Uploaded image for project: '[Read Only] - Hippo Repository'
  1. [Read Only] - Hippo Repository
  2. REPO-1607

Replace custom reading Implementation-* from MANIFEST.MF by java.lang.Package methods

    XMLWordPrintable

Details

    • Improvement
    • Status: Closed
    • Normal
    • Resolution: Fixed
    • None
    • 4.2.0
    • None
    • None
    • Platform Sprint 145, Platform Sprint 147

    Description

      There are some that have been reading Implementation-* attributes from the MANIFEST.MF resource manually by manipulating relative URL path using ../../../../, which doesn't seem to be very safe, as explained in HSTTWO-3890.

      I'd like to propose changes in the following:

      • org.hippoecm.repository.impl.RepositoryDecorator#getDescriptor(String) reads Implementation-Version manually.
        This should be replaced by getClass().getPackage().getImplementationVersion() simply.
      • org.hippoecm.repository.StatusServlet uses RepoUtils.getManifestURL(getClass()) to read MANIFEST.MF input stream and reads Implementation-Version and Implementation-Build manually, as a fallback if there's no custom overriding MANIFEST.MF in the classpath.
        This uses RepoUtils#getManifestURL().
        As a conservative approach, we should use StatusServlet.class.getPackage().getImplementationVersion() if the implementation version is not found from MANIFEST.MF in any cases.

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              wko Woonsan Ko (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: