[
https://issues.apache.org/jira/browse/LUCENE-5072?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13691439#comment-13691439
]
Uwe Schindler edited comment on LUCENE-5072 at 6/23/13 11:30 AM:
-----------------------------------------------------------------
Hi Sebb,
of course that's what i I did. The confirmation I sent here is just the "final"
check. When using correct charset encoding (which is buggy in Oracle's tool,
because it uses Oracle's default), the output is identical.
was (Author: thetaphi):
Hi Sebb,
of course that's what i I did. The confirmation I sent here is just the "final"
check. When using correct charset encoding (which is buggy in Oracle's tool,
because it uses Oracle's default, the output is identical).
> Fix frame injection bug in javadocs generated with Java 6 (and Java 7 prior
> u25)
> --------------------------------------------------------------------------------
>
> Key: LUCENE-5072
> URL: https://issues.apache.org/jira/browse/LUCENE-5072
> Project: Lucene - Core
> Issue Type: Bug
> Components: general/build
> Affects Versions: 4.3.1
> Reporter: Uwe Schindler
> Assignee: Uwe Schindler
> Fix For: 5.0, 4.4
>
> Attachments: LUCENE-5072.patch, LUCENE-5072.patch, LUCENE-5072.patch
>
>
> The Apache Infra / Security team posted to all committers:
> {quote}
> Hi All,
> Oracle has announced [1], [2] a frame injection vulnerability in Javadoc
> generated by Java 5, Java 6 and Java 7 before update 22.
> [...]
> Please take the necessary steps to fix any currently published Javadoc and to
> ensure that any future Javadoc published by your project does not contain the
> vulnerability. The announcement by Oracle includes a link to a tool that can
> be used to fix Javadoc without regeneration.
> The infrastructure team is investigating options for preventing the
> publication of vulnerable Javadoc.
> The issue is public and may be discussed freely on your project's dev list.
> Thanks,
> Mark (ASF Infra)
> {quote}
> I fixed all published Javadocs on http://lucene.apache.org (for all historic
> releases where we have public available Javadocs on the web page).
> The mail also notes that we should not publish javadocs with this javadocs
> problem in the future. Unfortunately the release manager has to use the
> latest Java 7u25 version (released 2 days) ago. This would be fine for Lucene
> trunk (which is Java 7 only).
> But when we generate Javadocs JARs for Lucene 3 and 4, we cannot use Java 7
> (to build the official release) because the javadocs would contain e.g.
> AutoCloaseable interface unless we use a JDK 6 or 5 bootclasspath (like we do
> for web pages).
> We also want the lucene/solr-*-javadoc.jar files to be correct, but those are
> built with Java 5 (3.x) or Java 6 (4.x).
> Unfortunately Oracle does not relaese a newer JDK 5 or JDK 6, so its
> impossible to do a release.
> But Oracle publishes the binary and source code of a "fix tool", that can be
> run on top of a tree of HTML files, patching all broken files (and only
> those). You can run it theoretically on the root folder of your harddisk - I
> did this on the whole lucene.apache.org web site.
> Robert Muir and I were looking for a IVY-compatible solution (the original
> Oracle tool cannot be automatically downloaded by IVY, as Oracle's website
> sets cookies and requests license confirmations). We found the following
> GITHUB project by olamy/karianna:
> https://github.com/AdoptOpenJDK/JavadocUpdaterTool
> As soon as they release the JAR file officially on Maven, we can download it
> with IVY and use it. This is a Maven Plugin, but it still contains the
> original source code of Oracle's tool, so we can execute it as ANT task after
> loading the JAR with IVY's coordinates: {{<java fork="false" class="..."/>}}
> In the GITHUB project description they note that you need JDK7 to use the
> tool, but this is no longer true, the -source/-target is Java 5 now, so we
> can run it easily.
> I will add the required tasks in common-build.xml's javadoc macro so it
> post-processes all javadocs and patches vulnerable files. If you build
> javadocs with a recent JDK, it would do nothing.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@lucene.apache.org
For additional commands, e-mail: dev-h...@lucene.apache.org
