From 5d751ea03353a9885a0d8e7363dfd002ec0d735c Mon Sep 17 00:00:00 2001 From: Marco Rizzi Date: Fri, 13 Oct 2017 11:13:09 +0200 Subject: [PATCH] WINDUPRULE-314, WINDUPRULE--315,WINDUPRULE-316 Resteasy new rules (#282) (#284) * WINDUPRULE-314: adding rule for Resteasy Yaml provider * WINDUPRULE-316: adding rule for Resteasy Serializable Provider * WINDUPRULE-315: added new rule for default charset in text response * WINDUPRULE-307: fixes after review (cherry picked from commit b15ba2c3dcda819d180d0e5bd52cd9534e7f5a43) --- rules-reviewed/eap7/eap6/resteasy.windup.xml | 95 +++++++++++++++++++ .../data/data-resteasy/YamlResource.java | 45 +++++++++ .../eap7/eap6/tests/resteasy.windup.test.xml | 34 +++++++ 3 files changed, 174 insertions(+) create mode 100644 rules-reviewed/eap7/eap6/tests/data/data-resteasy/YamlResource.java diff --git a/rules-reviewed/eap7/eap6/resteasy.windup.xml b/rules-reviewed/eap7/eap6/resteasy.windup.xml index 8d1aec76f..a66438950 100644 --- a/rules-reviewed/eap7/eap6/resteasy.windup.xml +++ b/rules-reviewed/eap7/eap6/resteasy.windup.xml @@ -737,6 +737,101 @@ + + + + ANNOTATION + + + + + + + + + + + + + The resteasy-yaml-provider module is not recommended to use due security issue in SnakeYAML library used by RESTEasy for unmarshaling. + If you would like to use YAML Resteasy Provider even it is not recommended, + you need to add the SnakeYAML library (Maven dependency) into your application and enable it by creating file `META-INF/services/javax.ws.rs.ext.Providers` with line `org.jboss.resteasy.plugins.providers.YamlProvider` in that file and your application. + + + + + resteasy + yaml + + + + + + + + + + ANNOTATION + + + + ANNOTATION + + + + + + + + + + + + + + Deserializing Java objects from untrusted sources is not safe. For this reason, + the `org.jboss.resteasy.plugins.providers.SerializableProvider` class is disabled by default, and it is not recommended to use this provider. + If you need to enable it even against the recommendation, create or update file `META-INF/services/javax.ws.rs.ext.Providers` with adding line with `org.jboss.resteasy.plugins.providers.SerializableProvider` string. + + + + resteasy + + + + + + + + + + ANNOTATION + + + + ANNOTATION + + + + + + + RESTEasy fixes the issue when it doesn't set/add correctly character set meta data specified in JAX-RS specification. Therefore UTF-8 as the character set for text media types is set by default. + This behavior results in adding `charset=UTF-8` string to the returned content-type header when the resource method returns a `text/*` or `application/xml*` media type without an explicit charset. + The behavior is controlled by `resteasy.add.charset` parameter which is set to `true` by default and you can customize the `resteasy.add.charset` parameter to `false` in _web.xml_'s `context-param` element + in case of wanting to keep previous behavior. + + + + resteasy + charset + + + diff --git a/rules-reviewed/eap7/eap6/tests/data/data-resteasy/YamlResource.java b/rules-reviewed/eap7/eap6/tests/data/data-resteasy/YamlResource.java new file mode 100644 index 000000000..906522e6b --- /dev/null +++ b/rules-reviewed/eap7/eap6/tests/data/data-resteasy/YamlResource.java @@ -0,0 +1,45 @@ +import javax.ws.rs.Consumes; +import javax.ws.rs.GET; +import javax.ws.rs.Path; +import javax.ws.rs.Produces; + +@Path("/yaml") +public class YamlResource { + + @GET + @Produces("text/x-yaml") + public MyObject getMyObject() { + return createMyObject(); + } + + @GET + @Produces("text/yaml") + public MyObject getMyObject1() { + return createMyObject(); + } + + @GET + @Produces("application/x-yaml") + public MyObject getMyObject2() { + return createMyObject(); + } + + + @GET + @Produces("application/x-java-serialized-object") + public MyObject getMyObject4() { + return createMyObject(); + } + + @GET + @Produces("text/plain") + public String getResult() { + return ""; + } + + @GET + @Produces("application/xml") + public String getResult() { + return ""; + } +} \ No newline at end of file diff --git a/rules-reviewed/eap7/eap6/tests/resteasy.windup.test.xml b/rules-reviewed/eap7/eap6/tests/resteasy.windup.test.xml index f8375947a..f1cb81cfb 100644 --- a/rules-reviewed/eap7/eap6/tests/resteasy.windup.test.xml +++ b/rules-reviewed/eap7/eap6/tests/resteasy.windup.test.xml @@ -469,6 +469,40 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +