[imaging] Apache Commons Imaging 1.0 final release ?

2017-08-28 Thread Olivier Jaquemet
Hi imagers :) As far I could find, no official release of org.apache.commons/commons-imaging was ever published to maven. I understand that the current snapshot build is stable and that previous sanselan release are too. That said, an official build would certainly increase confidence in the l

Re: [imaging] Apache Commons Imaging 1.0 final release ?

2017-08-28 Thread Olivier Jaquemet
initial release. CheersBruno From: Olivier Jaquemet To: "user@commons.apache.org" Sent: Monday, 28 August 2017, 9:11:08 PM NZSTSubject: [imaging] Apache Commons Imaging 1.0 final release ? Hi imagers :) As far I could find, no official release of org.apache.commons/commons-imaging was

Re: [SECURITY] CVE-2023-24998 Apache Commons FileUpload - DoS with excessive parts

2023-02-20 Thread Olivier Jaquemet
Hello Mark Thank you for this advisory. The changes report [1] of Commons FileUpload 1.5 indicates :    "Add a configurable limit (disabled by default) for the number of files to upload per request" Does it mean that the 1.5 is not secured by default against CVE-2023-24998, and require expl

Re: [SECURITY] CVE-2023-24998 Apache Commons FileUpload - DoS with excessive parts

2023-02-20 Thread Olivier Jaquemet
On 20/02/2023 17:52, Mark Thomas wrote: On 20/02/2023 16:40, Olivier Jaquemet wrote: Does it mean that the 1.5 is not secured by default against CVE-2023-24998, and require explicit configuration to be secured ? Correct. Commons FileUpload does not enable any of the limits (individual file

[file-upload] FileCountMax limit of 1.5 incorrectly count both simple form fields and files

2023-02-21 Thread Olivier Jaquemet
Hello, I would like to report a bug against the Apache Commons FileUpload 1.5. However, because the JIRA is restricted, I do not have the authorization to create a new issue. Here is my bug report, and corresponding pull request with unittest+fix TITLE : FileCountMax limit incorrectly c

Re: FileUpload 1.5 question

2023-02-28 Thread Olivier Jaquemet
Hi, If you are a user of the Apache Common FileUpload library, you must set them manually, there are no limits in the default values for all those settings : https://github.com/apache/commons-fileupload/blob/commons-fileupload-1.5/src/main/java/org/apache/commons/fileupload/FileUploadBase.java

Re: FileUpload 1.5 question

2023-02-28 Thread Olivier Jaquemet
hoping not to have to submit a code change to address this fix. Upgrading Tomcat and adding the parameter to the connector is a much more efficient solution. On Tue, Feb 28, 2023 at 11:33 AM Olivier Jaquemet < olivier.jaque...@jalios.com> wrote: Hi, If you are a user of the Apache

Re: [fileupload] question about compatibility

2023-07-04 Thread Olivier Jaquemet
Hi Velitchko, I highly recommend "Java API Compliance Checker" when you want to check binary compatibility between two version of the same library. https://lvc.github.io/japi-compliance-checker/ Very useful tool ! Olivier On 04/07/2023 11:34, Gary Gregory wrote: Hi Velitchko, Releases wit

Re: [ANNOUNCE] Apache Commons Compress 1.26.0

2024-02-19 Thread Olivier Jaquemet
Hello Gary, Thank you for this release. I'd like to point out to users of Commons Compress that this version 1.26.0 introduce a *new* dependency to commons-codec (for which it uses the latest 1.16.1). https://central.sonatype.com/artifact/org.apache.commons/commons-compress/dependencies So