Re: using cocoon 2.1 in the long-term, security concerns
Leszek Gawron <[email protected]> Sat, 31 Jul 2021 14:22:15 +0200
| Newsgroups | gmane.text.xml.cocoon.user |
|---|---|
| Message-ID | <CAM3qyx+Ze0YPj88gjX+wOxc5-Kgux8O7EinWX=hzBr4Uc5dTTw@mail.gmail.com> |
--00000000000088f2b905c86a6366
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
I have never attempted a cocoon release - doesn't look like a trivial task,
so maybe someone here has more experience?
I'd like one more thing "fixed" if it's possible:
org.apache.cocoon.forms.formmodel.Repeater has some "crazy" limitation that
has hit me several times on production:
if (size > 500) {
//throw new RuntimeException("Client is not allowed to
specify a repeater size larger than 500.");
}
could we lift that off or at least make the constraint configurable ?
On Fri, Jul 30, 2021 at 1:37 PM Gabriel Gruber <[email protected]>
wrote:
> Hi Leszak,
>
>
>
> Yeah, a release would be nice =E2=80=93 Fix version 2.2.1 was stated in t=
his
> ticket https://issues.apache.org/jira/browse/COCOON-2347
>
>
>
> But was never released though=E2=80=A6
>
> Cheers,
>
> Gabriel
>
>
>
> *From: *Leszek Gawron <[email protected]>
> *Date: *Friday, 30. July 2021 at 10:35
> *To: *[email protected] <[email protected]>
> *Subject: *Re: using cocoon 2.1 in the long-term, security concerns
>
> I am sorry for not reading the thread to the last message. Maybe a releas=
e
> then?
>
>
>
> On Tue, Jul 20, 2021 at 12:39 PM Gabriel Gruber <
> [email protected]> wrote:
>
> Hi Vincent,
>
>
>
> We at Workflow are also still using Cocoon 2.2 as part of our main produc=
t
> and are running it with Java 11 and Tomcat 9 on Windows and Linux OSes. =
In
> the past we did not see any major problem with cocoon which were not
> solvable. From a security perspective maybe the biggest thread was a
> directory traversal opportunity if you would use ResourceReader cocoon
> component in the wrong way allowing users to use the /.. in
> URL/request-parameters being forwarded to the path of the resource to be
> read in order to traverse the directory of the deployment.
>
>
>
> Latest Cocoon 2.2 trunk is also compatible with Spring 4.x by the way.
>
>
>
> Cheers,
>
> Gabriel Gruber
>
> www.workflow.at
>
>
>
>
>
> *Von:* Vincent Neyt <[email protected]>
> *Gesendet:* Dienstag, 20. Juli 2021 12:28
> *An:* [email protected]
> *Betreff:* Re: using cocoon 2.1 in the long-term, security concerns
>
>
>
> Thank you very much Warrell, C=C3=A9dric, Greg and Chris.
>
>
>
> I'm happy to hear that you believe Cocoon poses a very low security risk
> as long as Tomcat and Java are up to date, and that Cocoon should continu=
e
> to work well with future versions of T & J as long as the dependency
> libraries in Cocoon are updated. (At least until Tomcat 9 is no longer
> supported.)
>
>
>
> best wishes,
>
> Vincent
>
>
>
>
>
>
>
>
>
>
>
> On Mon, Jul 19, 2021 at 6:35 PM Christopher Schultz <
> [email protected]> wrote:
>
> Vincent,
>
> On 7/19/21 08:03, Vincent Neyt wrote:
> > Hi Cocoon users,
> >
> > I'd like to ask your opinion on the long-term security risks of running
> > Cocoon on a server. The colleague responsible for the servers at my
> > university is inquiring if the software I'm using for my website is up
> > to date and is concerned that I'm using outdated software that could in
> > the future pose a security risk.
> >
> > I'm using cocoon 2.1.11, which I could probably upgrade to 2.1.13
> > without many problems. But I'm concerned about the long-term, and
> > wondering if it would perhaps be better to reprogram the website I've
> > been working on for 10 years into eXist DB (which would be a huge time
> > investment). I like cocoon very much and would love to continue using i=
t
> > if it's possible.
> >
> > I'm curious to hear your thoughts about using Cocoon 2.1 for the long
> > term: will it still work well inside future versions of servlet
> > containers like Tomcat? What about the java dependencies? And will
> > cocoon 2.1 continue to put out updates when security risks are
> identified?
>
> I, like you, have been running Cocoon 2.1.x for years and would like to
> continue to rely on it for some important functions at $work.
>
> I don't see any reason it wouldn't run on current and future Tomcat
> versions. There are a few "current" versions of Tomcat, and the only one
> I would expect to have some issues would be the Tomcat 10.x series,
> which implement the "Jakarta EE" specifications instead of the "Java EE"
> specifications. For the most part, these specifications are simply
> package-renamed versions of the original Java EE specs. So, for example,
> javax.servlet.whatever becomes jakarta.servlet.whatever and so on.
>
> Tomcat has a migration tool which can migrate a binary web application
> (e.g. WAR file) from Java EE to Jakarta EE. It would be good to know if
> that tool works on a webapp which is Cocoon itself and/or
> Cocoon-bundled-with-your-application.
>
> I'm a Tomcat committer and if there are any problems, we could work
> together to make sure Cocoon has plenty of life left in it.
>
> With the semi-recent release of Cocoon 2.2, are there members of the
> community who would be interested in converting the project into a
> Jakarta EE-based project? There is no particular rush, and most of the
> conversion can be done essentially with a single sed script. But working
> that into the build process so you can say "build me a Java EE-based
> Cocoon" versus "build me a Jakarta EE-based Cocoon" would be really
> beneficial moving into the future.
>
> [As a Cocoon user, I'd love to know what is necessary to upgrade from
> Cocoon 2.1 to 2.2. We have an ant-based build process for our
> application which starts with a pre-built cocoon.war and customizes it
> with everything we need. So if e.g. Maven can build Cocoon into a WAR
> file, I might be all set.]
>
> -chris
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>
>
--00000000000088f2b905c86a6366
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr">I have never attempted a cocoon release=C2=A0- doesn't=
look like a trivial task, so maybe someone here has more experience?<div><=
br></div><div>I'd like one more thing "fixed" if it's pos=
sible:</div><div><br></div><div>org.apache.cocoon.forms.formmodel.Repeater=
=C2=A0has some "crazy" limitation that has hit me several times o=
n production:=C2=A0</div><div><br></div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 if (size > 500) {<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 //throw new RuntimeException("Client is not allow=
ed to specify a repeater size larger than 500.");<br>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 }<br></div><div><br></div><div>could we lift that =
off or at least make the constraint configurable ?=C2=A0</div><div><br></di=
v></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr=
">On Fri, Jul 30, 2021 at 1:37 PM Gabriel Gruber <<a href=3D"mailto:gabr=
[email protected]">[email protected]</a>> wrote:<br></div>=
<blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-=
left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang=3D"en-AT" style=3D"overflow-wrap: break-word;">
<div class=3D"gmail-m_6670510806211068052WordSection1">
<p class=3D"MsoNormal"><span lang=3D"DE-AT">Hi Leszak,<u></u><u></u></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"DE-AT"><u></u>=C2=A0<u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">Yeah, a release would be nice =
=E2=80=93 Fix version 2.2.1 was stated in this ticket
<a href=3D"https://issues.apache.org/jira/browse/COCOON-2347" target=3D"_bl=
ank">https://issues.apache.org/jira/browse/COCOON-2347</a><u></u><u></u></s=
pan></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><u></u>=C2=A0<u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">But was never released though=
=E2=80=A6<u></u><u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">Cheers,<u></u><u></u></span></p=
>
<p class=3D"MsoNormal"><span lang=3D"EN-US">Gabriel<u></u><u></u></span></p=
>
<p class=3D"MsoNormal"><span><u></u>=C2=A0<u></u></span></p>
<div style=3D"border-right:none;border-bottom:none;border-left:none;border-=
top:1pt solid rgb(181,196,223);padding:3pt 0cm 0cm">
<p class=3D"MsoNormal" style=3D"margin-bottom:12pt"><b><span style=3D"font-=
size:12pt;color:black">From:
</span></b><span style=3D"font-size:12pt;color:black">Leszek Gawron <<a =
href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a>><br>
<b>Date: </b>Friday, 30. July 2021 at 10:35<br>
<b>To: </b><a href=3D"mailto:[email protected]" target=3D"_blank">use=
[email protected]</a> <<a href=3D"mailto:[email protected]" tar=
get=3D"_blank">[email protected]</a>><br>
<b>Subject: </b>Re: using cocoon 2.1 in the long-term, security concerns<u>=
</u><u></u></span></p>
</div>
<div>
<p class=3D"MsoNormal">I am sorry for not reading the thread to the last me=
ssage. Maybe a release then?=C2=A0<u></u><u></u></p>
</div>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<div>
<div>
<p class=3D"MsoNormal">On Tue, Jul 20, 2021 at 12:39 PM Gabriel Gruber <=
<a href=3D"mailto:[email protected]" target=3D"_blank">gabriel.gru=
[email protected]</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style=3D"border-top:none;border-right:none;border-bottom:none;b=
order-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin-left:4=
.8pt;margin-right:0cm">
<div>
<div>
<p class=3D"MsoNormal"><span lang=3D"DE-AT">Hi Vincent,<u></u><u></u></span=
></p>
<p class=3D"MsoNormal"><span lang=3D"DE-AT">=C2=A0<u></u><u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-GB">We at Workflow are also still u=
sing Cocoon 2.2 as part of our main product and are running it with Java 11=
and Tomcat 9 on Windows and Linux OSes.=C2=A0 In the past
we did not see any major problem with cocoon which were not solvable. From=
a security perspective maybe the biggest thread was a directory traversal =
opportunity if you would use ResourceReader cocoon component in the wrong w=
ay allowing users to use the =C2=A0/..
in URL/request-parameters =C2=A0being forwarded to the path of the resourc=
e to be read in order to traverse the directory of the deployment.</span><s=
pan lang=3D"DE-AT"><u></u><u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-GB">=C2=A0</span><span lang=3D"DE-A=
T"><u></u><u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-GB">Latest Cocoon 2.2 trunk is also=
compatible with Spring 4.x by the way.</span><span lang=3D"DE-AT"><u></u><=
u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-GB">=C2=A0</span><span lang=3D"DE-A=
T"><u></u><u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-GB">Cheers,</span><span lang=3D"DE-=
AT"><u></u><u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-GB">Gabriel Gruber</span><span lang=
=3D"DE-AT"><u></u><u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-GB"><a href=3D"http://www.workflow.=
at" target=3D"_blank">www.workflow.at</a></span><span lang=3D"DE-AT"><u></u=
><u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-GB">=C2=A0</span><span lang=3D"DE-A=
T"><u></u><u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-GB">=C2=A0</span><span lang=3D"DE-A=
T"><u></u><u></u></span></p>
<div style=3D"border-right:none;border-bottom:none;border-left:none;border-=
top:1pt solid rgb(225,225,225);padding:3pt 0cm 0cm">
<p class=3D"MsoNormal"><b><span lang=3D"DE">Von:</span></b><span lang=3D"DE=
"> Vincent Neyt <<a href=3D"mailto:[email protected]" target=3D"_bl=
ank">[email protected]</a>>
<br>
<b>Gesendet:</b> Dienstag, 20. Juli 2021 12:28<br>
<b>An:</b> <a href=3D"mailto:[email protected]" target=3D"_blank">use=
[email protected]</a><br>
<b>Betreff:</b> Re: using cocoon 2.1 in the long-term, security concerns</s=
pan><span lang=3D"DE-AT"><u></u><u></u></span></p>
</div>
<p class=3D"MsoNormal"><span lang=3D"DE-AT">=C2=A0<u></u><u></u></span></p>
<div>
<p class=3D"MsoNormal"><span lang=3D"DE-AT">Thank you very much Warrell, C=
=C3=A9dric, Greg and Chris.<u></u><u></u></span></p>
<div>
<p class=3D"MsoNormal"><span lang=3D"DE-AT">=C2=A0<u></u><u></u></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span lang=3D"DE-AT">I'm happy to hear that you =
believe Cocoon poses a very low security risk as long as Tomcat and Java ar=
e up to date, and that Cocoon should continue to work well
with future versions of T & J as long as the dependency libraries in C=
ocoon are updated. (At least until Tomcat 9 is no longer supported.)<u></u>=
<u></u></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span lang=3D"DE-AT">=C2=A0<u></u><u></u></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span lang=3D"DE-AT">best wishes,<u></u><u></u></spa=
n></p>
</div>
<div>
<p class=3D"MsoNormal"><span lang=3D"DE-AT">Vincent<u></u><u></u></span></p=
>
</div>
<div>
<p class=3D"MsoNormal"><span lang=3D"DE-AT">=C2=A0<u></u><u></u></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span lang=3D"DE-AT">=C2=A0<u></u><u></u></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span lang=3D"DE-AT">=C2=A0<u></u><u></u></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span lang=3D"DE-AT">=C2=A0<u></u><u></u></span></p>
</div>
</div>
<p class=3D"MsoNormal"><span lang=3D"DE-AT">=C2=A0<u></u><u></u></span></p>
<div>
<div>
<p class=3D"MsoNormal"><span lang=3D"DE-AT">On Mon, Jul 19, 2021 at 6:35 PM=
Christopher Schultz <<a href=3D"mailto:[email protected]" ta=
rget=3D"_blank">[email protected]</a>> wrote:<u></u><u></u></=
span></p>
</div>
<blockquote style=3D"border-top:none;border-right:none;border-bottom:none;b=
order-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin:5pt 0c=
m 5pt 4.8pt">
<p class=3D"MsoNormal" style=3D"margin-bottom:12pt"><span lang=3D"DE-AT">Vi=
ncent,<br>
<br>
On 7/19/21 08:03, Vincent Neyt wrote:<br>
> Hi Cocoon users,<br>
> <br>
> I'd like to ask your opinion on the long-term security risks of ru=
nning <br>
> Cocoon on a server. The colleague responsible for the servers at my <b=
r>
> university is inquiring if the software I'm using for my website i=
s up <br>
> to date and is concerned that I'm using outdated software that cou=
ld in <br>
> the future pose a security risk.<br>
> <br>
> I'm using cocoon 2.1.11, which I could probably upgrade to 2.1.13 =
<br>
> without many problems. But I'm concerned about the long-term, and =
<br>
> wondering if it would perhaps be better to reprogram the website I'=
;ve <br>
> been working on for 10 years into eXist DB (which would be a huge time=
<br>
> investment). I like cocoon very=C2=A0much and would love to continue u=
sing it <br>
> if it's possible.<br>
> <br>
> I'm curious to hear your thoughts about using Cocoon 2.1 for the l=
ong <br>
> term: will it still work well inside future versions of servlet <br>
> containers like Tomcat? What about the java dependencies? And will <br=
>
> cocoon 2.1 continue to put out updates when security risks are identif=
ied?<br>
<br>
I, like you, have been running Cocoon 2.1.x for years and would like to <br=
>
continue to rely on it for some important functions at $work.<br>
<br>
I don't see any reason it wouldn't run on current and future Tomcat=
<br>
versions. There are a few "current" versions of Tomcat, and the o=
nly one <br>
I would expect to have some issues would be the Tomcat 10.x series, <br>
which implement the "Jakarta EE" specifications instead of the &q=
uot;Java EE" <br>
specifications. For the most part, these specifications are simply <br>
package-renamed versions of the original Java EE specs. So, for example, <b=
r>
javax.servlet.whatever becomes jakarta.servlet.whatever and so on.<br>
<br>
Tomcat has a migration tool which can migrate a binary web application <br>
(e.g. WAR file) from Java EE to Jakarta EE. It would be good to know if <br=
>
that tool works on a webapp which is Cocoon itself and/or <br>
Cocoon-bundled-with-your-application.<br>
<br>
I'm a Tomcat committer and if there are any problems, we could work <br=
>
together to make sure Cocoon has plenty of life left in it.<br>
<br>
With the semi-recent release of Cocoon 2.2, are there members of the <br>
community who would be interested in converting the project into a <br>
Jakarta EE-based project? There is no particular rush, and most of the <br>
conversion can be done essentially with a single sed script. But working <b=
r>
that into the build process so you can say "build me a Java EE-based <=
br>
Cocoon" versus "build me a Jakarta EE-based Cocoon" would be=
really <br>
beneficial moving into the future.<br>
<br>
[As a Cocoon user, I'd love to know what is necessary to upgrade from <=
br>
Cocoon 2.1 to 2.2. We have an ant-based build process for our <br>
application which starts with a pre-built cocoon.war and customizes it <br>
with everything we need. So if e.g. Maven can build Cocoon into a WAR <br>
file, I might be all set.]<br>
<br>
-chris<br>
<br>
---------------------------------------------------------------------<br>
To unsubscribe, e-mail: <a href=3D"mailto:[email protected]=
rg" target=3D"_blank">
[email protected]</a><br>
For additional commands, e-mail: <a href=3D"mailto:[email protected]=
.org" target=3D"_blank">
[email protected]</a><u></u><u></u></span></p>
</blockquote>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote></div>
--00000000000088f2b905c86a6366--