[jira] [Assigned] (CXF-8185) Generated Ephemeral Public Key missing in JWE Headers when Json Serialization is used
[ https://issues.apache.org/jira/browse/CXF-8185?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Colm O hEigeartaigh reassigned CXF-8185: Assignee: Colm O hEigeartaigh > Generated Ephemeral Public Key missing in JWE Headers when Json Serialization > is used > - > > Key: CXF-8185 > URL: https://issues.apache.org/jira/browse/CXF-8185 > Project: CXF > Issue Type: Bug > Components: JAX-RS Security >Affects Versions: 3.3.4 >Reporter: Frederik Libert >Assignee: Colm O hEigeartaigh >Priority: Blocker > Time Spent: 10m > Remaining Estimate: 0h > > When using Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static > (ECDH-ES), the > JWA Specification says that an Ephemeral Public Key MUST be set as "epk" > Header Parameter ( > https://tools.ietf.org/html/rfc7518#page-16). > The key is generated during the encryption process. > However, it is only added to the jwe output when using compact serialization. > When using Json serialization, the header gets lost somewhere along the way. -- This message was sent by Atlassian Jira (v8.3.4#803005)
[jira] [Commented] (CXF-8156) Incorrect service name displayed in logs during Runtime Exception
[ https://issues.apache.org/jira/browse/CXF-8156?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17006747#comment-17006747 ] Colm O hEigeartaigh commented on CXF-8156: -- Can you put together a test-case to reproduce the problem? > Incorrect service name displayed in logs during Runtime Exception > - > > Key: CXF-8156 > URL: https://issues.apache.org/jira/browse/CXF-8156 > Project: CXF > Issue Type: Bug > Components: JAX-RS >Reporter: Swathantra Kumar N >Priority: Major > > This is with reference to the ticket CXF-2538, wherein the service name was > appended to the exception stack trace logs. For this getName() of the > JAXRSServiceImpl was used to get the name of the service. > In getName() method, when the serviceName and address properties are null, > then we pick up first record in the classResourceInfos list. In scenarios > where there are multiple endpoints and I am not setting the serviceName > property while constructing JAXRSServiceImpl which happens in > initializeServiceModel() of JAXRSServiceFactoryBean. Because, there isn't a > specific service that I can initialize during the service factory creation(I > have multiple rest services). In these scenarios, when I request a service > and the service throws Runtime exception, In the logs I see an incorrect > Service Name being displayed due to the fact that we are hardcoding to pick > the first item in the classResourceInfos. > > Is there a specific purpose of hardcoding to pick the first item in the list > ? I feel there should be a logic to determine the particular Service name > which I requested, may be CXF-5360 where there is a discussion of selecting > an appropriate service name using ResourceComparator when there are multiple > rest services could be used to decide on the serviceName ? > -- This message was sent by Atlassian Jira (v8.3.4#803005)
[jira] [Updated] (CXF-8097) Equal candidates for handling the current request (HEAD / GET)
[ https://issues.apache.org/jira/browse/CXF-8097?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Carsten D updated CXF-8097: --- Attachment: cxf-8097-mcve.zip > Equal candidates for handling the current request (HEAD / GET) > -- > > Key: CXF-8097 > URL: https://issues.apache.org/jira/browse/CXF-8097 > Project: CXF > Issue Type: Bug > Components: JAX-RS >Affects Versions: 3.3.2, 3.3.3 >Reporter: Carsten D >Priority: Major > Attachments: Screenshot 2019-12-17 at 08.44.29.png, cxf-8097-mcve.zip > > > I have just migrated a very outdated Spring backend to Spring 5 and with it > upgraded CXF to first 3.3.2 and just now 3.3.3. I have a REST service class > defining two different methods with the same path defined via > {{javax.ws.rs.Path}} annotation, differentiated by {{javax.ws.rs.HEAD}} and > {{javax.ws.rs.GET}} annotations. Both methods are annotated with > {{@Produces(MediaType.APPLICATION_OCTET_STREAM)}}. > When this method is called I get (redacted): > {{WARN [JAXRSUtils.compare:129] Both ServiceRestImpl#getFile and > ServiceRestImpl#getFileAsHeadRequest are equal candidates for handling the > current request which can lead to unpredictable results}} > The differentiation works: HEAD requests are handled by the {{@HEAD}} > annotated method and GET requests by the {{@GET}} annotated one (this has > always worked). Therefore the warning is false but will severely clutter > production log output, possibly affect performance. > Relevant dependencies: > * Spring framework 5.1.8 > * "org.apache.cxf", "cxf-rt-rs-service-description", "3.3.3" > * "javax.servlet", "javax.servlet-api", "4.0.1" > * "javax.ws.rs", "javax.ws.rs-api", "2.0.1" > I'd appreciate support. May be linked to: > * CXF-7670 > * CXF-6684 -- This message was sent by Atlassian Jira (v8.3.4#803005)
[jira] [Commented] (CXF-8097) Equal candidates for handling the current request (HEAD / GET)
[ https://issues.apache.org/jira/browse/CXF-8097?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17006804#comment-17006804 ] Carsten D commented on CXF-8097: [~coheigea] I have now managed to mostly strip my project to reproduce the problem. Please see [^cxf-8097-mcve.zip]. You may run this server after extracting it with {code} ./gradlew runTestServer {code} Afterwards you should be able to trigger this warning by sending HEAD and GET requests: {code} // this is the HEAD request which produces the WARN log statement curl --location --head 'http://localhost:8989/api/test/path/x/y/z/test' // this calls a different method but on the same path, this does not produce the log statement curl --location --request GET 'http://localhost:8989/api/test/path/x/y/z/test' {code} > Equal candidates for handling the current request (HEAD / GET) > -- > > Key: CXF-8097 > URL: https://issues.apache.org/jira/browse/CXF-8097 > Project: CXF > Issue Type: Bug > Components: JAX-RS >Affects Versions: 3.3.2, 3.3.3 >Reporter: Carsten D >Priority: Major > Attachments: Screenshot 2019-12-17 at 08.44.29.png, cxf-8097-mcve.zip > > > I have just migrated a very outdated Spring backend to Spring 5 and with it > upgraded CXF to first 3.3.2 and just now 3.3.3. I have a REST service class > defining two different methods with the same path defined via > {{javax.ws.rs.Path}} annotation, differentiated by {{javax.ws.rs.HEAD}} and > {{javax.ws.rs.GET}} annotations. Both methods are annotated with > {{@Produces(MediaType.APPLICATION_OCTET_STREAM)}}. > When this method is called I get (redacted): > {{WARN [JAXRSUtils.compare:129] Both ServiceRestImpl#getFile and > ServiceRestImpl#getFileAsHeadRequest are equal candidates for handling the > current request which can lead to unpredictable results}} > The differentiation works: HEAD requests are handled by the {{@HEAD}} > annotated method and GET requests by the {{@GET}} annotated one (this has > always worked). Therefore the warning is false but will severely clutter > production log output, possibly affect performance. > Relevant dependencies: > * Spring framework 5.1.8 > * "org.apache.cxf", "cxf-rt-rs-service-description", "3.3.3" > * "javax.servlet", "javax.servlet-api", "4.0.1" > * "javax.ws.rs", "javax.ws.rs-api", "2.0.1" > I'd appreciate support. May be linked to: > * CXF-7670 > * CXF-6684 -- This message was sent by Atlassian Jira (v8.3.4#803005)
[jira] [Comment Edited] (CXF-8097) Equal candidates for handling the current request (HEAD / GET)
[ https://issues.apache.org/jira/browse/CXF-8097?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17006804#comment-17006804 ] Carsten D edited comment on CXF-8097 at 1/2/20 1:26 PM: [~coheigea] I have now managed to mostly strip my project to reproduce the problem. Please see [^cxf-8097-mcve.zip]. You may run this server after extracting it with {code} ./gradlew runTestServer {code} Afterwards you should be able to trigger this warning by sending HEAD and GET requests: {code} // this is the HEAD request which produces the WARN log statement curl --location --head 'http://localhost:8989/api/test/path/x/y/z/test' // this calls a different method but on the same path, this does not produce the log statement curl --location --request GET 'http://localhost:8989/api/test/path/x/y/z/test' {code} Output: {code} 2020-01-02 14:18:01,509 INFO [qtp1970436060-24] [] [ServletRequestLogHandler.handle:23] Request: HEAD /api/test/path/x/y/z/test, Content-Type: null, Body: 0 bytes 2020-01-02 14:18:01,595 WARN [qtp1970436060-24] [] [JAXRSUtils.compare:129] Both com.test.app.rest.service.impl.TestRestServiceImpl#test and com.test.app.rest.service.impl.TestRestServiceImpl#testAsHeadRequest are equal candidates for handling the current request which can lead to unpredictable results 2020-01-02 14:18:01,599 INFO [qtp1970436060-24] [] [TestRestServiceImpl.testAsHeadRequest:46] HEAD request 2020-01-02 14:18:01,630 INFO [qtp1970436060-24] [] [ServletRequestLogHandler.handle:33] Response -- Status: 200, Content-Type: application/octet-stream {code} was (Author: carsten.d): [~coheigea] I have now managed to mostly strip my project to reproduce the problem. Please see [^cxf-8097-mcve.zip]. You may run this server after extracting it with {code} ./gradlew runTestServer {code} Afterwards you should be able to trigger this warning by sending HEAD and GET requests: {code} // this is the HEAD request which produces the WARN log statement curl --location --head 'http://localhost:8989/api/test/path/x/y/z/test' // this calls a different method but on the same path, this does not produce the log statement curl --location --request GET 'http://localhost:8989/api/test/path/x/y/z/test' {code} > Equal candidates for handling the current request (HEAD / GET) > -- > > Key: CXF-8097 > URL: https://issues.apache.org/jira/browse/CXF-8097 > Project: CXF > Issue Type: Bug > Components: JAX-RS >Affects Versions: 3.3.2, 3.3.3 >Reporter: Carsten D >Priority: Major > Attachments: Screenshot 2019-12-17 at 08.44.29.png, cxf-8097-mcve.zip > > > I have just migrated a very outdated Spring backend to Spring 5 and with it > upgraded CXF to first 3.3.2 and just now 3.3.3. I have a REST service class > defining two different methods with the same path defined via > {{javax.ws.rs.Path}} annotation, differentiated by {{javax.ws.rs.HEAD}} and > {{javax.ws.rs.GET}} annotations. Both methods are annotated with > {{@Produces(MediaType.APPLICATION_OCTET_STREAM)}}. > When this method is called I get (redacted): > {{WARN [JAXRSUtils.compare:129] Both ServiceRestImpl#getFile and > ServiceRestImpl#getFileAsHeadRequest are equal candidates for handling the > current request which can lead to unpredictable results}} > The differentiation works: HEAD requests are handled by the {{@HEAD}} > annotated method and GET requests by the {{@GET}} annotated one (this has > always worked). Therefore the warning is false but will severely clutter > production log output, possibly affect performance. > Relevant dependencies: > * Spring framework 5.1.8 > * "org.apache.cxf", "cxf-rt-rs-service-description", "3.3.3" > * "javax.servlet", "javax.servlet-api", "4.0.1" > * "javax.ws.rs", "javax.ws.rs-api", "2.0.1" > I'd appreciate support. May be linked to: > * CXF-7670 > * CXF-6684 -- This message was sent by Atlassian Jira (v8.3.4#803005)
[jira] [Updated] (CXF-8097) Equal candidates for handling the current request (HEAD / GET)
[ https://issues.apache.org/jira/browse/CXF-8097?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Carsten D updated CXF-8097: --- Affects Version/s: 3.3.4 > Equal candidates for handling the current request (HEAD / GET) > -- > > Key: CXF-8097 > URL: https://issues.apache.org/jira/browse/CXF-8097 > Project: CXF > Issue Type: Bug > Components: JAX-RS >Affects Versions: 3.3.2, 3.3.3, 3.3.4 >Reporter: Carsten D >Priority: Major > Attachments: Screenshot 2019-12-17 at 08.44.29.png, cxf-8097-mcve.zip > > > I have just migrated a very outdated Spring backend to Spring 5 and with it > upgraded CXF to first 3.3.2 and just now 3.3.3. I have a REST service class > defining two different methods with the same path defined via > {{javax.ws.rs.Path}} annotation, differentiated by {{javax.ws.rs.HEAD}} and > {{javax.ws.rs.GET}} annotations. Both methods are annotated with > {{@Produces(MediaType.APPLICATION_OCTET_STREAM)}}. > When this method is called I get (redacted): > {{WARN [JAXRSUtils.compare:129] Both ServiceRestImpl#getFile and > ServiceRestImpl#getFileAsHeadRequest are equal candidates for handling the > current request which can lead to unpredictable results}} > The differentiation works: HEAD requests are handled by the {{@HEAD}} > annotated method and GET requests by the {{@GET}} annotated one (this has > always worked). Therefore the warning is false but will severely clutter > production log output, possibly affect performance. > Relevant dependencies: > * Spring framework 5.1.8 > * "org.apache.cxf", "cxf-rt-rs-service-description", "3.3.3" > * "javax.servlet", "javax.servlet-api", "4.0.1" > * "javax.ws.rs", "javax.ws.rs-api", "2.0.1" > I'd appreciate support. May be linked to: > * CXF-7670 > * CXF-6684 -- This message was sent by Atlassian Jira (v8.3.4#803005)
[jira] [Commented] (CXF-7910) Change JAX-WS javax to jakarta artifact dependencies
[ https://issues.apache.org/jira/browse/CXF-7910?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17007068#comment-17007068 ] S V Mohana Rao commented on CXF-7910: - [~deki] Could you please update is it ready for release. Even the application is pointing to the Jakarta dependencies cxf pulling javax dependencies. {code:xml} [INFO] | +- org.apache.cxf:cxf-rt-bindings-soap:jar:3.3.4:compile [INFO] | | +- org.apache.cxf:cxf-rt-wsdl:jar:3.3.4:compile [INFO] | | | \- wsdl4j:wsdl4j:jar:1.6.3:compile [INFO] | | +- org.apache.cxf:cxf-rt-databinding-jaxb:jar:3.3.4:compile [INFO] | | +- javax.annotation:javax.annotation-api:jar:1.3.2:compile [INFO] | | \- com.sun.activation:javax.activation:jar:1.2.0:compile {code} > Change JAX-WS javax to jakarta artifact dependencies > > > Key: CXF-7910 > URL: https://issues.apache.org/jira/browse/CXF-7910 > Project: CXF > Issue Type: Task > Components: JAX-WS Runtime >Reporter: Dennis Kieselhorst >Priority: Minor > Fix For: 3.4.0 > > Time Spent: 10m > Remaining Estimate: 0h > > See https://github.com/eclipse-ee4j/jax-ws-api/issues/46 > According to https://projects.eclipse.org/projects/ee4j.jaxws/ will be > released on 2018-12-14. -- This message was sent by Atlassian Jira (v8.3.4#803005)
[jira] [Commented] (CXFXJC-36) Use Jakarta API dependencies
[ https://issues.apache.org/jira/browse/CXFXJC-36?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17007091#comment-17007091 ] S V Mohana Rao commented on CXFXJC-36: -- Could you please release these changes > Use Jakarta API dependencies > > > Key: CXFXJC-36 > URL: https://issues.apache.org/jira/browse/CXFXJC-36 > Project: CXF XJC Utils > Issue Type: Improvement >Affects Versions: 3.3.0 >Reporter: Alexey Markevich >Priority: Major > Fix For: 3.3.1 > > Time Spent: 20m > Remaining Estimate: 0h > -- This message was sent by Atlassian Jira (v8.3.4#803005)
[jira] [Assigned] (CXF-8097) Equal candidates for handling the current request (HEAD / GET)
[ https://issues.apache.org/jira/browse/CXF-8097?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Andriy Redko reassigned CXF-8097: - Assignee: Andriy Redko > Equal candidates for handling the current request (HEAD / GET) > -- > > Key: CXF-8097 > URL: https://issues.apache.org/jira/browse/CXF-8097 > Project: CXF > Issue Type: Bug > Components: JAX-RS >Affects Versions: 3.3.2, 3.3.3, 3.3.4 >Reporter: Carsten D >Assignee: Andriy Redko >Priority: Major > Attachments: Screenshot 2019-12-17 at 08.44.29.png, cxf-8097-mcve.zip > > > I have just migrated a very outdated Spring backend to Spring 5 and with it > upgraded CXF to first 3.3.2 and just now 3.3.3. I have a REST service class > defining two different methods with the same path defined via > {{javax.ws.rs.Path}} annotation, differentiated by {{javax.ws.rs.HEAD}} and > {{javax.ws.rs.GET}} annotations. Both methods are annotated with > {{@Produces(MediaType.APPLICATION_OCTET_STREAM)}}. > When this method is called I get (redacted): > {{WARN [JAXRSUtils.compare:129] Both ServiceRestImpl#getFile and > ServiceRestImpl#getFileAsHeadRequest are equal candidates for handling the > current request which can lead to unpredictable results}} > The differentiation works: HEAD requests are handled by the {{@HEAD}} > annotated method and GET requests by the {{@GET}} annotated one (this has > always worked). Therefore the warning is false but will severely clutter > production log output, possibly affect performance. > Relevant dependencies: > * Spring framework 5.1.8 > * "org.apache.cxf", "cxf-rt-rs-service-description", "3.3.3" > * "javax.servlet", "javax.servlet-api", "4.0.1" > * "javax.ws.rs", "javax.ws.rs-api", "2.0.1" > I'd appreciate support. May be linked to: > * CXF-7670 > * CXF-6684 -- This message was sent by Atlassian Jira (v8.3.4#803005)
[jira] [Commented] (CXF-8097) Equal candidates for handling the current request (HEAD / GET)
[ https://issues.apache.org/jira/browse/CXF-8097?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17007123#comment-17007123 ] Andriy Redko commented on CXF-8097: --- Hey [~carsten.d] , Thanks a lot for the sample project. I've noticed that you are using custom resource comparator (by overriding the CXF's default one): {noformat} ... factory.setResourceComparator(new QueryResourceInfoComperator()); factory.setServiceName(new QName("CXF-8097")); return factory.create(); {noformat} This comparator's implementation is the reason why you see warning. When default CXF resource comparator is used , the warning is gone: {noformat} 2020-01-02 16:24:53,814 INFO [qtp603658030-20] [] [ServletRequestLogHandler.handle:23] Request: HEAD /api/test/path/x/y/z/test, Content-Type: null, Body: 0 bytes 2020-01-02 16:24:53,828 INFO [qtp603658030-20] [] [TestRestServiceImpl.testAsHeadRequest:46] HEAD request 2020-01-02 16:24:53,828 INFO [qtp603658030-20] [] [ServletRequestLogHandler.handle:33] Response -- Status: 200, Content-Type: application/octet-stream 2020-01-02 16:24:55,808 INFO [qtp603658030-19] [] [ServletRequestLogHandler.handle:23] Request: GET /api/test/path/x/y/z/test, Content-Type: null, Body: 0 bytes 2020-01-02 16:24:55,810 INFO [qtp603658030-19] [] [TestRestServiceImpl.test:34] GET request 2020-01-02 16:24:55,810 INFO [qtp603658030-19] [] [ServletRequestLogHandler.handle:33] Response -- Status: 200, Content-Type: null {noformat} The issue is that the custom comparator (*QueryResourceInfoComperator*) is inherited from *OperationResourceInfoComparator* but does not properly initialize it (passing *null*s to parent's constructor). {noformat} public QueryResourceInfoComperator() { super(null, null); } {noformat} This is purely CXF documentation fault (since this where the original example of custom resource comparator comes from), the *OperationResourceInfoComparator* is not reusable and is very context-dependent. Probably, the simplest solution in this case is to remove *OperationResourceInfoComparator* from inheritance chain and use delegation instead (otherwise the important details (like HTTP method) are not passed through, leading to warnings and surprises), for example: {noformat} @Override public int compare(OperationResourceInfo oper1, OperationResourceInfo oper2, Message message) { // HTTP method final String httpMethod = HttpUtils.getProtocolHeader(message, Message.HTTP_REQUEST_METHOD, HttpMethod.POST, true); final OperationResourceInfoComparator delegate = new OperationResourceInfoComparator(null, httpMethod); // Check if CXF can make a decision final int cxfResult = delegate .compare(oper1, oper2); ... } {noformat} The proper fix would take some time but the workaround with delegation should do the job meantime. I am wondering, would it work for the time being? Thank you. Best Regards, Andriy Redko > Equal candidates for handling the current request (HEAD / GET) > -- > > Key: CXF-8097 > URL: https://issues.apache.org/jira/browse/CXF-8097 > Project: CXF > Issue Type: Bug > Components: JAX-RS >Affects Versions: 3.3.2, 3.3.3, 3.3.4 >Reporter: Carsten D >Priority: Major > Attachments: Screenshot 2019-12-17 at 08.44.29.png, cxf-8097-mcve.zip > > > I have just migrated a very outdated Spring backend to Spring 5 and with it > upgraded CXF to first 3.3.2 and just now 3.3.3. I have a REST service class > defining two different methods with the same path defined via > {{javax.ws.rs.Path}} annotation, differentiated by {{javax.ws.rs.HEAD}} and > {{javax.ws.rs.GET}} annotations. Both methods are annotated with > {{@Produces(MediaType.APPLICATION_OCTET_STREAM)}}. > When this method is called I get (redacted): > {{WARN [JAXRSUtils.compare:129] Both ServiceRestImpl#getFile and > ServiceRestImpl#getFileAsHeadRequest are equal candidates for handling the > current request which can lead to unpredictable results}} > The differentiation works: HEAD requests are handled by the {{@HEAD}} > annotated method and GET requests by the {{@GET}} annotated one (this has > always worked). Therefore the warning is false but will severely clutter > production log output, possibly affect performance. > Relevant dependencies: > * Spring framework 5.1.8 > * "org.apache.cxf", "cxf-rt-rs-service-description", "3.3.3" > * "javax.servlet", "javax.servlet-api", "4.0.1" > * "javax.ws.rs", "javax.ws.rs-api", "2.0.1" > I'd appreciate support. May be linked to: > * CXF-7670 > * CXF-6684 -- This message was sent by Atlassian Jira (v8.3.4#803005)
[jira] [Commented] (CXF-7910) Change JAX-WS javax to jakarta artifact dependencies
[ https://issues.apache.org/jira/browse/CXF-7910?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17007262#comment-17007262 ] Dennis Kieselhorst commented on CXF-7910: - [~mohanaraosv] you can already use 3.3.4 with the new Jakarta dependencies by excluding the javax ones and adding the new ones manually. We will provide updated POMs with 3.4.0. > Change JAX-WS javax to jakarta artifact dependencies > > > Key: CXF-7910 > URL: https://issues.apache.org/jira/browse/CXF-7910 > Project: CXF > Issue Type: Task > Components: JAX-WS Runtime >Reporter: Dennis Kieselhorst >Priority: Minor > Fix For: 3.4.0 > > Time Spent: 10m > Remaining Estimate: 0h > > See https://github.com/eclipse-ee4j/jax-ws-api/issues/46 > According to https://projects.eclipse.org/projects/ee4j.jaxws/ will be > released on 2018-12-14. -- This message was sent by Atlassian Jira (v8.3.4#803005)