[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Gary Gregory (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006800#comment-15006800 ] Gary Gregory commented on IO-487: - Right, {{accept(MyClass.class)}} is fine as long as we translate that to

[jira] [Updated] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Adrian Crum (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Adrian Crum updated IO-487: --- Attachment: IO-487.patch Updated patch with Niall's changes. The biggest problem I see with this issue is we

[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Bertrand Delacretaz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006893#comment-15006893 ] Bertrand Delacretaz commented on IO-487: The {{IO-487-accept-reject.patch}} uses a different and much

[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Gary Gregory (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006765#comment-15006765 ] Gary Gregory commented on IO-487: - I would be careful using class objects in the API, because of class loader

[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Bertrand Delacretaz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006769#comment-15006769 ] Bertrand Delacretaz commented on IO-487: You mean in methods like {{accept(MyClass.class)}} ? One

[jira] [Comment Edited] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Bertrand Delacretaz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006769#comment-15006769 ] Bertrand Delacretaz edited comment on IO-487 at 11/16/15 3:22 PM: -- You mean

[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Joerg Schaible (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006693#comment-15006693 ] Joerg Schaible commented on IO-487: --- If you have to declare any accepted class, you might be surprised how

[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Bertrand Delacretaz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006594#comment-15006594 ] Bertrand Delacretaz commented on IO-487: bq. I'd suggest adding the name of the class rejected to the

[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Emmanuel Bourg (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006598#comment-15006598 ] Emmanuel Bourg commented on IO-487: --- bq. I intentionally didn't do that as security folks sometimes complain

[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Bertrand Delacretaz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006676#comment-15006676 ] Bertrand Delacretaz commented on IO-487: bq. ...any class is rejected unless it's explicitly accepted.

[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Emmanuel Bourg (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006702#comment-15006702 ] Emmanuel Bourg commented on IO-487: --- Ok understood I didn't parse the method properly. All classes are

[jira] [Commented] (COLLECTIONS-580) Arbitrary remote code execution with InvokerTransformer

2015-11-16 Thread Michel Schudel (JIRA)
[ https://issues.apache.org/jira/browse/COLLECTIONS-580?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006612#comment-15006612 ] Michel Schudel commented on COLLECTIONS-580: Thanks Thomas for the quick fix > Arbitrary

[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Emmanuel Bourg (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006723#comment-15006723 ] Emmanuel Bourg commented on IO-487: --- The base types should be accepted by default I think (primitive

[jira] [Updated] (LANG-1182) Clarify JavaDoc of StringUtils.containsAny()

2015-11-16 Thread Benedikt Ritter (JIRA)
[ https://issues.apache.org/jira/browse/LANG-1182?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Benedikt Ritter updated LANG-1182: -- Fix Version/s: 3.5 > Clarify JavaDoc of StringUtils.containsAny() >

[jira] [Resolved] (LANG-1182) Clarify JavaDoc of StringUtils.containsAny()

2015-11-16 Thread Benedikt Ritter (JIRA)
[ https://issues.apache.org/jira/browse/LANG-1182?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Benedikt Ritter resolved LANG-1182. --- Resolution: Fixed Assignee: Benedikt Ritter {code} commit

[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Christopher Schultz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15007015#comment-15007015 ] Christopher Schultz commented on IO-487: I made a suggestion on the tomcat-user mailing list where we

[jira] [Updated] (LANG-1182) Clarify JavaDoc of StringUtils.containsAny()

2015-11-16 Thread Benedikt Ritter (JIRA)
[ https://issues.apache.org/jira/browse/LANG-1182?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Benedikt Ritter updated LANG-1182: -- Summary: Clarify JavaDoc of StringUtils.containsAny() (was: javadoc correction, clarification

[jira] [Commented] (LANG-1182) Clarify JavaDoc of StringUtils.containsAny()

2015-11-16 Thread ASF GitHub Bot (JIRA)
[ https://issues.apache.org/jira/browse/LANG-1182?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15007153#comment-15007153 ] ASF GitHub Bot commented on LANG-1182: -- Github user asfgit closed the pull request at:

[GitHub] commons-lang pull request: LANG-1182: adding clarifying examples t...

2015-11-16 Thread asfgit
Github user asfgit closed the pull request at: https://github.com/apache/commons-lang/pull/114 --- If your project is set up for it, you can reply to this email and have your reply appear on GitHub as well. If your project does not have this feature enabled and wishes so, or if the feature

[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Emmanuel Bourg (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15007299#comment-15007299 ] Emmanuel Bourg commented on IO-487: --- Or move the throw InvalidClassException to a protected method that can

[jira] [Created] (COMPRESS-327) Support in-memory processing for ZipFile

2015-11-16 Thread Brett Kail (JIRA)
Brett Kail created COMPRESS-327: --- Summary: Support in-memory processing for ZipFile Key: COMPRESS-327 URL: https://issues.apache.org/jira/browse/COMPRESS-327 Project: Commons Compress Issue

[jira] [Commented] (COLLECTIONS-580) Arbitrary remote code execution with InvokerTransformer

2015-11-16 Thread Mike Yoder (JIRA)
[ https://issues.apache.org/jira/browse/COLLECTIONS-580?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15007419#comment-15007419 ] Mike Yoder commented on COLLECTIONS-580: Let me also extend my thanks for the fix. Question:

[jira] [Commented] (SANDBOX-501) Add configurable type conversion support

2015-11-16 Thread Benedikt Ritter (JIRA)
[ https://issues.apache.org/jira/browse/SANDBOX-501?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15007178#comment-15007178 ] Benedikt Ritter commented on SANDBOX-501: - Hello Matt, bq. I was wondering if we might have a

[jira] [Comment Edited] (SANDBOX-501) Add configurable type conversion support

2015-11-16 Thread Benedikt Ritter (JIRA)
[ https://issues.apache.org/jira/browse/SANDBOX-501?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15007178#comment-15007178 ] Benedikt Ritter edited comment on SANDBOX-501 at 11/16/15 7:30 PM: ---

[jira] [Resolved] (IMAGING-175) Check download release

2015-11-16 Thread Benedikt Ritter (JIRA)
[ https://issues.apache.org/jira/browse/IMAGING-175?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Benedikt Ritter resolved IMAGING-175. - Resolution: Not A Problem There hasn't been a release for commons-imaging, since it has

[jira] [Commented] (SANDBOX-501) Add configurable type conversion support

2015-11-16 Thread Benedikt Ritter (JIRA)
[ https://issues.apache.org/jira/browse/SANDBOX-501?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15007180#comment-15007180 ] Benedikt Ritter commented on SANDBOX-501: - I'll try to have a look at your patch later this week!

[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Bertrand Delacretaz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15007292#comment-15007292 ] Bertrand Delacretaz commented on IO-487: For that you can write a ClassNameMatcher that accepts

[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Benedikt Ritter (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15007171#comment-15007171 ] Benedikt Ritter commented on IO-487: The general design philosophy at commons is, that our components

[jira] [Commented] (COLLECTIONS-580) Arbitrary remote code execution with InvokerTransformer

2015-11-16 Thread Ravi Chamarthy (JIRA)
[ https://issues.apache.org/jira/browse/COLLECTIONS-580?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006555#comment-15006555 ] Ravi Chamarthy commented on COLLECTIONS-580: Thanks Thomas for the confirmation. >

[jira] [Updated] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Bertrand Delacretaz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Bertrand Delacretaz updated IO-487: --- Attachment: IO-487-accept-reject.patch Here's IO-487-accept-reject.patch with the suggested

[jira] [Comment Edited] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Bertrand Delacretaz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006559#comment-15006559 ] Bertrand Delacretaz edited comment on IO-487 at 11/16/15 11:51 AM: --- Here's

[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Emmanuel Bourg (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006574#comment-15006574 ] Emmanuel Bourg commented on IO-487: --- The API looks good to me. I'd suggest adding the name of the class

[jira] [Updated] (COMPRESS-327) Support in-memory processing for ZipFile

2015-11-16 Thread Damjan Jovanovic (JIRA)
[ https://issues.apache.org/jira/browse/COMPRESS-327?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Damjan Jovanovic updated COMPRESS-327: -- Attachment: seekable-input-stream.txt I wrote a patch precisely for this a few weeks

[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Joerg Schaible (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006331#comment-15006331 ] Joerg Schaible commented on IO-487: --- Please use the InvalidClassException with a proper reason (e.g.

[jira] [Updated] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Bertrand Delacretaz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Bertrand Delacretaz updated IO-487: --- Attachment: IO-487-matchers.patch Based on all those great ideas, here's a variant

[jira] [Comment Edited] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Bertrand Delacretaz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006477#comment-15006477 ] Bertrand Delacretaz edited comment on IO-487 at 11/16/15 10:37 AM: --- Or maybe

[jira] [Commented] (COLLECTIONS-580) Arbitrary remote code execution with InvokerTransformer

2015-11-16 Thread Thomas Neidhart (JIRA)
[ https://issues.apache.org/jira/browse/COLLECTIONS-580?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006492#comment-15006492 ] Thomas Neidhart commented on COLLECTIONS-580: - collections 3.2.2 has been released

[jira] [Commented] (COLLECTIONS-580) Arbitrary remote code execution with InvokerTransformer

2015-11-16 Thread Ravi Chamarthy (JIRA)
[ https://issues.apache.org/jira/browse/COLLECTIONS-580?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006460#comment-15006460 ] Ravi Chamarthy commented on COLLECTIONS-580: Hi, Would be interested to know an

[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Emmanuel Bourg (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006466#comment-15006466 ] Emmanuel Bourg commented on IO-487: --- What about an even simpler syntax like: {code:java} ObjectInputStream

[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Bertrand Delacretaz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006477#comment-15006477 ] Bertrand Delacretaz commented on IO-487: Or maybe {code} ObjectInputStream ois = new

[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Emmanuel Bourg (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006504#comment-15006504 ] Emmanuel Bourg commented on IO-487: --- For the simplified pattern syntax we can reuse

[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Sebb (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006495#comment-15006495 ] Sebb commented on IO-487: - Wildcard matching such as {{withClass("com.bar.Bar*")}} uses a syntax which AFAIK is not

[jira] [Commented] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

2015-11-16 Thread Bertrand Delacretaz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006512#comment-15006512 ] Bertrand Delacretaz commented on IO-487: bq. ...we can reuse FilenameUtils.wildcardMatch(String,

[jira] [Commented] (COMPRESS-327) Support in-memory processing for ZipFile

2015-11-16 Thread Brett Kail (JIRA)
[ https://issues.apache.org/jira/browse/COMPRESS-327?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15008154#comment-15008154 ] Brett Kail commented on COMPRESS-327: - The patch seems to be missing the new(?) SeekableInputStream