Race condition in SmallRye Config property expansion for @RolesAllowed value? #30988
Labels
Milestone
Comments
|
/cc @sberyozkin (security) |
|
@michalvavrik it's probably related to #29935 /cc @radcortez as there might be some config knowledge required. |
gsmet
changed the title
|
I'll look at it. |
|
Way I see it, I need to run build step that validates/uses runtime configuration (it's runtime init) property after |
|
Maybe Could the annotations be inspected and recorded during the build phase instead of static init? This would allow generating the source directly and not require mutating it later. |
michalvavrik
added a commit
to michalvavrik/quarkus
that referenced
this issue
Feb 14, 2023
|
I see what you mean, but it also has to work with runtime properties. I didn't know about that build item, thanks. Anyway, I took leverage of |
michalvavrik
added a commit
to michalvavrik/quarkus
that referenced
this issue
Feb 14, 2023
|
Sure. |
iocanel
pushed a commit
to iocanel/quarkus
that referenced
this issue
Feb 14, 2023
gsmet
pushed a commit
to gsmet/quarkus
that referenced
this issue
Feb 15, 2023
fixes: quarkusio#30988 (cherry picked from commit 3c19ad3)
benkard
added a commit
to benkard/mulkcms2
that referenced
this issue
Apr 2, 2023
This MR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [flow-bin](https://github.com/flowtype/flow-bin) ([changelog](https://github.com/facebook/flow/blob/master/Changelog.md)) | devDependencies | minor | [`^0.199.0` -> `^0.200.0`](https://renovatebot.com/diffs/npm/flow-bin/0.199.0/0.200.0) | | [com.rometools:rome](http://rometools.com) ([source](https://github.com/rometools/rome)) | compile | minor | `1.18.0` -> `1.19.0` | | [org.postgresql:postgresql](https://jdbc.postgresql.org) ([source](https://github.com/pgjdbc/pgjdbc)) | build | patch | `42.5.3` -> `42.5.4` | | [org.jsoup:jsoup](https://jsoup.org/) ([source](https://github.com/jhy/jsoup)) | compile | patch | `1.15.3` -> `1.15.4` | | [io.quarkus:quarkus-maven-plugin](https://github.com/quarkusio/quarkus) | build | patch | `2.16.2.Final` -> `2.16.3.Final` | | [io.quarkus:quarkus-universe-bom](https://github.com/quarkusio/quarkus-platform) | import | patch | `2.16.2.Final` -> `2.16.3.Final` | --- ### Release Notes <details> <summary>flowtype/flow-bin</summary> ### [`v0.200.0`](flow/flow-bin@9618443...b6c1eb0) [Compare Source](flow/flow-bin@9618443...b6c1eb0) ### [`v0.199.1`](flow/flow-bin@05bb4e3...9618443) [Compare Source](flow/flow-bin@05bb4e3...9618443) </details> <details> <summary>rometools/rome</summary> ### [`v1.19.0`](https://github.com/rometools/rome/releases/tag/1.19.0) [Compare Source](rometools/rome@1.18.0...1.19.0) <!-- Release notes generated using configuration in .github/release.yml at 1.19.0 --> #### What's Changed ##### 🔨 Dependency Upgrades - Bump flatten-maven-plugin from 1.2.7 to 1.3.0 by [@​dependabot](https://github.com/dependabot) in rometools/rome#565 - Bump maven-bundle-plugin from 5.1.5 to 5.1.8 by [@​dependabot](https://github.com/dependabot) in rometools/rome#563 - Bump maven-dependency-plugin from 3.3.0 to 3.5.0 by [@​dependabot](https://github.com/dependabot) in rometools/rome#602 - Bump maven-deploy-plugin from 2.8.2 to 3.1.0 by [@​dependabot](https://github.com/dependabot) in rometools/rome#607 - Bump maven-jar-plugin from 3.2.2 to 3.3.0 by [@​dependabot](https://github.com/dependabot) in rometools/rome#574 - Bump maven-javadoc-plugin from 3.3.1 to 3.5.0 by [@​dependabot](https://github.com/dependabot) in rometools/rome#609 - Bump maven-scm-plugin from 1.12.2 to 1.13.0 by [@​dependabot](https://github.com/dependabot) in rometools/rome#554 - Bump assertj-core from 3.22.0 to 3.24.2 by [@​dependabot](https://github.com/dependabot) in rometools/rome#603 - Bump slf4j-api from 1.7.36 to 2.0.6 by [@​dependabot](https://github.com/dependabot) in rometools/rome#596 ##### Other Changes - Bump actions/setup-java from 3.3.0 to 3.10.0 by [@​dependabot](https://github.com/dependabot) in rometools/rome#606 - Bump logback-classic from 1.2.10 to 1.3.5 by [@​PatrickGotthard](https://github.com/PatrickGotthard) in rometools/rome#611 **Full Changelog**: rometools/rome@1.18.0...1.19.0 </details> <details> <summary>pgjdbc/pgjdbc</summary> ### [`v42.5.4`](https://github.com/pgjdbc/pgjdbc/blob/HEAD/CHANGELOG.md#​4254-2023-02-15-102104--0500) ##### Fixed fix: fix testGetSQLTypeQueryCache by searching for xid type. We used to search for box type but it is now cached. xid is not cached, this nuance is required for the test. fix OidValueCorrectnessTest BOX_ARRAY OID, by adding BOX_ARRAY to the oidTypeName map \[MR [#​2810](https://github.com/pgjdbc/pgjdbc/issues/2810)]\((https://github.com/pgjdbc/pgjdbc/pull/2810). fixes [Issue #​2804](pgjdbc/pgjdbc#2804). fix: Make sure that github CI runs tests on all [MRs #​2809](\(https://github.com/pgjdbc/pgjdbc/pull/2809\)). </details> <details> <summary>quarkusio/quarkus</summary> ### [`v2.16.3.Final`](https://github.com/quarkusio/quarkus/releases/tag/2.16.3.Final) [Compare Source](quarkusio/quarkus@2.16.2.Final...2.16.3.Final) ##### Major changes - [#​29756](quarkusio/quarkus#29756) - Support custom Flyway credentials/URL ##### Complete changelog - [#​31141](quarkusio/quarkus#31141) - Resolve roles allowed configuration expression after config setup is completed - [#​31129](quarkusio/quarkus#31129) - Fix stuck HTTP2 request when sent challenge has resumed request - [#​31125](quarkusio/quarkus#31125) - Add "keep-alive-enabled" parameter to REST client reactive - [#​31112](quarkusio/quarkus#31112) - Qute - fix assignability check when validating expressions - [#​31099](quarkusio/quarkus#31099) - Use the effective Maven project build config when initializing sources and classes paths for dev mode - [#​31092](quarkusio/quarkus#31092) - Make sure quarkus:go-offline properly supports test scoped dependencies - [#​31077](quarkusio/quarkus#31077) - Qute: regression in template extension method with byte array - [#​31076](quarkusio/quarkus#31076) - Quarkiverse: Install instead of verify - [#​31074](quarkusio/quarkus#31074) - Added quarkus-jms-spi to quarkus bom - [#​31059](quarkusio/quarkus#31059) - Path lookup must also consider interfaces - [#​31046](quarkusio/quarkus#31046) - Simplify Quarkiverse release.yml workflow - [#​31038](quarkusio/quarkus#31038) - Update Instrumentation Processor check logic to match comment - [#​31036](quarkusio/quarkus#31036) - Use CDI when accessing UserTransaction/TransactionManager in QuarkusTransaction - [#​31028](quarkusio/quarkus#31028) - Fix typo in snapstart enable config - [#​31016](quarkusio/quarkus#31016) - Re-initialize platform dependent netty classes/values at runtime - [#​30988](quarkusio/quarkus#30988) - Race condition in SmallRye Config property expansion for [@​RolesAllowed](https://github.com/RolesAllowed) value? - [#​30964](quarkusio/quarkus#30964) - Add ConfigMappings from a builder class to support full hot reload - [#​30961](quarkusio/quarkus#30961) - Error of quarkus:dev when the project.build.directory is overridden by a profile - [#​30960](quarkusio/quarkus#30960) - Register CDI Bean when ConfigMapping is marked as Unremovable - [#​30922](quarkusio/quarkus#30922) - Fix dependency parsing in JBangBuilderImpl - [#​30885](quarkusio/quarkus#30885) - Add concurrency configuration to the GitHub Action workflows - [#​30843](quarkusio/quarkus#30843) - Micrometer-Extension writes wrong URI-Tag when Path-Variables defined at Interface-Level - [#​30672](quarkusio/quarkus#30672) - Avoid creating CSRF cookie if no CSRF token was created - [#​30648](quarkusio/quarkus#30648) - Support passing filename to multipart form data output - [#​30594](quarkusio/quarkus#30594) - CSRF: exception thrown when authentication falied - [#​30570](quarkusio/quarkus#30570) - Set filename for PartItems in MultipartFormDataOutput - [#​30455](quarkusio/quarkus#30455) - Introduce `quarkus.datasource.devservices.init-script-path` - [#​29756](quarkusio/quarkus#29756) - Support custom Flyway credentials/URL - [#​29631](quarkusio/quarkus#29631) - [@​Unremovable](https://github.com/Unremovable) ConfigMapping is still removed - [#​29630](quarkusio/quarkus#29630) - Changes to configmappings not being applied during hot reload - [#​28709](quarkusio/quarkus#28709) - QuarkusTransaction does not fire [@​Initialized](https://github.com/Initialized)(TransactionScoped.class) - [#​24639](quarkusio/quarkus#24639) - configure dedicated db user for database migrations: DML-only user for datasource, but DDL user for migration - [#​23360](quarkusio/quarkus#23360) - "Request has already been read" using vertx + auth - [#​17839](quarkusio/quarkus#17839) - Invalid memory configuration for netty maxDirectMemory in native image </details> <details> <summary>quarkusio/quarkus-platform</summary> ### [`v2.16.3.Final`](quarkusio/quarkus-platform@2.16.2.Final...2.16.3.Final) [Compare Source](quarkusio/quarkus-platform@2.16.2.Final...2.16.3.Final) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever MR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This MR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNC4yNC4wIiwidXBkYXRlZEluVmVyIjoiMzQuMjQuMCJ9-->
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
We sometimes have
LazyAuthRolesAllowedConfigExpTestCasefailing on CI with the error above.I saw it on Windows which is usually a bit slower than the Linux hosts so it could be a race condition somewhere.
The text was updated successfully, but these errors were encountered: