pac4j artifacts bundling their test code in production jars since 6.5.0

[James Nord]

Hi all,

in processing an update from pac4j 6.4.x to 6.5.x I have noticed that many of the pac4j jars are now shipping formally test code in the production jars.

Given test code is generally not written in anyway to be secure, and has no idea about the environment or reachability that it will be running in this is very concerning to me.

Whilst there are OSGi manifests this is of no help when the downstream system does not use OSGi and as such all test classes are exposed to the application (which could lead to further unexpected exposure and is a small step away from a security issue).

e.g. https://repo1.maven.org/maven2/org/pac4j/pac4j-core/6.5.4/pac4j-core-6.5.4.jar contains org\pac4j\test\ with interesting things like DbServer.class (from https://github.com/pac4j/pac4j/commits/master/pac4j-core/src/main/java/org/pac4j/test/sql/DbServer.java which was relocated from test source in  pac4j-sql.

from https://github.com/pac4j/pac4j/commit/09317c1749f8f81a5ca33f2f83432fc14b3d8a78 
 

Database itself once the class is loaded starts an in memory h2 DB with well known username/password which is not something that should be done in any production code just because a class can be loaded (which can be for a variety of reasons). granted this is not available over the network but is a small change away from a potential full RCE.

Was this a conscious choice or a mistake?  

Regards.

/James

CONFIDENTIALITY NOTICE: This email and any attachments contain confidential and proprietary information of CloudBees intended only for the named recipient(s). Unauthorized use or distribution is prohibited. If you received this in error, please notify the sender and delete this email.

[Jérôme LELEU]

Hi,

I see your point, it was done on purpose to simplify things.

Except DbServer which has static code and this should be changed, other objects don't do anything "by default" so there is no problem.

I just committed: https://github.com/pac4j/pac4j/commit/20f6fe39a2d4d9ab6d73dd5300163c8e2fef4f82

But it may be a mistake, I will give it some more thoughts.

Thanks.

Best regards,

Jérôme

--
You received this message because you are subscribed to the Google Groups "Pac4j development mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pac4j-dev+...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/pac4j-dev/CAPcEHyfObwd0qFHgsXNujYEBQY3D8bzzz6w5sge0eNsfVb4Oig%40mail.gmail.com.