[Geoserver-devel] Upgrading Wicket

GeoServer GeoServer Developer
1

Hey guys,

It’s come up a couple of times recently that we’re on a quite old version of Wicket (1.4 when the latest is 6.5, although that’s not as bad as it might sound since the Wicket project went straight from 1.5 to 6.0.)

In particular, in the recent palette patch 1, it was mentioned that we might be fixing a bug that’s already resolved upstream. (I’m not sure whether this is the case.)

Just to remind everyone of the upgrade status, I started working on this a few months ago and got all of GeoServer to compile with Wicket 1.5, but was stalled out when I ran into some test failures and couldn’t determine what the tests should be doing. (These were in the new security module, meaning that ironically GeoServer’s security code is holding us back from updating to a modern version of the web framework we use.) In the interim since I’ve looked at it, we appear to have added new dependencies on Wicket APIs that have been deprecated or removed (for example, we have a custom RequestEncodingStrategy, when the New Way is to use request mappings 2.) So currently the ‘feature-wicket-upgrade’ branch I’ve been working on does not compile (I did just merge from master, but I haven’t addressed the incompatibilities that were added in the last couple of months.)

Anyway, it would be nice to figure out a way forward. Does anyone care about this besides me? How can we avoid getting more and more entwined with old APIs? Can we set a GeoServer version to target this upgrade for?

–
David Winslow
OpenGeo - http://opengeo.org/

2

For reference, there appear to be a number of open CVE issues with Apache Wicket < 1.4.21 (I’m guessing its the same thing):

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wicket

I don’t know which specific wicket version is being used, but if its less than 1.4.21, then GeoServer may be vulnerable to one or more of these.

On 29 January 2013 15:17, David Winslow <dwinslow@anonymised.com> wrote:

Hey guys,

It’s come up a couple of times recently that we’re on a quite old version of Wicket (1.4 when the latest is 6.5, although that’s not as bad as it might sound since the Wicket project went straight from 1.5 to 6.0.)

In particular, in the recent palette patch 1, it was mentioned that we might be fixing a bug that’s already resolved upstream. (I’m not sure whether this is the case.)

Just to remind everyone of the upgrade status, I started working on this a few months ago and got all of GeoServer to compile with Wicket 1.5, but was stalled out when I ran into some test failures and couldn’t determine what the tests should be doing. (These were in the new security module, meaning that ironically GeoServer’s security code is holding us back from updating to a modern version of the web framework we use.) In the interim since I’ve looked at it, we appear to have added new dependencies on Wicket APIs that have been deprecated or removed (for example, we have a custom RequestEncodingStrategy, when the New Way is to use request mappings 2.) So currently the ‘feature-wicket-upgrade’ branch I’ve been working on does not compile (I did just merge from master, but I haven’t addressed the incompatibilities that were added in the last couple of months.)

Anyway, it would be nice to figure out a way forward. Does anyone care about this besides me? How can we avoid getting more and more entwined with old APIs? Can we set a GeoServer version to target this upgrade for?

–
David Winslow
OpenGeo - http://opengeo.org/

Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
MVPs and experts. ON SALE this month only – learn more at:
http://p.sf.net/sfu/learnnow-d2d

Geoserver-devel mailing list
Geoserver-devel@anonymised.comnet
https://lists.sourceforge.net/lists/listinfo/geoserver-devel

This transmission is intended for the named addressee(s) only and may contain sensitive or protectively marked material up to RESTRICTED and should be handled accordingly. Unless you are the named addressee (or authorised to receive it for the addressee) you may not copy or use it, or disclose it to anyone else. If you have received this transmission in error please notify the sender immediately. All email traffic sent to or from us, including without limitation all GCSX traffic, may be subject to recording and/or monitoring in accordance with relevant legislation.

3

On Wed, Jan 30, 2013 at 1:58 PM, Jonathan Moules <jonathanmoules@anonymised.com…3638…> wrote:

For reference, there appear to be a number of open CVE issues with Apache Wicket < 1.4.21 (I’m guessing its the same thing):

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wicket

I don’t know which specific wicket version is being used, but if its less than 1.4.21, then GeoServer may be vulnerable to one or more of these.

We are using 1.4.12 at the moment.
Upgrading to 1.5.x has proven to be quite difficult, (1.6.x… not even a chance right now), but maybe we could try
to upgrade to 1.4.21 on the stable series and hope the upgrade is fully compatible

Cheers
Andrea

–

==
Our support, Your Success! Visit http://opensdi.geo-solutions.it for more information.

Ing. Andrea Aime
@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

4

On Tue, Jan 29, 2013 at 4:17 PM, David Winslow <dwinslow@anonymised.com> wrote:

Hey guys,

It’s come up a couple of times recently that we’re on a quite old version of Wicket (1.4 when the latest is 6.5, although that’s not as bad as it might sound since the Wicket project went straight from 1.5 to 6.0.)

In particular, in the recent palette patch [1], it was mentioned that we might be fixing a bug that’s already resolved upstream. (I’m not sure whether this is the case.)

Just to remind everyone of the upgrade status, I started working on this a few months ago and got all of GeoServer to compile with Wicket 1.5, but was stalled out when I ran into some test failures and couldn’t determine what the tests should be doing. (These were in the new security module, meaning that ironically GeoServer’s security code is holding us back from updating to a modern version of the web framework we use.) In the interim since I’ve looked at it, we appear to have added new dependencies on Wicket APIs that have been deprecated or removed (for example, we have a custom RequestEncodingStrategy, when the New Way is to use request mappings [2].) So currently the ‘feature-wicket-upgrade’ branch I’ve been working on does not compile (I did just merge from master, but I haven’t addressed the incompatibilities that were added in the last couple of months.)

Anyway, it would be nice to figure out a way forward. Does anyone care about this besides me? How can we avoid getting more and more entwined with old APIs? Can we set a GeoServer version to target this upgrade for?

I don’t think we can “set” anything if we do this on spare time basis, but I’m interested in giving another go.
However, it seems that to handle the current blockers we’ll also need some help from Christian?

Cheers
Andrea

–

==
Our support, Your Success! Visit http://opensdi.geo-solutions.it for more information.

Ing. Andrea Aime
@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

5

The security wicket code was done by Justin and me, it depends on the specific problem. AFAIK Justin does not change the author tag in the header if he does modifications. The same holds true for me, the author is always the creator of the class.

I am skiing next week, so I can have a look at the problems in two weeks.

Christian

2013/1/30 Andrea Aime <andrea.aime@anonymised.com>

On Tue, Jan 29, 2013 at 4:17 PM, David Winslow <dwinslow@anonymised.com> wrote:

Hey guys,

It’s come up a couple of times recently that we’re on a quite old version of Wicket (1.4 when the latest is 6.5, although that’s not as bad as it might sound since the Wicket project went straight from 1.5 to 6.0.)

In particular, in the recent palette patch [1], it was mentioned that we might be fixing a bug that’s already resolved upstream. (I’m not sure whether this is the case.)

Just to remind everyone of the upgrade status, I started working on this a few months ago and got all of GeoServer to compile with Wicket 1.5, but was stalled out when I ran into some test failures and couldn’t determine what the tests should be doing. (These were in the new security module, meaning that ironically GeoServer’s security code is holding us back from updating to a modern version of the web framework we use.) In the interim since I’ve looked at it, we appear to have added new dependencies on Wicket APIs that have been deprecated or removed (for example, we have a custom RequestEncodingStrategy, when the New Way is to use request mappings [2].) So currently the ‘feature-wicket-upgrade’ branch I’ve been working on does not compile (I did just merge from master, but I haven’t addressed the incompatibilities that were added in the last couple of months.)

Anyway, it would be nice to figure out a way forward. Does anyone care about this besides me? How can we avoid getting more and more entwined with old APIs? Can we set a GeoServer version to target this upgrade for?

I don’t think we can “set” anything if we do this on spare time basis, but I’m interested in giving another go.
However, it seems that to handle the current blockers we’ll also need some help from Christian?

Cheers

Andrea

–

==
Our support, Your Success! Visit http://opensdi.geo-solutions.it for more information.

Ing. Andrea Aime
@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_jan

Geoserver-devel mailing list
Geoserver-devel@anonymised.comsts.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/geoserver-devel