Hi!
Thank you for your quick answer. This service overriding ist exactly what I'm
struggling with.
What I tried was
@Contribute(ServiceOverride.class)
public static void
setupApplicationServiceOverrides(MappedConfiguration<Class,Object>
configuration) {
configuration.addInstance(AssetRequestHandler.class,
PatchedAssetDispatcher.class);
}
@Contribute(ServiceOverride.class)
public static void
setupApplicationServiceOverrides(MappedConfiguration<Class,Object>
configuration) {
configuration.addInstance(Dispatcher.class, PatchedAssetDispatcher.class);
}
yielding to following error
2021-05-28 16:11:28,928 [main] ERROR org.apache.tapestry5.ioc.Registry -
java.lang.StackOverflowError
java.lang.NoClassDefFoundError: Could not initialize class
org.apache.tapestry5.ioc.internal.IOCMessages
at
org.apache.tapestry5.ioc.internal.ContributionDefImpl.invokeMethod(ContributionDefImpl.java:130)
.
.
.
Also tried
public static void bind(ServiceBinder binder) {
binder.bind(Dispatcher.class,
PatchedAssetDispatcher.class).withId("AssetDispatcher");
}
which yields
java.lang.RuntimeException: Service id 'AssetDispatcher' has already been
defined by org.apache.tapestry5.internal.services.AssetDispatcher(Map, String,
String, String) (at AssetDispatcher.java:68) via
org.apache.tapestry5.service....
Any hint, what I'm doing wrong would be very welcome.
Best Regards
Reinhold
Gesendet: Freitag, 28. Mai 2021 um 15:44 Uhr
Von: "Dmitry Gusev" <[email protected]>
An: "Tapestry users" <[email protected]>
Betreff: Re: AssetDispatcher Tapestry 5.3.8
Hi!
AssetDispatcher is a regular tapestry service, I'd expect that you can
replace it with your own implementation using service overrides:
https://tapestry.apache.org/ioc-cookbook-overriding-ioc-services.html
The service is bound with marker annotation and
AssetRequestDispatcher.class, with id=AssetDispatcher.
You can try the latest implementation from 5.6 branch, it should be
compatible with 5.3 I think:
https://github.com/apache/tapestry-5/blob/5.6.x/tapestry-core/src/main/java/org/apache/tapestry5/internal/services/AssetDispatcher.java[https://github.com/apache/tapestry-5/blob/5.6.x/tapestry-core/src/main/java/org/apache/tapestry5/internal/services/AssetDispatcher.java]
Hope this helps,
Dmitry
On Fri, May 28, 2021 at 1:41 PM Reinhold Gruber <[email protected]> wrote:
> Hi!
>
> Some emergency. Any help highly appreciated.
> The AssetDispatcher in Tapestry 5.3.8 allows harmful requests, reading
> contents from WEB-INF etc.
> We currently do not have the time to update to the newest Tapestry version
> and we need to to something quick, right now.
> So I would like to ask how the current AssetDispatcher can be replaced by
> a more secure version?
> What needs to be done in the application module class. Tried there various
> things but did not make it work.
> Does anyone maybe have already a patched class handy?
>
> Best Regards,
> Reinhold
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>
>
--
Dmitry Gusev
AnjLab Team
http://anjlab.com[http://anjlab.com]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
