[
https://issues.apache.org/jira/browse/CXF-9263?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Colm O hEigeartaigh updated CXF-9263:
-------------------------------------
Description:
||Candidate||Module / Location||Systest usage||Rationale||
|{{org.apache.cxf.rs.security.oauth2.tokens.hawk}} package (11
classes)|cxf-rt-rs-security-oauth2|None|Hawk was an abandoned draft and never
became a standard.|
|{Unknown macro:
Unknown macro: \{DirectAuthorizationService}
}|cxf-rt-rs-security-oauth2 (services)|None|Non-standard "direct_token" grant
that issues tokens directly from an authenticated request. Nothing else
references it.|
|{{OOBResponseDeliverer}} and OOB redirect support in \{ Unknown macro:
{AuthorizationCodeGrantService}
}|cxf-rt-rs-security-oauth2 (provider, services)|None|Out-of-band redirect has
been deprecated across the industry.|
|{{{}ModelEncryptionSupport{}}}, {{{}DefaultEncryptingOAuthDataProvider{}}}, \{
Unknown macro: {DefaultEncryptingCodeDataProvider}
}|cxf-rt-rs-security-oauth2 (utils.crypto, provider,
grants.code)|None|Home-grown way to store tokens as encrypted strings, with a
custom tokenizer (about 600 LOC). Several recent fixes (PRs 3345, 3347, 3408).
JPA and JCache providers already cover this.|
|{{{}JoseSessionTokenProvider{}}}, \{ Unknown macro:
{JoseClientCodeStateManager}
}|cxf-rt-rs-security-oauth2 (provider, client)|4 systests|Prototype-style ways
to keep session and state data in JOSE. The in-memory and session-based options
already exist.|
|{{{}ResourceOwnerGrant{}}}, {{{}ResourceOwnerGrantHandler{}}},
{{{}ResourceOwnerLoginHandler{}}}, \{ Unknown macro:
{JAASResourceOwnerLoginHandler}
}|cxf-rt-rs-security-oauth2 (grants.owner)|About 20 systests|The password grant
is removed in OAuth 2.1 and the OAuth Security BCP.|
|{{{}ImplicitGrantService{}}}, {{{}AbstractImplicitGrantService{}}},
{{OidcImplicitService}} |cxf-rt-rs-security-oauth2 (services),
cxf-rt-rs-security-sso-oidc (idp)|About 14 systests (oauth2), 9 (oidc)|The
implicit flow is removed in OAuth 2.1 and the Security BCP.|
|{{org.apache.cxf.jaxrs.provider.jsonp}} package ({{{}JsonpInInterceptor{}}},
{{{}JsonpPreStreamInterceptor{}}}, {{{}JsonpPostStreamInterceptor{}}},
{{{}JsonpJaxrsWriterInterceptor{}}},
{{{}AbstractJsonpOutInterceptor{}}})|cxf-rt-rs-extension-providers|1
systest|Made obsolete by CORS. It is reflected-script injection by design (PR
3628).|
|{Unknown macro:
Unknown macro: \{ODataParser}
}|cxf-rt-rs-extension-search (odata)|1 systest|Depends on Apache Olingo OData2,
which is effectively dead.|
|{{{}TikaContentExtractor{}}}, {{{}TikaLuceneContentExtractor{}}},
{{{}LuceneDocumentMetadata{}}}, \{ Unknown macro: {LuceneQueryVisitor}
}|cxf-rt-rs-extension-search (tika, lucene)|1 systest, 1 sample|Prototype
integrations that pull in heavy dependencies (Tika parsers, Lucene) for little
use.|
|{Unknown macro:
Unknown macro: \{DOM4JProvider}
}|cxf-rt-rs-extension-providers (dom4j)|None|Niche, with no tests or samples
using it.|
|{{{}AegisElementProvider{}}}, \{ Unknown macro: {AbstractAegisProvider}
}|cxf-rt-rs-extension-providers (aegis)|3 systests|Niche. Aegis already had
CVE-2024-28752.|
|{Unknown macro:
Unknown macro: \{XPathProvider}
}|cxf-rt-frontend-jaxrs (provider)|None|The XPath path keeps needing XML
resolver and XXE hardening.|
|{Unknown macro:
Unknown macro: \{XSLTJaxbProvider}
}|cxf-rt-frontend-jaxrs (provider)|3 systests|The XSLT path keeps needing
stylesheet resolver hardening (PR 3512).|
|{{{}XMLSource{}}}, {{XSLTTransform}} (optional)|cxf-rt-frontend-jaxrs
(ext.xml)|About 7 systests|Same XML and XSLT risk area, but used more widely.|
|SimpleTypeJsonProvider|cxf-rt-rs-extension-providers|N/A|Not used anywhere|
was:
||Candidate||Module / Location||Systest usage||Rationale||
|{{org.apache.cxf.rs.security.oauth2.tokens.hawk}} package (11
classes)|cxf-rt-rs-security-oauth2|None|Hawk was an abandoned draft and never
became a standard.|
|{Unknown macro: \\{DirectAuthorizationService}}|cxf-rt-rs-security-oauth2
(services)|None|Non-standard "direct_token" grant that issues tokens directly
from an authenticated request. Nothing else references it.|
|{{OOBResponseDeliverer}} and OOB redirect support in \{ Unknown macro:
\{AuthorizationCodeGrantService}
}|cxf-rt-rs-security-oauth2 (provider, services)|None|Out-of-band redirect has
been deprecated across the industry.|
|{{{}ModelEncryptionSupport{}}}, {{{}DefaultEncryptingOAuthDataProvider{}}}, \{
Unknown macro: \{DefaultEncryptingCodeDataProvider}
}|cxf-rt-rs-security-oauth2 (utils.crypto, provider,
grants.code)|None|Home-grown way to store tokens as encrypted strings, with a
custom tokenizer (about 600 LOC). Several recent fixes (PRs 3345, 3347, 3408).
JPA and JCache providers already cover this.|
|{{{}JoseSessionTokenProvider{}}}, \{ Unknown macro:
\{JoseClientCodeStateManager}
}|cxf-rt-rs-security-oauth2 (provider, client)|4 systests|Prototype-style ways
to keep session and state data in JOSE. The in-memory and session-based options
already exist.|
|{{{}ResourceOwnerGrant{}}}, {{{}ResourceOwnerGrantHandler{}}},
{{{}ResourceOwnerLoginHandler{}}}, \{ Unknown macro:
\{JAASResourceOwnerLoginHandler}
}|cxf-rt-rs-security-oauth2 (grants.owner)|About 20 systests|The password grant
is removed in OAuth 2.1 and the OAuth Security BCP.|
|{{{}ImplicitGrantService{}}}, {{{}AbstractImplicitGrantService{}}},
{{OidcImplicitService}} |cxf-rt-rs-security-oauth2 (services),
cxf-rt-rs-security-sso-oidc (idp)|About 14 systests (oauth2), 9 (oidc)|The
implicit flow is removed in OAuth 2.1 and the Security BCP.|
|{{org.apache.cxf.jaxrs.provider.jsonp}} package ({{{}JsonpInInterceptor{}}},
{{{}JsonpPreStreamInterceptor{}}}, {{{}JsonpPostStreamInterceptor{}}},
{{{}JsonpJaxrsWriterInterceptor{}}},
{{{}AbstractJsonpOutInterceptor{}}})|cxf-rt-rs-extension-providers|1
systest|Made obsolete by CORS. It is reflected-script injection by design (PR
3628).|
|{Unknown macro: \\{ODataParser}}|cxf-rt-rs-extension-search (odata)|1
systest|Depends on Apache Olingo OData2, which is effectively dead.|
|{{{}TikaContentExtractor{}}}, {{{}TikaLuceneContentExtractor{}}},
{{{}LuceneDocumentMetadata{}}}, \{ Unknown macro: \{LuceneQueryVisitor}
}|cxf-rt-rs-extension-search (tika, lucene)|1 systest, 1 sample|Prototype
integrations that pull in heavy dependencies (Tika parsers, Lucene) for little
use.|
|{Unknown macro: \\{DOM4JProvider}}|cxf-rt-rs-extension-providers
(dom4j)|None|Niche, with no tests or samples using it.|
|{{{}AegisElementProvider{}}}, \{ Unknown macro: \{AbstractAegisProvider}
}|cxf-rt-rs-extension-providers (aegis)|3 systests|Niche. Aegis already had
CVE-2024-28752.|
|{Unknown macro: \\{XPathProvider}}|cxf-rt-frontend-jaxrs (provider)|None|The
XPath path keeps needing XML resolver and XXE hardening.|
|{Unknown macro: \\{XSLTJaxbProvider}}|cxf-rt-frontend-jaxrs (provider)|3
systests|The XSLT path keeps needing stylesheet resolver hardening (PR 3512).|
|{{{}XMLSource{}}}, {{XSLTTransform}} (optional)|cxf-rt-frontend-jaxrs
(ext.xml)|About 7 systests|Same XML and XSLT risk area, but used more widely.|
> Review and remove JAX-RS functionality that is out of date or little used
> -------------------------------------------------------------------------
>
> Key: CXF-9263
> URL: https://issues.apache.org/jira/browse/CXF-9263
> Project: CXF
> Issue Type: Improvement
> Reporter: Colm O hEigeartaigh
> Assignee: Colm O hEigeartaigh
> Priority: Major
> Fix For: 4.3.0
>
>
> ||Candidate||Module / Location||Systest usage||Rationale||
> |{{org.apache.cxf.rs.security.oauth2.tokens.hawk}} package (11
> classes)|cxf-rt-rs-security-oauth2|None|Hawk was an abandoned draft and never
> became a standard.|
> |{Unknown macro:
> Unknown macro: \{DirectAuthorizationService}
> }|cxf-rt-rs-security-oauth2 (services)|None|Non-standard "direct_token" grant
> that issues tokens directly from an authenticated request. Nothing else
> references it.|
> |{{OOBResponseDeliverer}} and OOB redirect support in \{ Unknown macro:
> {AuthorizationCodeGrantService}
> }|cxf-rt-rs-security-oauth2 (provider, services)|None|Out-of-band redirect
> has been deprecated across the industry.|
> |{{{}ModelEncryptionSupport{}}}, {{{}DefaultEncryptingOAuthDataProvider{}}},
> \{ Unknown macro: {DefaultEncryptingCodeDataProvider}
> }|cxf-rt-rs-security-oauth2 (utils.crypto, provider,
> grants.code)|None|Home-grown way to store tokens as encrypted strings, with a
> custom tokenizer (about 600 LOC). Several recent fixes (PRs 3345, 3347,
> 3408). JPA and JCache providers already cover this.|
> |{{{}JoseSessionTokenProvider{}}}, \{ Unknown macro:
> {JoseClientCodeStateManager}
> }|cxf-rt-rs-security-oauth2 (provider, client)|4 systests|Prototype-style
> ways to keep session and state data in JOSE. The in-memory and session-based
> options already exist.|
> |{{{}ResourceOwnerGrant{}}}, {{{}ResourceOwnerGrantHandler{}}},
> {{{}ResourceOwnerLoginHandler{}}}, \{ Unknown macro:
> {JAASResourceOwnerLoginHandler}
> }|cxf-rt-rs-security-oauth2 (grants.owner)|About 20 systests|The password
> grant is removed in OAuth 2.1 and the OAuth Security BCP.|
> |{{{}ImplicitGrantService{}}}, {{{}AbstractImplicitGrantService{}}},
> {{OidcImplicitService}} |cxf-rt-rs-security-oauth2 (services),
> cxf-rt-rs-security-sso-oidc (idp)|About 14 systests (oauth2), 9 (oidc)|The
> implicit flow is removed in OAuth 2.1 and the Security BCP.|
> |{{org.apache.cxf.jaxrs.provider.jsonp}} package ({{{}JsonpInInterceptor{}}},
> {{{}JsonpPreStreamInterceptor{}}}, {{{}JsonpPostStreamInterceptor{}}},
> {{{}JsonpJaxrsWriterInterceptor{}}},
> {{{}AbstractJsonpOutInterceptor{}}})|cxf-rt-rs-extension-providers|1
> systest|Made obsolete by CORS. It is reflected-script injection by design (PR
> 3628).|
> |{Unknown macro:
> Unknown macro: \{ODataParser}
> }|cxf-rt-rs-extension-search (odata)|1 systest|Depends on Apache Olingo
> OData2, which is effectively dead.|
> |{{{}TikaContentExtractor{}}}, {{{}TikaLuceneContentExtractor{}}},
> {{{}LuceneDocumentMetadata{}}}, \{ Unknown macro: {LuceneQueryVisitor}
> }|cxf-rt-rs-extension-search (tika, lucene)|1 systest, 1 sample|Prototype
> integrations that pull in heavy dependencies (Tika parsers, Lucene) for
> little use.|
> |{Unknown macro:
> Unknown macro: \{DOM4JProvider}
> }|cxf-rt-rs-extension-providers (dom4j)|None|Niche, with no tests or samples
> using it.|
> |{{{}AegisElementProvider{}}}, \{ Unknown macro: {AbstractAegisProvider}
> }|cxf-rt-rs-extension-providers (aegis)|3 systests|Niche. Aegis already had
> CVE-2024-28752.|
> |{Unknown macro:
> Unknown macro: \{XPathProvider}
> }|cxf-rt-frontend-jaxrs (provider)|None|The XPath path keeps needing XML
> resolver and XXE hardening.|
> |{Unknown macro:
> Unknown macro: \{XSLTJaxbProvider}
> }|cxf-rt-frontend-jaxrs (provider)|3 systests|The XSLT path keeps needing
> stylesheet resolver hardening (PR 3512).|
> |{{{}XMLSource{}}}, {{XSLTTransform}} (optional)|cxf-rt-frontend-jaxrs
> (ext.xml)|About 7 systests|Same XML and XSLT risk area, but used more widely.|
> |SimpleTypeJsonProvider|cxf-rt-rs-extension-providers|N/A|Not used anywhere|
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
