Upgrade Jetty

Description

Since v10.x, Jetty includes an UriCompliance class that by default doesn't allow much of the offending URL encoding:

One proprietary fork that I’m working on does not seem to be affected by the issue, as it upgraded to Jetty 10.0.6, which has this UriCompliance. That has a default setting that filters things.

We should upgrade Jetty to benefit from this feature (and other improvements).

Beware: upgrading Jetty is likely not straight-forward, as compatibility changes with older plugins can be expected. An upgrade preferably does not break backwards-compatibility with existing plugin versions. It is probably worth investigating how we tackled this when we last had a major upgrade of Jetty.

This change should only go in the main branch of the private temporary fork of Openfire that is used to address this vulnerability.

Environment

None

Activity

Show:

Guus der Kinderen September 7, 2023 at 2:05 PM

Jetty has been upgraded to the latest release on 10.x

Daniel Jackson June 29, 2023 at 12:09 PM

Jetty 10 to 11 has a major change in the Servlet API from Servlet 4.0 to Servlet 5.0.

This change has some impact on the existing JSPs, however one major blocker has been identified with the sitemesh component, which depends on javax.servlet. Even if this dependency is provided, it is unable to cast/map these components to the modern jakarta.servlet.

When looking for valid alternatives for sitemesh, none were identified which state they support Servlet 5.0/Jakarta namespace, with other alternatives such as being retired.

Jetty 10 is still supported and appears to continue to be for the near future. Jetty 12 will be Servlet API independent , so it may be worth delivering Jetty 10 and waiting until Jetty 12 is released in a Stable version, where we will likely be able to keep our existing Sitemap and servlet version.

However, Jetty 12 will have a minimum JVM requirement of 17, which is potentially a big jump from where we are now, so how long Jetty 10 will be supported is a consideration. The Jetty 10 & 11 announcement post () mentioned the following:

'Enter Jetty 11. Jetty 11 is identical to Jetty 10 except that the javax.* packages now conform to the new jakarta.* namespace. Jetty 10 and 11 will remain in lockstep with each other for releases, meaning all new features or bug fixes in one version will be available in the other.'

‘Jetty 10 will be supported for a number of years to come. We have no plans on releasing it only to drop support for it in 12-18 months.’

However this was back in December 2020 so how many years of support will matter in this case.

Guus der Kinderen May 23, 2023 at 2:22 PM

An incremental upgrade of Jetty is underway. In the git branch that is linked to by JIRA, an upgrade to Jetty 10 is in a ready-ish state. The plan is to upgrade to Jetty 11.

Guus der Kinderen May 11, 2023 at 6:39 PM

For background information I have just found this PR which appears to track the change to deprecate UTF-16 based URL encoding from Jetty.

Fixed

Details

Assignee

Reporter

Fix versions

Priority

Created May 9, 2023 at 2:35 PM
Updated September 22, 2023 at 11:58 AM
Resolved September 7, 2023 at 2:05 PM