Merge branch 'master' of github.com:Evolveum/midpoint

Evolveum · Jul 18, 2022 · 084d125 · 084d125
2 parents 3ada3df + 6f24782
commit 084d125
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 50 deletions.
diff --git a/...on/src/main/java/com/evolveum/midpoint/common/configuration/api/RuntimeConfiguration.java b/...on/src/main/java/com/evolveum/midpoint/common/configuration/api/RuntimeConfiguration.java
diff --git a/pom.xml b/pom.xml
@@ -595,13 +595,18 @@
             <dependency>
                 <groupId>org.apache.commons</groupId>
                 <artifactId>commons-configuration2</artifactId>
-                <version>2.7</version>
+                <version>2.8.0</version>
                 <exclusions>
                     <!-- replaced by org.slf4j:jcl-over-slf4j -->
                     <exclusion>
                         <groupId>commons-logging</groupId>
                         <artifactId>commons-logging</artifactId>
                     </exclusion>
+                    <!-- just to avoid dep-convergence failure for lib we don't even use -->
+                    <exclusion>
+                        <groupId>javax.servlet</groupId>
+                        <artifactId>servlet-api</artifactId>
+                    </exclusion>
                 </exclusions>
             </dependency>
             <dependency>

diff --git a/repo/system-init/src/main/java/com/evolveum/midpoint/init/StartupConfiguration.java b/repo/system-init/src/main/java/com/evolveum/midpoint/init/StartupConfiguration.java
@@ -260,6 +260,8 @@ private void createXmlConfiguration(String filename) throws ConfigurationExcepti
         lookups.put(RandomLookup.PREFIX, new RandomLookup());
         lookups.put(HostnameLookup.PREFIX, new HostnameLookup());
 
+        // This configures only our prefixes, not the default ones like expr (which are also a security concern).
+        // Note that the Lookup.lookup(var) is called when get*() is called, so it can be evaluated every time.
         FileBasedConfigurationBuilder<XMLConfiguration> builder =
                 new FileBasedConfigurationBuilder<>(XMLConfiguration.class)
                         .configure(