This is an automated email from the ASF dual-hosted git repository.
shuber pushed a change to branch unomi-1.4.x
in repository https://gitbox.apache.org/repos/asf/unomi.git.
from 4607308 UNOMI-391: provide SameSite=Lax configuration on profile id
cookie (#209)
new 7279419 Improve scripting security (#179)
new 157b0f0 Adjust backport of security fix
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
common/pom.xml | 36 ++++
.../test/java/org/apache/unomi/itests/BaseIT.java | 60 +++++++
.../org/apache/unomi/itests/ContextServletIT.java | 168 ++++++++++++++++++
.../java/org/apache/unomi/itests/TestUtils.java | 58 ++++++-
.../test/resources/security/mvel-payload-1.json | 20 +++
.../test/resources/security/ognl-payload-1.json | 28 +++
kar/pom.xml | 5 +
kar/src/main/feature/feature.xml | 1 +
.../main/resources/etc/custom.system.properties | 7 +-
persistence-elasticsearch/core/pom.xml | 11 +-
.../conditions/ConditionContextHelper.java | 42 ++---
.../ConditionESQueryBuilderDispatcher.java | 10 +-
.../conditions/ConditionEvaluatorDispatcher.java | 8 +-
.../resources/OSGI-INF/blueprint/blueprint.xml | 3 +
plugins/baseplugin/pom.xml | 6 +
.../PastEventConditionESQueryBuilder.java | 8 +-
.../conditions/PastEventConditionEvaluator.java | 9 +-
.../conditions/PropertyConditionEvaluator.java | 116 ++++++++++++-
.../resources/META-INF/cxs/expressions/mvel.json | 13 ++
.../resources/OSGI-INF/blueprint/blueprint.xml | 3 +
.../conditions/PropertyConditionEvaluatorTest.java | 34 +++-
pom.xml | 3 +-
{extensions/web-tracker/wab => scripting}/pom.xml | 55 +++---
.../apache/unomi/scripting/ExpressionFilter.java | 59 +++++++
.../unomi/scripting/ExpressionFilterFactory.java | 19 +--
.../apache/unomi/scripting/MvelScriptExecutor.java | 80 +++++++++
.../org/apache/unomi/scripting/ScriptExecutor.java | 16 +-
.../scripting}/SecureFilteringClassLoader.java | 22 ++-
.../internal/ExpressionFilterFactoryImpl.java | 190 +++++++++++++++++++++
.../resources/META-INF/cxs/expressions/mvel.json | 1 +
.../resources/META-INF/cxs/expressions/ognl.json | 1 +
.../resources/OSGI-INF/blueprint/blueprint.xml | 29 ++--
.../unomi/scripting/MvelScriptExecutorTest.java | 130 ++++++++++++++
services/pom.xml | 12 +-
.../services/actions/ActionExecutorDispatcher.java | 43 +++--
.../resources/OSGI-INF/blueprint/blueprint.xml | 5 +-
.../actions/ActionExecutorDispatcherTest.java | 106 ------------
.../resources/OSGI-INF/blueprint/blueprint.xml | 1 +
.../java/org/apache/unomi/web/ContextServlet.java | 93 +++++++++-
39 files changed, 1258 insertions(+), 253 deletions(-)
create mode 100644
itests/src/test/java/org/apache/unomi/itests/ContextServletIT.java
create mode 100644 itests/src/test/resources/security/mvel-payload-1.json
create mode 100644 itests/src/test/resources/security/ognl-payload-1.json
create mode 100644
plugins/baseplugin/src/main/resources/META-INF/cxs/expressions/mvel.json
copy {extensions/web-tracker/wab => scripting}/pom.xml (68%)
mode change 100755 => 100644
create mode 100644
scripting/src/main/java/org/apache/unomi/scripting/ExpressionFilter.java
copy api/src/main/java/org/apache/unomi/api/TimestampedItem.java =>
scripting/src/main/java/org/apache/unomi/scripting/ExpressionFilterFactory.java
(60%)
create mode 100644
scripting/src/main/java/org/apache/unomi/scripting/MvelScriptExecutor.java
copy
extensions/unomi-mailchimp/services/src/main/java/org/apache/unomi/mailchimp/services/MailChimpResult.java
=> scripting/src/main/java/org/apache/unomi/scripting/ScriptExecutor.java (78%)
rename {common/src/main/java/org/apache/unomi/common =>
scripting/src/main/java/org/apache/unomi/scripting}/SecureFilteringClassLoader.java
(85%)
create mode 100644
scripting/src/main/java/org/apache/unomi/scripting/internal/ExpressionFilterFactoryImpl.java
create mode 100644
scripting/src/main/resources/META-INF/cxs/expressions/mvel.json
create mode 100644
scripting/src/main/resources/META-INF/cxs/expressions/ognl.json
copy {lifecycle-watcher =>
scripting}/src/main/resources/OSGI-INF/blueprint/blueprint.xml (62%)
create mode 100644
scripting/src/test/java/org/apache/unomi/scripting/MvelScriptExecutorTest.java
delete mode 100644
services/src/test/java/org/apache/unomi/services/actions/ActionExecutorDispatcherTest.java
