You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: jamal-maven-load/README.adoc
+51-34Lines changed: 51 additions & 34 deletions
Original file line number
Diff line number
Diff line change
@@ -2,18 +2,18 @@
2
2
3
3
The Jamal Maven Load module contains a macro to download Java JAR files from Maven repositories during run-time and load the macro classes into the running application.
4
4
5
-
The library's security was designed carefully to balance the ease of use and the security of the application.
6
-
Without any security measures, a Jamal file could execute any Java code published online, which is not a good idea.
7
-
To prevent this the Jamal installation has to be configured properly to use this module.
5
+
I designed the library's security, balancing the ease of use and the application's security.
6
+
Without security measures, a Jamal file could execute any Java code published online, which is not a good idea.
7
+
The Jamal installation has to be adequately configured to use this module.
8
8
The requirements of a proper configuration are described in the section about security.
9
9
10
10
== Macro
11
11
12
-
Currently, there is only one maco defined in this module.
12
+
Currently, there is only one macro defined in this module.
13
13
14
14
=== `maven:load`
15
15
16
-
It loads the macros from a Maven artifact along with its dependencies, unless the `noDependencies` option is used.
16
+
It loads the macros from a Maven artifact and its dependencies unless the `noDependencies` option is used.
17
17
18
18
This macro reads its input and interprets it as a maven coordinate set.
19
19
The format has to be
@@ -25,9 +25,9 @@ The macro works in two steps:
25
25
26
26
1. First, it downloads the artifact JAR and all the dependencies.
27
27
28
-
2. It loads the macros from the JAR files (the specified one and the dependencies) using a class loader.
28
+
2. Using a class loader, it loads the macros from the JAR files (the specified one and the dependencies).
29
29
30
-
It is possible to load only the file without the dependencies using the `noDependencies` option.
30
+
Loading only the file without the dependencies is possible using the `noDependencies` option.
31
31
32
32
[WARNING]
33
33
====
@@ -37,6 +37,7 @@ For more information, see the section about security.
37
37
====
38
38
39
39
The behavior of the macro can be controlled using options.
40
+
The options should follow the macro's name between `(` and `)` characters.
40
41
The options are:
41
42
42
43
* `repositories` (aliases are `repository`, `repo`, `repos`) define the Maven repositories used comma separated.
@@ -50,9 +51,10 @@ The symbolic names can be
50
51
- `google-maven-central-asia`
51
52
+
52
53
The default value is `central`.
53
-
When a URL is specified it is checked against the configuration.
54
-
The symbolic names are permitted by default, they can be used without configuration.
55
-
For more information see the section about security.
54
+
When a URL is specified, it is checked against the configuration.
55
+
The symbolic names are permitted by default; they can be used without configuration.
56
+
URLs must be configured in the `maven.load.repo` configuration property.
57
+
For more information, see the section about security.
56
58
57
59
* `noDependencies` (alias is `noDeps`) says that the dependencies of the JAR should not be loaded.
58
60
The default value is `false`.
@@ -62,8 +64,8 @@ already loaded.
62
64
63
65
* `local` can specify the location of the local Maven repository.
64
66
The default value is `~/.m2/repository`.
65
-
If this option is used it is checked against the configuration.
66
-
For more information see the section about security.
67
+
If this option is used, it is checked against the configuration.
68
+
For more information, see the section about security.
67
69
68
70
* `exclude` can specify a comma-separated list of maven coordinates that should not be loaded.
69
71
This parameter will not stop loading the "root" artifact specified in the macro input.
@@ -79,14 +81,14 @@ The macro `maven:load` reads the configuration of Jamal via an API that works on
79
81
80
82
=== Secure configuration
81
83
82
-
This macro works only if your configuration files' access control is properly set.
83
-
Without that someone accessing the computer in a different account could modify the configuration and load malicious code.
84
+
This macro works only if your configuration files' access control is set correctly.
85
+
Without that, someone accessing the computer in a different account could modify the configuration, potentially loading malicious code.
84
86
85
-
The configuration must be secure meaning:
87
+
The configuration must be secure, meaning:
86
88
87
89
* There is no configuration.
88
90
In that case, nothing can be opened, so there is no security risk.
89
-
However, in this case, the macro will not be able to load any JAR file.
91
+
However, in this case, the macro cannot load any JAR file.
90
92
OR
91
93
92
94
The configuration directory and the files are _SAFE_
@@ -125,31 +127,42 @@ When reading the configuration, if any of the
125
127
126
128
* `maven.load.repo`
127
129
128
-
properties point to files, these files should also be _SAFE_.
130
+
properties point to files; these files should also be _SAFE_.
129
131
====
130
132
131
133
NOTE: Securing the configuration is not a must for Jamal's other parts and functionalities, although it is a good practice.
132
134
The security is only checked before reading the configuration for the `maven:load` macro.
133
135
134
136
Also, the `maven:load` macro uses a unique API to read the configuration.
135
137
Every time the macro runs, the API rereads the files, checks the security of the configuration, and ignores the in-memory cached configuration.
136
-
Also, note that while most of the macros and functionalities of Jamal read configuration via an API that consults the system properties first, environment variables second, and lastly only
138
+
Also, note that while most of the macros and functionalities of Jamal read configuration via an API that consults the system properties first, environment variables second, and lastly, only
137
139
the configuration files,
138
140
139
141
====
140
142
the API used by the `maven:load` macro reads only the configuration files in the directory `~/.jamal/`.
141
-
These are `~/.jamal/settings.properties` or `~/.jamal/settings.xml` and the files references by the above-mentioned properties.
143
+
These are `~/.jamal/settings.properties` or `~/.jamal/settings.xml`.
144
+
====
145
+
146
+
[NOTE]
147
+
====
148
+
When Jamal is executed in an interactive environment the security for a specific `maven:load` macro is checked only once.
149
+
The security is checked only when the macro tries to load the classes.
150
+
When the classes were loaded by the same JVM in a previous run, the security is not checked again.
151
+
152
+
It also means that changing the configuration to prevent the load of a macro library that was already loaded is futile.
153
+
On the other hand, changing the configuration to allow the load of a macro library that failed to load due to security settings is effective.
154
+
There is no need to restart the application executing Jamal.
142
155
====
143
156
144
157
=== Configuration
145
158
146
159
The `maven:load` macro has to be configured for security reasons.
147
160
It can only load JAR files which are explicitly allowed by the configuration.
148
-
Also, the remote repositories and the local repository have to be configured unless the hardwired well-known repositories are used with the default local location.
161
+
Also, the remote and local repositories must be configured unless the well-known hardwired repositories are used with the default local location.
149
162
150
163
The values for the property keys are
151
164
152
-
* commaseparated list of maven coordinates + path,
165
+
* comma-separated list of maven coordinates + path,
153
166
154
167
* absolute paths,
155
168
@@ -159,13 +172,13 @@ The values for the property keys are
159
172
160
173
When a key points to a file, the file also has to be _SAFE_ as defined in the previous section.
161
174
It has to be in the same directory as the configuration file and has to be specified by the bare name and extension but without any path.
162
-
The file contains the configuration information one per line.
175
+
The file contains the configuration information, one per line.
163
176
164
177
[NOTE]
165
178
====
166
179
You can use the comma-separated list in the `.properties` file.
167
-
When you have too many configuration items, however, it is better to use a file.
168
-
To have a readable format the file contains the list of the configuration items one per line.
180
+
However, it is better to use a file when you have many configuration items.
181
+
The file contains the list of configuration items, one per line.
169
182
====
170
183
171
184
==== `maven.load.include`
@@ -178,6 +191,7 @@ Every maven coordinate has to be in the format
178
191
groupId:artifactId:version
179
192
180
193
or
194
+
181
195
groupId:artifactId:version:path
182
196
183
197
The `groupId` cannot be a wildcard.
@@ -186,19 +200,20 @@ The path part is optional.
186
200
If the `artifactId` is a wildcard, then the `version` has to be a wildcard too.
187
201
188
202
The path represents the path to the Jamal source.
189
-
It can either be the absolute path to the Jamal text or a directory.
190
-
When the value ends with a `/` it is considered a directory.
203
+
It can be the absolute path to the Jamal input file or the directory containing one or more Jamal input files.
204
+
If the path is a directory, `maven:load` is also permitted for all subdirectories.
205
+
When the value ends with a `/`, it is considered a directory.
191
206
192
-
When the path is specified it is compared against the path of the Jamal source.
207
+
When the path is specified, it is compared against the path of the Jamal source.
193
208
The Jamal source file has to be the same or has to be in the specified directory.
194
209
195
-
The macro `maven:load` is used sometimes from a file included or imported by the top Jamal source directly or through other includes or imports.
196
-
In this case, just as when the normal, the path of the toplevel Jamal file is used only.
210
+
The macro `maven:load` is sometimes used from a file included or imported by the top Jamal source directly or through other includes or imports.
211
+
In this case, the path of the top-level Jamal file is used only.
197
212
198
213
==== `maven.load.exclude`
199
214
200
-
The key `maven.load.exclude` can be used to exclude some maven coordinates from the list of allowed coordinates.
201
-
If a coordinate is excluded, it cannot be used even if it is included in the `maven.load.include` list.
215
+
The key `maven.load.exclude` can exclude some maven coordinates from the list of allowed coordinates.
216
+
If a coordinate is excluded, it cannot be used even if included in the `maven.load.include` list.
202
217
203
218
A coordinate will also be skipped if one is present as a dependency.
204
219
In this case, however, the download will not stop.
@@ -207,16 +222,18 @@ The class loading, however, may still fail if classes are missing because of the
207
222
==== `maven.load.local`
208
223
209
224
The key `maven.load.local` can be used to specify the location of the local Maven repository.
210
-
It has to be configured when the option `local` used.
211
-
The values have to specify the absolute paths of the allowed directories that can be used as local repos.
225
+
It has to be configured when the option `local` is used.
226
+
The values have to specify the absolute paths of the allowed directories that can be used as local repositories.
212
227
213
228
WARNING: This is a security configuration.
214
229
Specifying a location here will not change the default location.
230
+
It merely lists the allowed locations.
215
231
216
232
==== `maven.load.repo`
217
233
218
234
The key `maven.load.repo` can be used to specify the list of allowed remote repositories in addition to the predefined ones.
219
-
The values have to be the URLs as they appear in the `repositories` option of the `maven:load` macro.
235
+
The values must be the URLs appearing in the `repositories` option of the `maven:load` macro.
220
236
221
237
WARNING: This is a security configuration.
222
238
Specifying a URL here will not change the default repository.
0 commit comments