceptor{}}},
> {{{}JsonpJaxrsWriterInterceptor{}}},
> {{{}AbstractJsonpOutInterceptor{}}})|cxf-rt-rs-extension-providers|1
> systest|Made obsolete by CORS. It is reflected-script injection by design (PR
> 3628).|
> |{Unknown macro: \{ODataParser}
> }|cxf-rt-rs-extension-search (odata)|1 systest|Depends on Apache Olingo
> OData2, which is effectively dead.|
> |{{{}TikaContentExtractor{}}}, {{{}TikaLuceneContentExtractor{}}},
> {{{}LuceneDocumentMetadata{}}}, {
> Unknown macro: \{LuceneQueryVisitor}
> }|cxf-rt-rs-extension-search (tika, lucene)|1 systest, 1 sample|Prototype
> integrations that pull in heavy dependencies (Tika parsers, Lucene) for
> little use.|
> |{Unknown macro: \{DOM4JProvider}
> }|cxf-rt-rs-extension-providers (dom4j)|None|Niche, with no tests or samples
> using it.|
> |{{{}AegisElementProvider{}}}, {
> Unknown macro: \{AbstractAegisProvider}
> }|cxf-rt-rs-extension-providers (aegis)|3 systests|Niche. Aegis already had
> CVE-2024-28752.|
> |{Unknown macro: \{XPathProvider}
> }|cxf-rt-frontend-jaxrs (provider)|None|The XPath path keeps needing XML
> resolver and XXE hardening.|
> |{Unknown macro: \{XSLTJaxbProvider}
> }|cxf-rt-frontend-jaxrs (provider)|3 systests|The XSLT path keeps needing
> stylesheet resolver hardening (PR 3512).|
> |{{{}XMLSource{}}}, {{XSLTTransform}} (optional)|cxf-rt-frontend-jaxrs
> (ext.xml)|About 7 systests|Same XML and XSLT risk area, but used more widely.|
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
