Log4j 1.x Vulnerabilities

[Ashley.Dingman]

Can the following questions be confirmed for NetBeans?


  1.  Which versions of your products utilize Log4j 1.x, if any?


  1.  Do they utilize the JMSAppender or SocketServer classes?


  1.  Do you have any mitigation options available for addressing both 
CVE-2019-17571 and CVE-2021-4104?
https://nvd.nist.gov/vuln/detail/CVE-2019-17571
https://nvd.nist.gov/vuln/detail/CVE-2021-4104


 *   Would it impact the product if we deleted both the 
net/JMSAppender.class and net/SocketServer.class from the Log4j 1.x JAR itself?


  1.  Can you provide a roadmap of when you plan to move Log4j version 2.15 or 
higher?

Thanks,
Ashley Dingman

Re: Netbeans 12.6 C/;C++

[antonio]

Hi,

There's File/New Project/Lightweight C/C++ Project

Kind regards,
Antonio

El 3/1/22 a las 18:43, dms489 escribió:
I have Netbeans 12.6 running to develop Java programs. I also need to 
develop C/C++. In the good old days of Netbeans 8-ish, there was a clear 
set of directions for adding C/C++. I can't find such info for the newer 
Netbeans IDE's.


Help, please.

DMS

--
David Smith
david.sm...@dms489.com 


-
To unsubscribe, e-mail: users-unsubscr...@netbeans.apache.org
For additional commands, e-mail: users-h...@netbeans.apache.org

For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists

Netbeans 12.6 C/;C++

[dms489]

I have Netbeans 12.6 running to develop Java programs. I also need to
develop C/C++. In the good old days of Netbeans 8-ish, there was a clear
set of directions for adding C/C++. I can't find such info for the newer
Netbeans IDE's.  

Help, please. 

DMS

-- 
David Smith
david.sm...@dms489.com

RE: Hide Netbeans internal modules in "update center"

[Joseph Huber]

Alex,

I am still using Netbeans 8, but I patched the Netbeans platform to allow the 
RCP application to intercept and modify the installed module list before it is 
displayed.  For my application, different versions go to different customers 
with certain modules disabled, and this patch allows the different customers to 
only see the modules we want them to see in the update center.  This may be 
what you are looking for.

I have included a couple of pictures demonstrating the patch, a text file 
describing the patch that I made to the platform (taken from a post I made to 
the old NetBeans forums a number of years ago), and a text file describing how 
to patch the platform (taken from the old NetBeans Developers FAQ).

There may be better ways to do this in the newer versions of Netbeans.  And I 
don’t know if this approach can still be used with newer NetBeans versions.

Thank You!

Joe Huber
Standard Refrigeration LLC

=
From: Alexander Faust 
Sent: Monday, January 3, 2022 9:00 AM
To: users@netbeans.apache.org
Subject: Hide Netbeans internal modules in "update center"

Hello,

it is possible to hide some internal Netbeans modules in the "update center" of 
the own RCP application. I want to show only modules of my own cluster / RCP. 
The most modules are hided by default, but some modules e.g. "JavaScript 2 
Editor" defines the attribute "AutoUpdate-Show-In-Client: true" in the module 
MANIFEST.MF. This leads to it being displayed. Is it possible to overwrite the 
attribute of the MANIFEST.MF file in the corresponding module, e.g. by using 
-J-D switches / parameter with specifying the code name base of the module? Or 
is there another mechanism to solve my problem?

Thanks in advance

Best regards
Alex
In case anyone is interested, I finally got back to this issue after being
shuffled around between projects and came up with a solution.  

This involves patching the Auto Update UI platform module.  I'm working with NB
platform 8.0.2.

In org.netbeans.modules.autoupdate.ui.api, which is a public package, I added a
new class UpdateUnitListModifier, which very simply is

Code:
[...]
package org.netbeans.modules.autoupdate.ui.api;

import java.util.List;
import org.netbeans.api.autoupdate.UpdateUnit;

/** UpdateUnitListModifier modifies a list of {@link 
org.netbeans.api.autoupdate.UpdateUnit} items. 
 * After {@link org.netbeans.modules.autoupdate.ui.PluginManagerUI} creates the 
list, 
 * it looks for providers of this service registered in the global lookup, and 
calls them to modify the list.
 *
 * @author jhuber
 */
public interface UpdateUnitListModifier {
public List modifyList(List uList);
}

Then, in org.netbeans.modules.autoupdate.ui, I modified PuginManagerUI.java by
adding code noted below to initialize() after line 251:

Code:
[...]
private void initialize () {
try {
final List uu = 
UpdateManager.getDefault().getUpdateUnits(Utilities.getUnitTypes());
//List precompute1 = Utilities.makeUpdateCategories 
(uu, false);
if (localTable != null) {
final List nbms = 
new 
ArrayList(((LocallyDownloadedTableModel)localTable.getModel()).getLocalDownloadSupport().getUpdateUnits());
List precompute2 = 
Utilities.makeUpdateCategories(nbms, true);
}

//new code
Collection col1 = 
Lookup.getDefault().lookupAll(UpdateUnitListModifier.class);
if (!col1.isEmpty()) {
for (Object k1 : col1) {
((UpdateUnitListModifier)k1).modifyList(uu);
}
}
//end new code

// postpone later
refreshUnitsInBackground(uu);
[...]

Finally in my application, I have an UpdateUnitListModifier service provider to
manipulate the UpdateUnit list.

Code:
[...]
@ServiceProvider(service=UpdateUnitListModifier.class)
public class UpdateModifier implements UpdateUnitListModifier {

@Override
public List modifyList(List uList) {  
  Iterator it1 = uList.iterator();
  while (it1.hasNext()) {
UpdateUnit u1 = it1.next();
String s1 = "com.dont.show.this.in.update.tab";
if ((u1.getInstalled() == null) && 
u1.getCodeName().contentEquals(s1)) {
   System.out.println ("This module should be removed from the 
list: " + u1.getCodeName());
   it1.remove();
}
}
return uList;
}
}

When one selects Tools>Plugins, PluginManagerUI goes about figuring out what is
installed, what needs to be updated, and creates an UpdateUnit list with these
items. Per the above modification, after this list is created and before the
default Plugins window is displayed, PluginManagerUI now looks for service
providers to modify this list.  The service provider(s) can go through the list
and remove items from (or add items to) the list.  

Hide Netbeans internal modules in "update center"

[Alexander Faust]

Hello,

it is possible to hide some internal Netbeans modules in the "update
center" of the own RCP application. I want to show only modules of my own
cluster / RCP. The most modules are hided by default, but some modules e.g.
"JavaScript 2 Editor" defines the attribute "AutoUpdate-Show-In-Client:
true" in the module MANIFEST.MF. This leads to it being displayed. Is it
possible to overwrite the attribute of the MANIFEST.MF file in the
corresponding module, e.g. by using -J-D switches / parameter with
specifying the code name base of the module? Or is there another mechanism
to solve my problem?

Thanks in advance

Best regards
Alex