Re: (commons-lang) branch master updated: Adding the @Insecure, and @Safe annotations.
On Fri, 17 May 2024 at 00:11, Gary Gregory wrote:
>
> Can we PLEASE not do this unless we know what the plan is for Commons
> overall? I really don't want to have this stuff copied in all Commons
> Components because I doubt we will want to add Commons Lang as a dependency
> in all Components.
Agreed.
Also if we are to use annotations great care must be taken with the
RetentionPolicy.
Using the wrong setting can mean adding unnecessary runtime
dependencies (this was an issue with the JCIP annotations @ThreadSafe
etc)
> So, what's the plan? Do you plan on copying this stuff
> over and over or depending on Commons Lang all over.
>
> Imaging using code assit and seeing these types being offered from all over
> the place...
And finding they are all slightly different...
>
> Gary
>
> On Thu, May 16, 2024, 6:30 PM wrote:
>
> > This is an automated email from the ASF dual-hosted git repository.
> >
> > jochen pushed a commit to branch master
> > in repository https://gitbox.apache.org/repos/asf/commons-lang.git
> >
> >
> > The following commit(s) were added to refs/heads/master by this push:
> > new 3322d9748 Adding the @Insecure, and @Safe annotations.
> > 3322d9748 is described below
> >
> > commit 3322d974876b8d4f934d3544967103ebbcaef726
> > Author: Jochen Wiedmann
> > AuthorDate: Fri May 17 00:28:39 2024 +0200
> >
> > Adding the @Insecure, and @Safe annotations.
> > ---
> > src/changes/changes.xml| 1 +
> > .../apache/commons/lang3/annotations/Insecure.java | 48
> > .../org/apache/commons/lang3/annotations/Safe.java | 61 +++
> > .../commons/lang3/annotations/package-info.java| 37 +++
> > .../commons/lang3/annotations/AnnotationsTest.java | 122
> > +
> > 5 files changed, 269 insertions(+)
> >
> > diff --git a/src/changes/changes.xml b/src/changes/changes.xml
> > index 34841687a..b69e1f8a2 100644
> > --- a/src/changes/changes.xml
> > +++ b/src/changes/changes.xml
> > @@ -140,6 +140,7 @@ The type attribute can be
> > add,update,fix,remove.
> > > due-to="Dependabot">Bump org.apache.commons:commons-text from 1.11.0 to
> > 1.12.0 #1200.
> >
> > > due-to="Paranoïd User">Drop obsolete JDK 13 Maven profile #1142.
> > +Added the
> > annotations package, including the Insecure, and Safe annotations.
> >
> >
> >
> > diff --git
> > a/src/main/java/org/apache/commons/lang3/annotations/Insecure.java
> > b/src/main/java/org/apache/commons/lang3/annotations/Insecure.java
> > new file mode 100644
> > index 0..2802f1189
> > --- /dev/null
> > +++ b/src/main/java/org/apache/commons/lang3/annotations/Insecure.java
> > @@ -0,0 +1,48 @@
> > +/*
> > + * Licensed to the Apache Software Foundation (ASF) under one or more
> > + * contributor license agreements. See the NOTICE file distributed with
> > + * this work for additional information regarding copyright ownership.
> > + * The ASF licenses this file to You under the Apache License, Version 2.0
> > + * (the "License"); you may not use this file except in compliance with
> > + * the License. You may obtain a copy of the License at
> > + *
> > + * http://www.apache.org/licenses/LICENSE-2.0
> > + *
> > + * Unless required by applicable law or agreed to in writing, software
> > + * distributed under the License is distributed on an "AS IS" BASIS,
> > + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
> > implied.
> > + * See the License for the specific language governing permissions and
> > + * limitations under the License.
> > + */
> > +package org.apache.commons.lang3.annotations;
> > +
> > +import java.lang.annotation.Documented;
> > +import java.lang.annotation.ElementType;
> > +import java.lang.annotation.Retention;
> > +import java.lang.annotation.RetentionPolicy;
> > +import java.lang.annotation.Target;
> > +
> > +/**
> > + * This annotation is used to indicate, that a constructor, or method
> > + * is insecure to use, unless the input parameters contain safe
> > ("trusted")
> > + * values.
> > + *
> > + * For example, consider a method like
> > + * {@literal @Insecure}
> > + * public void runCommand(String pCmdLine) {
> > + * }
> > + *
> > + *
> > + * The example method would invoke {@code /bin/sh} (Linux, Unix, or
> > MacOS), or
> > + * {@code cmd} (Windows) to run an external command, as given by the
> > parameter
> > + * {@code pCmdLine}. Obviously, depending on the value of the parameter,
> > + * this can be dangerous, unless the API user (downstream developer)
> > + * knows, that the parameter value is safe (for example, because
> > it
> > + * is hard coded, or because it has been compared to a white list of
> > + * permissible values).
> > + */
> > +@Retention(RetentionPolicy.RUNTIME)
> > +@Target({ElementType.CONSTRUCTOR, ElementType.METHOD})
> > +@Documented
> > +public @interface Insecure {
> > +}
> > diff --git a/src/main/java/org/apache/commons/lang3/annotations/Safe.java
> >
Re: (commons-lang) branch master updated: Adding the @Insecure, and @Safe annotations.
Can we PLEASE not do this unless we know what the plan is for Commons
overall? I really don't want to have this stuff copied in all Commons
Components because I doubt we will want to add Commons Lang as a dependency
in all Components. So, what's the plan? Do you plan on copying this stuff
over and over or depending on Commons Lang all over.
Imaging using code assit and seeing these types being offered from all over
the place...
Gary
Gary
On Thu, May 16, 2024, 6:30 PM wrote:
> This is an automated email from the ASF dual-hosted git repository.
>
> jochen pushed a commit to branch master
> in repository https://gitbox.apache.org/repos/asf/commons-lang.git
>
>
> The following commit(s) were added to refs/heads/master by this push:
> new 3322d9748 Adding the @Insecure, and @Safe annotations.
> 3322d9748 is described below
>
> commit 3322d974876b8d4f934d3544967103ebbcaef726
> Author: Jochen Wiedmann
> AuthorDate: Fri May 17 00:28:39 2024 +0200
>
> Adding the @Insecure, and @Safe annotations.
> ---
> src/changes/changes.xml| 1 +
> .../apache/commons/lang3/annotations/Insecure.java | 48
> .../org/apache/commons/lang3/annotations/Safe.java | 61 +++
> .../commons/lang3/annotations/package-info.java| 37 +++
> .../commons/lang3/annotations/AnnotationsTest.java | 122
> +
> 5 files changed, 269 insertions(+)
>
> diff --git a/src/changes/changes.xml b/src/changes/changes.xml
> index 34841687a..b69e1f8a2 100644
> --- a/src/changes/changes.xml
> +++ b/src/changes/changes.xml
> @@ -140,6 +140,7 @@ The type attribute can be
> add,update,fix,remove.
> due-to="Dependabot">Bump org.apache.commons:commons-text from 1.11.0 to
> 1.12.0 #1200.
>
> due-to="Paranoïd User">Drop obsolete JDK 13 Maven profile #1142.
> +Added the
> annotations package, including the Insecure, and Safe annotations.
>
>
>
> diff --git
> a/src/main/java/org/apache/commons/lang3/annotations/Insecure.java
> b/src/main/java/org/apache/commons/lang3/annotations/Insecure.java
> new file mode 100644
> index 0..2802f1189
> --- /dev/null
> +++ b/src/main/java/org/apache/commons/lang3/annotations/Insecure.java
> @@ -0,0 +1,48 @@
> +/*
> + * Licensed to the Apache Software Foundation (ASF) under one or more
> + * contributor license agreements. See the NOTICE file distributed with
> + * this work for additional information regarding copyright ownership.
> + * The ASF licenses this file to You under the Apache License, Version 2.0
> + * (the "License"); you may not use this file except in compliance with
> + * the License. You may obtain a copy of the License at
> + *
> + * http://www.apache.org/licenses/LICENSE-2.0
> + *
> + * Unless required by applicable law or agreed to in writing, software
> + * distributed under the License is distributed on an "AS IS" BASIS,
> + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
> implied.
> + * See the License for the specific language governing permissions and
> + * limitations under the License.
> + */
> +package org.apache.commons.lang3.annotations;
> +
> +import java.lang.annotation.Documented;
> +import java.lang.annotation.ElementType;
> +import java.lang.annotation.Retention;
> +import java.lang.annotation.RetentionPolicy;
> +import java.lang.annotation.Target;
> +
> +/**
> + * This annotation is used to indicate, that a constructor, or method
> + * is insecure to use, unless the input parameters contain safe
> ("trusted")
> + * values.
> + *
> + * For example, consider a method like
> + * {@literal @Insecure}
> + * public void runCommand(String pCmdLine) {
> + * }
> + *
> + *
> + * The example method would invoke {@code /bin/sh} (Linux, Unix, or
> MacOS), or
> + * {@code cmd} (Windows) to run an external command, as given by the
> parameter
> + * {@code pCmdLine}. Obviously, depending on the value of the parameter,
> + * this can be dangerous, unless the API user (downstream developer)
> + * knows, that the parameter value is safe (for example, because
> it
> + * is hard coded, or because it has been compared to a white list of
> + * permissible values).
> + */
> +@Retention(RetentionPolicy.RUNTIME)
> +@Target({ElementType.CONSTRUCTOR, ElementType.METHOD})
> +@Documented
> +public @interface Insecure {
> +}
> diff --git a/src/main/java/org/apache/commons/lang3/annotations/Safe.java
> b/src/main/java/org/apache/commons/lang3/annotations/Safe.java
> new file mode 100644
> index 0..4b5212c71
> --- /dev/null
> +++ b/src/main/java/org/apache/commons/lang3/annotations/Safe.java
> @@ -0,0 +1,61 @@
> +/*
> + * Licensed to the Apache Software Foundation (ASF) under one or more
> + * contributor license agreements. See the NOTICE file distributed with
> + * this work for additional information regarding copyright ownership.
> + * The ASF licenses this file to You under the Apache License, Version 2.0
> + * (the "License"); you may not use this
