Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-17918

[GSS](7.2.z) unsecured path warn for secured @WebService bean

    XMLWordPrintable

Details

    • Bug
    • Resolution: Not a Bug
    • Major
    • None
    • None
    • Web Services
    • None
    • +
    • Hide

      Deploy attached test app

      Show
      Deploy attached test app

    Description

      A secured @WebService bean hits the following warns:

      WARN  [io.undertow.servlet] (ServerService Thread Pool -- 86) UT015020: Path /TestBean is secured for some HTTP methods, however it is not secured for [TRACE, HEAD, DELETE, GET, CONNECT, OPTIONS, PUT]

      org.jboss.as.webservices.util.WebMetaDataHelper.newWebResourceCollection sets the applicable methods to only POST or GET/POST:

      2019-11-01 17:31:49,464 INFO  [stdout] (MSC service thread 1-2) GSS WebResourceCollectionMetaData.setHttpMethods: org.jboss.metadata.web.spec.WebResourceCollectionMetaData@bf779782{TestBean} [POST]
2019-11-01 17:31:49,464 INFO  [stdout] (MSC service thread 1-2) org.jboss.metadata.web.spec.WebResourceCollectionMetaData.setHttpMethods(WebResourceCollectionMetaData.java:105)
2019-11-01 17:31:49,464 INFO  [stdout] (MSC service thread 1-2) org.jboss.as.webservices.util.WebMetaDataHelper.newWebResourceCollection(WebMetaDataHelper.java:277)
2019-11-01 17:31:49,464 INFO  [stdout] (MSC service thread 1-2) org.jboss.as.webservices.tomcat.WebMetaDataCreator.createSecurityConstraints(WebMetaDataCreator.java:240)

      Should that method limitation be removed to avoid such unsecured method warns?

      Attachments

        Issue Links

          clones

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-18299 [GSS](7.3.z) unsecured path warn for secured @WebService bean

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed
          is cloned by

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-18299 [GSS](7.3.z) unsecured path warn for secured @WebService bean

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed
          is related to

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-5865 No warning logged for uncovered HTTP methods by security constraints

          • Minor - To be worked after urgent, high, and medium priorities are resolved. This term is chosen when the severity of the issue is low, or the complexity or effort to correct it may be higher, relatively speaking. For low priority issues, known workarounds exist or are not needed due to the trivial effort needed to address the issue.
          • Verified

          Activity

            People

              rhn-support-iweiss Ingo Weiss
              rhn-support-aogburn Aaron Ogburn
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: