[
https://issues.apache.org/jira/browse/CXF-9263?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Colm O hEigeartaigh updated CXF-9263:
-------------------------------------
Summary: Review and remove JAX-RS functionality that is out of date or
little used (was: Review and remove deprecated JAX-RS code)
> Review and remove JAX-RS functionality that is out of date or little used
> -------------------------------------------------------------------------
>
> Key: CXF-9263
> URL: https://issues.apache.org/jira/browse/CXF-9263
> Project: CXF
> Issue Type: Improvement
> Reporter: Colm O hEigeartaigh
> Assignee: Colm O hEigeartaigh
> Priority: Major
> Fix For: 4.3.0
>
>
> ||Candidate||Module / Location||Systest usage||Rationale||
> |{{org.apache.cxf.rs.security.oauth2.tokens.hawk}} package (11
> classes)|cxf-rt-rs-security-oauth2|None|Hawk was an abandoned draft and never
> became a standard.|
> |{Unknown macro: \{DirectAuthorizationService}
> }|cxf-rt-rs-security-oauth2 (services)|None|Non-standard "direct_token" grant
> that issues tokens directly from an authenticated request. Nothing else
> references it.|
> |{{OOBResponseDeliverer}} and OOB redirect support in {
> Unknown macro: \{AuthorizationCodeGrantService}
> }|cxf-rt-rs-security-oauth2 (provider, services)|None|Out-of-band redirect
> has been deprecated across the industry.|
> |{{{}ModelEncryptionSupport{}}}, {{{}DefaultEncryptingOAuthDataProvider{}}}, {
> Unknown macro: \{DefaultEncryptingCodeDataProvider}
> }|cxf-rt-rs-security-oauth2 (utils.crypto, provider,
> grants.code)|None|Home-grown way to store tokens as encrypted strings, with a
> custom tokenizer (about 600 LOC). Several recent fixes (PRs 3345, 3347,
> 3408). JPA and JCache providers already cover this.|
> |{{{}JoseSessionTokenProvider{}}}, {
> Unknown macro: \{JoseClientCodeStateManager}
> }|cxf-rt-rs-security-oauth2 (provider, client)|4 systests|Prototype-style
> ways to keep session and state data in JOSE. The in-memory and session-based
> options already exist.|
> |{{{}ResourceOwnerGrant{}}}, {{{}ResourceOwnerGrantHandler{}}},
> {{{}ResourceOwnerLoginHandler{}}}, {
> Unknown macro: \{JAASResourceOwnerLoginHandler}
> }|cxf-rt-rs-security-oauth2 (grants.owner)|About 20 systests|The password
> grant is removed in OAuth 2.1 and the OAuth Security BCP.|
> |{{{}ImplicitGrantService{}}}, {{{}AbstractImplicitGrantService{}}},
> {{OidcImplicitService}} |cxf-rt-rs-security-oauth2 (services),
> cxf-rt-rs-security-sso-oidc (idp)|About 14 systests (oauth2), 9 (oidc)|The
> implicit flow is removed in OAuth 2.1 and the Security BCP.|
> |{{org.apache.cxf.jaxrs.provider.jsonp}} package ({{{}JsonpInInterceptor{}}},
> {{{}JsonpPreStreamInterceptor{}}}, {{{}JsonpPostStreamInterceptor{}}},
> {{{}JsonpJaxrsWriterInterceptor{}}},
> {{{}AbstractJsonpOutInterceptor{}}})|cxf-rt-rs-extension-providers|1
> systest|Made obsolete by CORS. It is reflected-script injection by design (PR
> 3628).|
> |{Unknown macro: \{ODataParser}
> }|cxf-rt-rs-extension-search (odata)|1 systest|Depends on Apache Olingo
> OData2, which is effectively dead.|
> |{{{}TikaContentExtractor{}}}, {{{}TikaLuceneContentExtractor{}}},
> {{{}LuceneDocumentMetadata{}}}, {
> Unknown macro: \{LuceneQueryVisitor}
> }|cxf-rt-rs-extension-search (tika, lucene)|1 systest, 1 sample|Prototype
> integrations that pull in heavy dependencies (Tika parsers, Lucene) for
> little use.|
> |{Unknown macro: \{DOM4JProvider}
> }|cxf-rt-rs-extension-providers (dom4j)|None|Niche, with no tests or samples
> using it.|
> |{{{}AegisElementProvider{}}}, {
> Unknown macro: \{AbstractAegisProvider}
> }|cxf-rt-rs-extension-providers (aegis)|3 systests|Niche. Aegis already had
> CVE-2024-28752.|
> |{Unknown macro: \{XPathProvider}
> }|cxf-rt-frontend-jaxrs (provider)|None|The XPath path keeps needing XML
> resolver and XXE hardening.|
> |{Unknown macro: \{XSLTJaxbProvider}
> }|cxf-rt-frontend-jaxrs (provider)|3 systests|The XSLT path keeps needing
> stylesheet resolver hardening (PR 3512).|
> |{{{}XMLSource{}}}, {{XSLTTransform}} (optional)|cxf-rt-frontend-jaxrs
> (ext.xml)|About 7 systests|Same XML and XSLT risk area, but used more widely.|
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
