honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
OpenSearch/plugins/mapper-attachments/licenses
History
Robert Muir 6692e42d9a thirdPartyAudit round 2 
This fixes the `lenient` parameter to be `missingClasses`. I will remove this boolean and we can handle them via the normal whitelist.
It also adds a check for sheisty classes (jar hell with the jdk).
This is inspired by the lucene "sheisty" classes check, but it has false positives. This check is more evil, it validates every class file against the extension classloader as a resource, to see if it exists there. If so: jar hell.

This jar hell is a problem for several reasons:

1. causes insanely-hard-to-debug problems (like bugs in forbidden-apis)
2. hides problems (like internal api access)
3. the code you think is executing, is not really executing
4. security permissions are not what you think they are
5. brings in unnecessary dependencies
6. its jar hell

The more difficult problems are stuff like jython, where these classes are simply 'uberjared' directly in, so you cant just fix them by removing a bogus dependency. And there is a legit reason for them to do that, they want to support java 1.4.
 		2015-12-17 02:35:00 -05:00
..
bcmail-jdk15on-1.52.jar.sha1 migrate mapper attachments 2015-11-08 02:09:36 -05:00
bcmail-jdk15on-LICENSE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
bcmail-jdk15on-NOTICE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
bcpkix-jdk15on-1.52.jar.sha1 migrate mapper attachments 2015-11-08 02:09:36 -05:00
bcpkix-jdk15on-LICENSE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
bcpkix-jdk15on-NOTICE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
bcprov-jdk15on-1.52.jar.sha1 migrate mapper attachments 2015-11-08 02:09:36 -05:00
bcprov-jdk15on-LICENSE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
bcprov-jdk15on-NOTICE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
commons-codec-1.10.jar.sha1 Build: Remove transitive dependencies 2015-11-10 15:01:41 -08:00
commons-codec-LICENSE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
commons-codec-NOTICE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
commons-compress-1.10.jar.sha1 migrate mapper attachments 2015-11-08 02:09:36 -05:00
commons-compress-LICENSE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
commons-compress-NOTICE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
commons-io-2.4.jar.sha1 migrate mapper attachments 2015-11-08 02:09:36 -05:00
commons-io-LICENSE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
commons-io-NOTICE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
commons-logging-1.1.3.jar.sha1 Build: Remove transitive dependencies 2015-11-10 15:01:41 -08:00
commons-logging-LICENSE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
commons-logging-NOTICE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
fontbox-1.8.10.jar.sha1 migrate mapper attachments 2015-11-08 02:09:36 -05:00
fontbox-LICENSE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
fontbox-NOTICE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
jempbox-1.8.10.jar.sha1 migrate mapper attachments 2015-11-08 02:09:36 -05:00
jempbox-LICENSE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
jempbox-NOTICE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
juniversalchardet-1.0.3.jar.sha1 migrate mapper attachments 2015-11-08 02:09:36 -05:00
juniversalchardet-LICENSE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
juniversalchardet-NOTICE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
pdfbox-1.8.10.jar.sha1 migrate mapper attachments 2015-11-08 02:09:36 -05:00
pdfbox-LICENSE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
pdfbox-NOTICE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
poi-3.13.jar.sha1 migrate mapper attachments 2015-11-08 02:09:36 -05:00
poi-LICENSE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
poi-NOTICE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
poi-ooxml-3.13.jar.sha1 migrate mapper attachments 2015-11-08 02:09:36 -05:00
poi-ooxml-LICENSE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
poi-ooxml-NOTICE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
poi-ooxml-schemas-3.13.jar.sha1 migrate mapper attachments 2015-11-08 02:09:36 -05:00
poi-ooxml-schemas-LICENSE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
poi-ooxml-schemas-NOTICE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
poi-scratchpad-3.13.jar.sha1 migrate mapper attachments 2015-11-08 02:09:36 -05:00
poi-scratchpad-LICENSE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
poi-scratchpad-NOTICE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
tagsoup-1.2.1.jar.sha1 migrate mapper attachments 2015-11-08 02:09:36 -05:00
tagsoup-LICENSE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
tagsoup-NOTICE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
tika-core-1.11.jar.sha1 migrate mapper attachments 2015-11-08 02:09:36 -05:00
tika-core-LICENSE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
tika-core-NOTICE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
tika-parsers-1.11.jar.sha1 migrate mapper attachments 2015-11-08 02:09:36 -05:00
tika-parsers-LICENSE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
tika-parsers-NOTICE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
xmlbeans-2.6.0.jar.sha1 migrate mapper attachments 2015-11-08 02:09:36 -05:00
xmlbeans-LICENSE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00
xmlbeans-NOTICE.txt migrate mapper attachments 2015-11-08 02:09:36 -05:00