Winery is a web-based environment to graphically model TOSCA topologies and plans managing these topologies. It is an Eclipse project and thus support is available through its project page https://eclipse.org/winery. Winery is also part of the OpenTOSCA ecosystem where more information is available at http://www.opentosca.org.
The code and the linked libraries are NOT approved by Eclipse Legal.
There was no software security check of Eclipse Winery in the past. There might be remote code execution vulnerabilities. Thus, when hosting Eclipse Winery, make it accessible to trustworthy parties only.
We take vulnerability reports serious. Here a list of the publicly disclosed ones.
- Winery is vulnerable to XSS. All data input in the front end is NOT sanitized and sent back as is. For instance, you can try it out at Administration -> Namespase -> Add.
Both development and user documentation is available at https://eclipse.github.io/winery. The source for the documentation can be found in the docs directory.
The initial code contribution has been supported by the Federal Ministry for Economic Affairs and Energy as part of the CloudCycle project (01MD11023). Current development is supported by the Federal Ministry for Economic Affairs and Climate Action as part of the PlanQK project (01MK20005N), the DFG (Deutsche Forschungsgemeinschaft) projects ReSUS (425911815) and IAC² (314720630), as well as the DFG’s Excellence Initiative project SimTech (EXC 2075 - 390740016). Additional development has been funded by the Federal Ministry for Economic Affairs and Energy projects SmartOrchestra (01MD16001F) and SePiA.Pro (01MD16013F), as well as by the DFG projects SustainLife (641730) and ADDCompliance (636503). Further development is also funded by the European Union’s Horizon 2020 project RADON (825040).
Copyright (c) 2012-2023 Contributors to the Eclipse Foundation
See the NOTICE file(s) distributed with this work for additional information regarding copyright ownership.
This program and the accompanying materials are made available under the terms of the Eclipse Public License 2.0 which is available at http://www.eclipse.org/legal/epl-2.0, or the Apache Software License 2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
SPDX-License-Identifier: EPL-2.0 OR Apache-2.0