Uploaded image for project: '[Read Only] - Hippo Repository'
  1. [Read Only] - Hippo Repository
  2. REPO-1607

Replace custom reading Implementation-* from MANIFEST.MF by java.lang.Package methods

    XMLWordPrintable

    Details

    • Type: Improvement
    • Status: Closed
    • Priority: Normal
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 4.2.0
    • Component/s: None
    • Labels:
      None
    • Similar issues:
    • Processed by team:
      Pulsar
    • Sprint:
      Platform Sprint 145, Platform Sprint 147

      Description

      There are some that have been reading Implementation-* attributes from the MANIFEST.MF resource manually by manipulating relative URL path using ../../../../, which doesn't seem to be very safe, as explained in HSTTWO-3890.

      I'd like to propose changes in the following:

      • org.hippoecm.repository.impl.RepositoryDecorator#getDescriptor(String) reads Implementation-Version manually.
        This should be replaced by getClass().getPackage().getImplementationVersion() simply.
      • org.hippoecm.repository.StatusServlet uses RepoUtils.getManifestURL(getClass()) to read MANIFEST.MF input stream and reads Implementation-Version and Implementation-Build manually, as a fallback if there's no custom overriding MANIFEST.MF in the classpath.
        This uses RepoUtils#getManifestURL().
        As a conservative approach, we should use StatusServlet.class.getPackage().getImplementationVersion() if the implementation version is not found from MANIFEST.MF in any cases.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                wko Woonsan Ko
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: