11a61dc8cc
URL Cleanup
...
This commit updates URLs to prefer the https protocol. Redirects are not followed to avoid accidentally expanding intentionally shortened URLs (i.e. if using a URL shortener).
# Fixed URLs
## Fixed Success
These URLs were switched to an https URL with a 2xx status. While the status was successful, your review is still recommended.
* http://www.apache.org/licenses/ with 1 occurrences migrated to:
https://www.apache.org/licenses/ ([https](https://www.apache.org/licenses/ ) result 200).
* http://www.apache.org/licenses/LICENSE-2.0 with 924 occurrences migrated to:
https://www.apache.org/licenses/LICENSE-2.0 ([https](https://www.apache.org/licenses/LICENSE-2.0 ) result 200).
* http://www.apache.org/licenses/LICENSE-2.0.html with 1 occurrences migrated to:
https://www.apache.org/licenses/LICENSE-2.0.html ([https](https://www.apache.org/licenses/LICENSE-2.0.html ) result 200).
2019-03-14 20:21:25 -05:00
2288d50f0e
Polish URLs
...
We have performed some polish on your URLs. We do not follow redirects to avoid expanding intentionally shorter URLs (i.e. URL shortened URLs)
# Fixed URLs
## Fixed But Review Recommended
These URLs were fixed, but the https status was not OK. However, the https status was the same as the http request, so we migrated them. Your review is recommended.
| HTTP URL | Result URL | HTTPS Result | HTTP Result | Count |
| --- | --- | --- | --- | --- |
| http://repo.terracotta.org/maven2/ | https://repo.terracotta.org/maven2/ | HttpResponse(httpStatus = 403 FORBIDDEN) | HttpResponse(httpStatus = 403 FORBIDDEN) | 1 |
| http://maven-gae-plugin.googlecode.com/svn/repository | https://maven-gae-plugin.googlecode.com/svn/repository | HttpResponse(httpStatus = 404 NOT_FOUND) | HttpResponse(httpStatus = 404 NOT_FOUND) | 1 |
| http://repository.springsource.com/maven/bundles/external | https://repository.springsource.com/maven/bundles/external | HttpResponse(httpStatus = 404 NOT_FOUND) | HttpResponse(httpStatus = 404 NOT_FOUND) | 1 |
| http://repository.springsource.com/maven/bundles/release | https://repository.springsource.com/maven/bundles/release | HttpResponse(httpStatus = 404 NOT_FOUND) | HttpResponse(httpStatus = 404 NOT_FOUND) | 1 |
## Fixed Success
These URLs were fixed successfully.
| HTTP URL | Result URL | HTTPS Result | HTTP Result | Count |
| --- | --- | --- | --- | --- |
| http://docs.spring.io/spring-ldap/docs/1.3.x/apidocs/ | https://docs.spring.io/spring-ldap/docs/1.3.x/apidocs/ | HttpResponse(httpStatus = 200 OK) | null | 2 |
| http://docs.spring.io/spring/docs/3.2.x/javadoc-api | https://docs.spring.io/spring/docs/3.2.x/javadoc-api | HttpResponse(httpStatus = 301 MOVED_PERMANENTLY redirectUrl = http://docs.spring.io/spring/docs/3.2.x/javadoc-api/ ) | null | 1 |
| http://docs.spring.io/spring/docs/3.2.x/javadoc-api/ | https://docs.spring.io/spring/docs/3.2.x/javadoc-api/ | HttpResponse(httpStatus = 200 OK) | null | 1 |
| http://download.oracle.com/javase/6/docs/api/ | https://download.oracle.com/javase/6/docs/api/ | HttpResponse(httpStatus = 302 FOUND redirectUrl = https://docs.oracle.com/javase/6/docs/api/ ) | null | 2 |
| http://spring.io/ | https://spring.io/ | HttpResponse(httpStatus = 200 OK) | null | 42 |
| http://spring.io/spring-security | https://spring.io/spring-security | HttpResponse(httpStatus = 302 FOUND redirectUrl = https://projects.spring.io/spring-security ) | null | 42 |
| http://www.apache.org/licenses/LICENSE-2.0.txt | https://www.apache.org/licenses/LICENSE-2.0.txt | HttpResponse(httpStatus = 200 OK) | null | 42 |
| http://forums.gradle.org/gradle/topics/after_upgrade_gradle_to_2_0_version_the_maven_pom_not_support_build_property | https://discuss.gradle.org/gradle/topics/after_upgrade_gradle_to_2_0_version_the_maven_pom_not_support_build_property | HttpResponse(httpStatus = 404 NOT_FOUND) | HttpResponse(httpStatus = 301 MOVED_PERMANENTLY redirectUrl = https://discuss.gradle.org/gradle/topics/after_upgrade_gradle_to_2_0_version_the_maven_pom_not_support_build_property ) | 1 |
| http://forums.gradle.org/gradle/topics/eclipse_wtp_deploys_testcode_to_server_example_provided | https://discuss.gradle.org/gradle/topics/eclipse_wtp_deploys_testcode_to_server_example_provided | HttpResponse(httpStatus = 404 NOT_FOUND) | HttpResponse(httpStatus = 301 MOVED_PERMANENTLY redirectUrl = https://discuss.gradle.org/gradle/topics/eclipse_wtp_deploys_testcode_to_server_example_provided ) | 1 |
# Ignored
These URLs were intentionally ignored so we didn't migrate them.
| HTTP URL |
| --- |
| http://maven.apache.org/POM/4.0.0 |
| http://maven.apache.org/xsd/maven-4.0.0.xsd |
| http://www.w3.org/2001/XMLSchema-instance |
2019-03-01 15:49:15 -06:00
7f246e1c0e
Release version 3.2.10.RELEASE
2016-12-22 20:05:14 +00:00
53ccda1549
Fix pom.xml
2016-12-22 13:08:51 -06:00
6d30da2e1f
Block URL Encoded "/" in DefaultHttpFirewall
...
Fixes gh-4171
2016-12-22 09:42:21 -06:00
55a25fa213
Use BUILD-SNAPSHOT
...
See if this avoids the conflict resolution
2016-12-20 20:44:14 -06:00
cdc485d121
Update to spring 3.2.17
2016-12-20 20:24:59 -06:00
5e19ac5e7e
Update pom.xml
2016-12-20 20:24:59 -06:00
f75ebb22d8
Next Development Version
2015-10-30 16:38:34 -05:00
980edebefa
Release version 3.2.9.RELEASE
2015-10-30 16:37:59 -05:00
1c22ec19e6
SEC-3082: make SavedRequest parameters case sensitive
2015-10-29 16:52:10 -05:00
d467146e49
SEC-2190: Support WebApplicationContext in ServletContext
2015-10-28 15:52:05 -05:00
c64b80564e
SEC-3108: DigestAuthenticationFilter should use SecurityContextHolder.createEmptyContext()
2015-10-27 14:00:02 -05:00
4cc2ffaa2d
SEC-3109: Fix web tests
2015-10-26 21:45:23 -05:00
37aacc5e02
SEC-3070: Logout invalidate-session=false and Spring Session doesn't
...
work
2015-10-20 13:50:04 -05:00
23de257508
SEC-3031: DelegatingSecurityContext(Runnable|Callable) only modify SecurityContext on new Thread
...
Modifying the SecurityContext on the same Thread can cause issues. For example, with a
RejectedExecutionHandler the SecurityContext may be cleared out on the original Thread.
This change modifies both the DelegatingSecurityContextRunnable and DelegatingSecurityContextCallable to,
by default, only modify the SecurityContext if they are invoked on a new Thread. The behavior can be changed
by setting the property enableOnOrigionalThread to true.
2015-07-22 16:48:04 -05:00
12ed990aa2
SEC-3051: Add AbstractPreAuthenticatedProcessingFilter#principalChanged
2015-07-22 09:02:25 -05:00
fcc9a34356
SEC-2973: Add OnCommittedResponseWrapper
...
This ensures that Spring Session & Security's logic for performing
a save on the response being committed can easily be kept in synch.
Further this ensures that the SecurityContext is now persisted when
the response body meets the content length.
2015-07-14 14:49:12 -05:00
00042ff70b
SEC-2931: Fix CsrfFilter Javadoc
2015-07-14 13:41:44 -05:00
ae772294cb
SEC-2851: Remove DataAccessException import from Persistent RememberMe
2015-04-21 15:04:51 -05:00
13cb51c15f
SEC-2918: Update Spring Version 3.2.13
2015-03-25 21:43:11 -05:00
1374898cd8
SEC-2879: Add Test
2015-02-24 23:19:27 -06:00
d5ed97eba6
SEC-2879: JdbcTokenRepositoryImpl updateToken should use lastUsed arg
2015-02-24 23:19:22 -06:00
8f29c2cc36
SEC-2878: Clean imports in UsernamePasswordAuthenticationFilter
2015-02-24 22:52:28 -06:00
dfaebfa63b
SEC-2872: CsrfAuthenticationStrategy Delay Saving CsrfToken
2015-02-24 17:35:08 -06:00
f794272bac
SEC-2832: Add Tests
2015-02-24 17:35:05 -06:00
aa0a5b96ab
SEC-2832: Update request attributes with new CsrfToken
2015-02-24 17:35:03 -06:00
975e4ec019
SEC-2078: AbstractPreAuthenticatedProcessingFilter requriesAuthentication support for non-String Principals
...
Previously, if the Principal returned by getPreAuthenticatedPrincipal was not a String,
it prevented requiresAuthentication from detecting when the Principal was the same.
This caused the need to authenticate the user for every request even when the Principal
did not change.
Now requiresAuthentication will check to see if the result of
getPreAuthenticatedPrincipal is equal to the current Authentication.getPrincipal().
2015-02-24 16:44:21 -06:00
74f8534b17
SEC-2791: AbstractRememberMeServices sets the version
...
If the maxAge < 1 then the version must be 1 otherwise browsers ignore
the value.
2015-02-04 15:58:49 -06:00
478a9650aa
SEC-2831: Regex/AntPath RequestMatcher handle invalid HTTP method
2015-02-04 12:05:25 -06:00
cdac4d990b
SEC-2747: Remove spring-core dependency from spring-security-crypto
2014-11-20 16:28:06 -06:00
89c5c56849
SEC-2599: HttpSessionEventPublisher get required ApplicationContext
...
In order to get better error messages (avoid NullPointerException) the
HttpSessionEventPublisher now gets the required ApplicationContext which
throws an IllegalStateException with a good error message.
2014-07-22 09:20:38 -05:00
89d80ed5c9
SEC-2683: Correct spelling of assignamble in AuthenticationPrincipalResolver Exception
2014-07-18 13:57:40 -05:00
d6b81abcf2
SEC-2578: HttpSessionSecurityContextRepository traverses HttpServletResponseWrapper
2014-05-02 15:06:28 -05:00
c074493f24
SEC-2573: RequestHeaderRequestMatcher constructor argument name has typo
2014-04-23 09:41:43 -05:00
79fa1c70eb
SEC-2542: Polish dependency exclusions
...
This cleans up exclusions so the pom.xml are not as cluttered.
2014-04-02 08:49:25 -05:00
fd6f9da184
SEC-2542: Use exclusions to remove duplicate dependencies
...
A number of projects had duplicate dependencies on their classpaths
as a result of the same classes being available in more than one
artifact, each with different Maven coordinates. Typically this only
affected the tests, but meant that the actual classes that were
loaded was somewhat unpredictable and had the potential to vary
between an IDE and the command line depending on the order in which
the aritfacts appeared on the classpath. This commit adds a number of
exclusions to remove such duplicates.
In addition to the new exclusions, notable other changes are:
- Spring Data JPA has been updated to 1.4.1. This brings its
transitive dependency upon spring-data-commons into line with
Spring LDAP's and prevents both spring-data-commons-core and
spring-data-commons from being on the classpath
- All Servlet API dependencies have been updated to use the official
artifact with all transitive dependencies on unofficial servlet API
artifacts being excluded.
- In places, groovy has been replaced with groovy-all. This removes
some duplicates caused by groovy's transitive dependencies.
- JUnit has been updated to 4.11 which brings its transitive Hamcrest
dependency into line with other components.
There appears to be a bug in Gradle which means that some exclusions
applied to an artifact do not work reliably. To work around this
problem it has been necessary to apply some exclusions at the
configuration level
Conflicts:
samples/messages-jc/pom.xml
2014-04-02 08:48:55 -05:00
ea0466d666
Next developmenet version in pom.xml
2014-04-02 08:44:06 -05:00
d7a2c0a98c
SEC-2177: Polish
2014-03-18 15:49:20 -05:00
9057fbe0ed
SEC-2177: Striping off all leading schemes
...
Striping off all leading schemes in the DefaultRedirectStrategy, so it
will be less vulnerable to open redirect phishing attacks. More info can
be found at SEC-2177 JIRA issue.
2014-03-18 15:49:20 -05:00
537d8f974f
SEC-2519: RememberMeAuthenticationException supports root cause
...
Added a constructor which keeps the root cause of the exception, and
added some documentation
2014-03-11 16:13:03 -05:00
bb563967cc
SEC-2507: WebExpressionVoter.supports support subclasses of FilterInvocation
2014-03-10 14:21:07 -05:00
60704eb50e
SEC-2511: Remove double ALLOW-FROM in X-Frame-Options header
2014-03-06 22:00:09 -06:00
f02b77794f
SEC-2511: Remove double ALLOW-FROM from X-Frame-Options header.
...
The interface documentation for getAllowFromValue states: Gets the value for ALLOW-FROM excluding the ALLOW-FROM.
2014-03-06 21:59:46 -06:00
7f99a2dfbb
SEC-2487: Update to Spring 3.2.8.RELEASE
2014-02-19 09:30:40 -06:00
ec8b48150d
SEC-2474: Update poms
2014-02-07 17:01:11 -06:00
8d8475deb1
SEC-2455: form-login@login-processing-url & logout@logout-url use matchers
...
Remove the deprecation warnings of using setFilterProcessingUrl by invoking
the matcher methods instead.
2014-01-29 15:35:18 -06:00
2df5541905
SEC-2448: Update to HSQL 2.3.1
2013-12-14 10:19:06 -06:00
ca1080fb96
SEC-2439: HttpSessionCsrfTokenRepository setHeaderName sets header instead of parameter
2013-12-13 15:47:28 -06:00
a34178bc40
SEC-2434: Update to Spring 3.2.6 and Spring 4.0 GA
2013-12-12 08:16:59 -06:00
Spring Operator
Rob Winch
Spring Buildmaster
Rob Winch
Michael Cramer
Marcin Mielnicki
Stillglade
Rob Winch
Mattias Severson
Maciej Zasada
Julien Dubois
getvictor