-
Type:
Bug
-
Status: Closed
-
Priority:
Major
-
Resolution: Fixed
-
Affects Version/s: 2.7.15
-
Fix Version/s: 2.7.16
-
Component/s: JAX-RS, Transports
-
Labels:None
-
Estimated Complexity:Unknown
I assume that the properties set on the service are init-params to org.apache.cxf.transport.servlet.ServletController. Some frameworks, pax-web-extender-whiteboard in my case, require one of the following for init parameters
- init-params are prefixed with init. OR
- There's a property init-prefix on the service specifying the prefix. This property may be blank
With the service as it stands no parameters are set on the servlet by pax-web-extender-whiteboard. They are skipped at this if-statement: https://github.com/ops4j/org.ops4j.pax.web/blob/master/pax-web-extender-whiteboard/src/main/java/org/ops4j/pax/web/extender/whiteboard/internal/tracker/ServletTracker.java#L180-L182
This makes it impossible to secure the servlet.