listing nodes in the root

2008-08-08 Thread Ruben Reusser

hi.

is there a way to do a http request to the launch pad to list all nodes 
in the root or in any other path?


Thanks

Ruben


securing a sling based application

2009-03-27 Thread Ruben Reusser

hi there,

I am wondering how to best secure a sling based application so once my 
app is deployed and I allow access from the internet I do not run into 
security issues or unexpected outside exposure.Is there a best practice 
what one should look out for or a set of apache rewrite rules one should 
use?


Thanks

Ruben


Re: Use the next Sling Release to enhance to community

2009-04-02 Thread Ruben Reusser

Hi there,

I heard a rumor that day is planning a sling training in the near 
future? Is that so and if yes, could that lead to a better documentation 
for sling?


Ruben

Dominik Süß wrote:

Hi Mike,

you're not the only one who did address this issue. This pops up in the
mailing list from time-to-time and on conventions like ApacheCon last week.
The main problem about that seams that the commiters are involved in a lot
of projects (as well the apache projects as the day products). Since Sling
does not have that many other commiters there is just a lack of time for
documentation. And since there is almost nothing in the existing
documentation which isn't at least in details outdated no one except the
core team feels capable enough to write a basic documentation.

I really hope someone will do the move and try to write a basic
documentation.

The getting started guide would propably be something even someone of us
"users" could write and contribute. I would like to do this but I'm always
out of time and the rare time I have left is reserved by my girlfriend.
(planning to write something since the first official release).

I even did plan some kind of multipart tutorial which allows to start with a
simple app which grows from step to step and uses all those funky features
we have (like versioning and observations). If there is anyone out there who
wants to support me in doing this little project please mail me directly
(since I wouldn't like to spam the mailing list without having at least a
skeleton of this).

Any other ideas out there how to get better documentation?

Best regards,
Dominik

On Thu, Apr 2, 2009 at 4:11 PM, Mike Müller  wrote:

  

Hi all,

First of all, I would like to thank all of you for the big efforts to
enhance and refine sling step by step. I'm watching the project since a few
months for now and tested sling in a few simple projects - and it really is
very easy to use it right from scratch.

But to be honest, it's rather hard to really get into the code of sling if
you try to build a complex app, not only based on scripting. The big problem
by now for a non-sling-insider is the documentation. The website mostly is
outdated. Dont' get me wrong, I know sling is open source and all free, so
nobody has to bother about missing things. And yes, if you try hard enough,
you also get into the details of sling. But that's the problem of the
project: I think sling is such a good project it should get out of the
incubator. The project is mature, it is tested in real projects (as Day's
CQ5) and it evolves further. It seems that the only thing which holds sling
off to get out the incubator is the list of active committers outside Day.
My company would like to move our products on a sling based core and we also
are interested to develop sling and help to enhance it. To make it easier
for others to use and also contribute to sling, I think the following things
would be as important as the source code itself:

1) an up-to-date website with documentation about the core part of sling
(like architecture, request processing, which services/interfaces are
exposed by the core of sling and which are additional services/interfaces?,
how and where can you enhance sling -> servlets, scripting, components)

2) a short getting started guide for developers e.g. how do I develop for
sling with eclipse without getting long roundtrips (or other IDEs, what's
about the eclipse plugin for jcr/sling?)

3) a short how-to guide for a real productive installation (like apache as
front server with mod_proxy or similar)

4) a separation of the core code and the additional bundles (as it is
already planed for the new release) -> maybe almost done?

It's great to hear that there will be soon a new release of sling. IMHO the
new release should be really used to get more people using sling and also to
get more people be involved in sling development. Maybe in favour of a
consistent documentation the release should be delayed.

WDYT?

regards
Mike




  


Re: (In)Security in Sling

2009-06-02 Thread Ruben Reusser
I have been wondering about this as well. The reverse proxy seems not to 
be the right place to add the security since once bypassed one would 
have full access to the site and the code of the site.


a sling based lockdown may be a problem too, since one site may need 
json (say the content management on top of sling) but another may not 
(such as a public web site).


The content reported by some formats should also be different based on 
what server accesses it and be better filtered - so for example there is 
no need to output some nodes in a .json file when used by the web site 
but there is for a content management system. Otherwise too many attack 
vectors are exposed for potential attacks.


Ruben

Christian Sprecher wrote:

Hi all

This is something that has been nagging me for a while now:
imho the whole JSR 283 security stuff looks good from the JCR context, 
but Sling is a different beast:
it is a web framework, and therefore susceptible to the whole web 
attack vectors, like information disclosure (e.g. unwanted JSON 
output), injection attacks (unsure about possible attack vectors), 
malicious file execution and others, see 
http://www.owasp.org/index.php/Top_10_2007 for some examples.


Therefore relying on JSR 283 is necessary but not sufficient to 
provide state of the art security for Sling. There are several 
possibilities to provide this additional layer of security, one is to 
provide a secure reverse proxy with filter possibilities, like John 
mentioned. This is state of the art for enterprises, but not 
necessarly the best approach for more lightweight environments.


Another approach would be to have a servlet filter handling all web 
attack mitigation strategies and in the same time beeing able to 
communicate with the underlying repository. Perhaps this would also 
allow to create something like an "execute" privilege, which doesn't 
make sense in JCR context but does make very much sense for Sling. The 
spec doc btw, mentions the possibility to define additional 
javax.jcr.security.Privilege namespaces, so it looks (without knowing 
details) to be well prepared for enhancements.


I am unsure if and how OSGI might be another mechanism to implement 
web security.


wdyt?

Cheers, CSp.