Develop Reference

Spring boot Camel ActiveMQ apache geronimo vulnerability

I'm using Camel in Spring Boot to send messages to an ActiveMQ Artemis queue using camel-jms-starter, artemis-jms-client and camel-jms. The issue is that Jenkins has found vulnerability in nested dependency org.apache.geronimo.specs:geronimo-jms_2.0_spec.
If I exclude it, it will not work.
Is there a way to keep using Camel in Spring Boot to send message in ActiveMQ queue without Apache Geronimo JMS?
These are my Camel dependencies for ActiveMQ:
<dependency>
<groupId>org.apache.camel</groupId>
<artifactId>camel-jms</artifactId>
<version>${camel.version}</version>
</dependency>
<dependency>
<groupId>org.apache.activemq</groupId>
<artifactId>artemis-jms-client</artifactId>
</dependency>
<dependency>
<groupId>org.apache.camel</groupId>
<artifactId>camel-jms-starter</artifactId>
<version>${camel.version}</version>
</dependency>
I do not use any configuration bean because Spring Boot does it automatically via properties
spring.artemis.mode=native
spring.artemis.host=localhost
spring.artemis.port=61616
spring.artemis.user=admin
spring.artemis.password=admin

You can explicitly exclude the Apache Geronimo dependency from artemis-jms-client, e.g.:
<dependency>
<groupId>org.apache.activemq</groupId>
<artifactId>artemis-jms-client</artifactId>
<exclusions>
<exclusion>
<groupId>org.apache.geronimo.specs</groupId>
<artifactId>geronimo-jms_2.0_spec</artifactId>
</exclusion>
</exclusions>
</dependency>
Then you can add a dependency on the Eclipse JMS API implementation, e.g.:
<dependency>
<groupId>jakarta.jms</groupId>
<artifactId>jakarta.jms-api</artifactId>
<version>2.0.3</version>
</dependency>
That said, it is very strange that the Apache Geronimo JMS API would be flagged with a vulnerability since it is just an API. In other words, it's just Java interface and empty class definitions.

Issue with deployment on Wildfly 17.0.1.Final

I want to deploy an ear file that consists of submodules over wildfly 17.0.1.final.
The code gets deployed on wildfly 10.1.0.final properly but gives issue over wildfly 17.0.1.final.
I tried both with standalone.xml as well as standalone-full.xml.
While using standalone.xml for deployment,I get following error on deployment console:-
Service service jboss.ejb.default-resource-adapter-name-service not found
And when I use standalone-full.xml on deployment console,I get following error:-
{"WFLYCTL0062: Composite operation failed and was rolled back. Steps that failed:" => {"Operation step-2" => {"WFLYCTL0080: Failed services" => {"jboss.depl
oyment.subunit.\"MyEarFile.ear\".\"EAR-AllVersion1.0.war\".POST_MODULE" => "WFLYSRV0153: Failed to process phase POST_MODULE of subdeployment \"EAR-AllVersion1.0.war
\" of deployment \"MyEarFile.ear\"
Caused by: java.lang.NoSuchMethodError: org.hibernate.validator.internal.util.logging.LoggerFactory.make()Lorg/hibernate/validator/internal/util/logging/Log;","jbo
ss.deployment.subunit.\"MyEarFile.ear\".\"EARmobile-AllVersion1.0.war\".POST_MODULE" => "WFLYSRV0153: Failed to process phase POST_MODULE of subdeployment \"EARm
obile-AllVersion1.0.war\" of deployment \"MyEarFile.ear\"
Caused by: java.lang.NoSuchMethodError: org.hibernate.validator.internal.util.logging.LoggerFactory.make()Lorg/hibernate/validator/internal/util/logging/Log;"},"WF
LYCTL0412: Required services that are not installed:" => ["jboss.naming.context.java.comp.MyEarFile.\"EjbDbfinder-AllVersion1.0\".ChangeBasicDataBaseData","jboss.namin
g.context.java.comp.MyEarFile.\"EjbDbfinder-AllVersion1.0\".MessegeConsumer",........
..
..
..
..]"]}}}
I am not getting how to resolve it.I tried removing sl4j dependency from pom but still it didn't work.I am using eclipse ide for this and just installed jboss tool for wildfly as other jboss tools were not getting installed.
So please let me know how I need to upgrade this to deploy the code and make it running.Please let me know If I need to to specify any more details for this.
Following is the Hibernate Dependency I am using :-
In DB module:-
<dependency>
<groupId>org.hibernate.javax.persistence</groupId>
<artifactId>hibernate-jpa-2.1-api</artifactId>
<version>1.0.0.Final</version>
</dependency>
<dependency>
<groupId>org.hibernate</groupId>
<artifactId>hibernate-entitymanager</artifactId>
<version>4.0.1.Final</version>
</dependency>
<dependency>
<groupId>org.hibernate</groupId>
<artifactId> hibernate-core</artifactId>
<version>4.0.1.Final</version>
</dependency>
<dependency>
<groupId>org.hibernate</groupId>
<artifactId>hibernate-ehcache</artifactId>
<version>4.0.1.Final</version>
</dependency>
<!--In other Module:--->
<dependency>
<groupId>org.hibernate</groupId>
<artifactId>hibernate-entitymanager</artifactId>
<version>3.5.1-Final</version>
<scope>compile</scope>
</dependency>
Any help would be apreciable.

I got the solution.This is how I achieved the goal:-
<dependency>
<groupId>org.hibernate</groupId>
<artifactId>hibernate-ehcache</artifactId>
<version>5.4.2.Final</version>
<exclusions>
<exclusion>
<groupId>org.jboss.logging</groupId>
<artifactId>jboss-logging</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.hibernate</groupId>
<artifactId>hibernate-validator</artifactId>
<version>6.0.16.Final</version>
</dependency>
<dependency>
<groupId>org.jboss.logging</groupId>
<artifactId>jboss-logging</artifactId>
<version>3.4.0.Final</version>
</dependency>
<dependency>
<groupId>org.wildfly</groupId>
<artifactId>wildfly-weld</artifactId>
<version>17.0.1.Final</version>
</dependency>
Excluding jboss-logging from hibernate-ehcache,changing the wildfly dependencyand including hibernate-validation dependency resolved my problem.

How to bypass default aries jndi lookup in karaf

I am trying to lookup for a connectionFactory in a code which is deployed as part of osgi bundle in servicemix (karaf)
final Hashtable<String, Object> jndiContext = new Hashtable<String, Object>();
jndiContext.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory");
jndiContext.put(Context.SECURITY_AUTHENTICATION, "none");
jndiContext.put(Context.PROVIDER_URL, pJndiLDAPserver);
ctx = new InitialContext(jndiContext);
ConnectionFactory lResult = (ConnectionFactory) ctx.lookup(pJndiCFname);
The issue I am facing is -
when I do a ctx.lookup("xyz") - It gives me a object of javax.naming.Reference instead of MQconnectionFactory. (The same code works perfectly fine as standalone java application)
Also, ctx = new InitialContext(jndiContext) gives me an object of InitialContext with defaultInitContext as -
org.apache.aries.jndi.DelegateContext. Ideally it should give me defaultInitiContext as LdapCtx (as my provider url is a Ldap server)
I have the following dependency in my pom.xml -
<dependency>
<groupId>javax.jms</groupId>
<artifactId>javax.jms-api</artifactId>
<version>2.0</version>
</dependency>
<dependency>
<groupId>com.ibm.mq.osgi</groupId>
<artifactId>java</artifactId>
<version>9.0.0.0</version>
</dependency>
<dependency>
<groupId>com.ibm.msg.client.osgi.jms</groupId>
<artifactId>prereq</artifactId>
<version>9.0.0.0</version>
</dependency>
<dependency>
<groupId>com.ibm.msg.client.osgi</groupId>
<artifactId>jms</artifactId>
<version>9.0.0.0</version>
</dependency>
<dependency>
<groupId>com.ibm.msg.client.osgi.commonservices</groupId>
<artifactId>j2se</artifactId>
<version>9.0.0.0</version>
</dependency>
<dependency>
<groupId>com.ibm.mq.osgi</groupId>
<artifactId>allclient</artifactId>
<version>9.0.0.0</version>
</dependency>
<dependency>
<groupId>com.ibm.mq.osgi</groupId>
<artifactId>allclientprereqs</artifactId>
<version>9.0.0.0</version>
</dependency>
<dependency>
<groupId>com.ibm.msg.client.osgi</groupId>
<artifactId>nls</artifactId>
<version>9.0.0.0</version>
</dependency>
<dependency>
<groupId>com.ibm.msg.client.osgi.wmq</groupId>
<artifactId>nls</artifactId>
<version>9.0.0.0</version>
</dependency>
<dependency>
<groupId>com.ibm.msg.client.osgi.wmq</groupId>
<artifactId>prereq</artifactId>
<version>9.0.0.0</version>
</dependency>
<dependency>
<groupId>com.ibm.msg.client.osgi</groupId>
<artifactId>wmq</artifactId>
<version>9.0.0.0</version>
</dependency>
<dependency>
<groupId>com.csg.npms.pilatus</groupId>
<artifactId>pilatus-common</artifactId>
<version>0.1-SNAPSHOT</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.ops4j.pax.logging</groupId>
<artifactId>pax-logging-api</artifactId>
<version>1.8.5</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.osgi</groupId>
<artifactId>org.osgi.core</artifactId>
<version>4.3.1</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>javax.ws.rs</groupId>
<artifactId>javax.ws.rs-api</artifactId>
<version>2.0-m09</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.1.4</version>
<scope>provided</scope>
</dependency>
and the same com.ibm dependency has been installed as part of karaf bundles.
So, therefore w.r.t abouve point 2, how can I bypass default jndi aries lookup in Karaf (org.apache.aries.jndi.DelegateContext), so that it gives me LdapContextFactory Object instead of DelegateContext. Am I missing any jars as part of mq in karaf.

This is the key part of the error:
Unresolved requirements: [[org.apache.qpid.jms.client [464](R 464.8)] osgi.wiring.package; (&(osgi.wiring.package=javax.jms (version>=1.1.0)(!(version>=2.0.0)))
This says that the bundle named org.apache.qpid.jms.client cannot be resolved because it imports the package javax.jms but there is no other bundle that exports the package javax.jms. In OSGi, every import must be matched by an export of that package. Additionally there is a version constraint: you need version [1.1.0, 2.0.0), i.e at least 1.1.0 but less than 2.0.0.
I would suggest using the following bundle from Maven Central: https://search.maven.org/#artifactdetails%7Corg.jboss.spec.javax.jms%7Cjboss-jms-api_1.1_spec%7C1.0.1.Final%7Cjar.

While I don't know how to bypass default jndi look up in karaf , something I myself am struggling with at the moment, trying to figure out how to get it to use an initial context factory that i need , i was able to get a MQ connection factory working by instantiating it directly via a bean in a blueprint, then you can name it and reference it from jndi as a normal service , like this:
<bean id="wmqcf" class="com.ibm.mq.jms.MQQueueConnectionFactory">
<property name="hostname" value="my.host">
...port, channel, queue manager, etc ...
</bean>
<service interface="javax.jms.ConnectionFactory" ref="wmqcf">
<service-properties>
<entry key="osgi.jndi.service.name" value="jms/wmqcf">
</service-properties>
</srevice>
This way you don't need to worry about any bridges, pools, etc. Just a quick way to get a connection factory in your application for wmq.

Migrating application from RestEasy to Jersey

I am working on migrating an application from RestEasy implemenation to Jersey Implementation. The main problem I am facing is in the jars required for the CDI part.
While using resteasy, we are using the following 3 resteasy related jars
<dependency>
<groupId>org.jboss.resteasy</groupId>
<artifactId>resteasy-cdi</artifactId>
<version>3.0.8-FINAL</version>
</dependency>
<dependency>
<groupId>org.jboss.resteasy</groupId>
<artifactId>resteasy-jaxrs</artifactId>
<version>3.0.8-FINAL</version>
</dependency>
<dependency>
<groupId>org.jboss.resteasy</groupId>
<artifactId>resteasy-servlet-initializer</artifactId>
<version>3.0.8-FINAL</version>
</dependency>
Now, to migrate it to Jersey, I am using the following jars in place of the resteasy jars.
<dependency>
<groupId>org.glassfish.jersey.containers</groupId>
<artifactId>jersey-container-servlet</artifactId>
<version>2.22.1</version>
</dependency>
<dependency>
<groupId>org.glassfish.jersey.ext.cdi</groupId>
<artifactId>jersey-cdi1x-servlet</artifactId>
<version>2.22.1</version>
</dependency>
<dependency>
<groupId>javax.enterprise</groupId>
<artifactId>cdi-api</artifactId>
<version>1.1</version>
</dependency>
Now when I try to deploy the EAR on the JBOSS server, I get the following error.
15:04:48,156 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-5) MSC000001: Failed to start service jboss.deployment.subunit."abc-ear.ear"."xyz-service-impl.war".POST_MODULE: org.jboss.msc.service.StartException in service jboss.deployment.subunit."abc-ear.ear"."xyz-service-impl.war".POST_MODULE: JBAS018733: Failed to process phase POST_MODULE of subdeployment "xyz-service-impl.war" of deployment "abc-ear.ear"
at org.jboss.as.server.deployment.DeploymentUnitPhaseService.start(DeploymentUnitPhaseService.java:166) [jboss-as-server-7.4.0.Final-redhat-19.jar:7.4.0.Final-redhat-19]
at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1980) [jboss-msc-1.1.5.Final-redhat-1.jar:1.1.5.Final-redhat-1]
at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1913) [jboss-msc-1.1.5.Final-redhat-1.jar:1.1.5.Final-redhat-1]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) [rt.jar:1.7.0_45]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) [rt.jar:1.7.0_45]
at java.lang.Thread.run(Thread.java:744) [rt.jar:1.7.0_45]
Caused by: org.jboss.as.server.deployment.DeploymentUnitProcessingException: JBAS016053: Service class org.glassfish.jersey.ext.cdi1x.internal.CdiComponentProvider didn't implement the javax.enterprise.inject.spi.Extension interface
at org.jboss.as.weld.deployment.WeldPortableExtensions.tryRegisterExtension(WeldPortableExtensions.java:48)
at org.jboss.as.weld.deployment.processors.WeldPortableExtensionProcessor.loadAttachments(WeldPortableExtensionProcessor.java:119)
at org.jboss.as.weld.deployment.processors.WeldPortableExtensionProcessor.deploy(WeldPortableExtensionProcessor.java:79)
at org.jboss.as.server.deployment.DeploymentUnitPhaseService.start(DeploymentUnitPhaseService.java:159) [jboss-as-server-7.4.0.Final-redhat-19.jar:7.4.0.Final-redhat-19]
... 5 more
As you can see from stack trace, the error that I am getting is org.glassfish.jersey.ext.cdi1x.internal.CdiComponentProvider didn't implement the javax.enterprise.inject.spi.Extension interface
I downloaded the source of the required jar to see if the class in question implements that interface or not. Well, it does implement the Extension interface.
Right now I am not able find a solution for this error.
I have tried various permutation and combination of different jersey jars but couldn't find a fix for this.
I have ran out of ideas. Any help would be really appreciated.

Recently I've done quite similar migration (RESTEasy 3.0.8.Final -> Jersey 2.23.1), but my migration also included the abandonment of the WildFly server. So it's quite big difference.
You haven't included any information about used Weld version, so please do it as this is very important here.
Anyway, two tips from my side before you'll update your question:
There is a big chance that your error is caused by the EAR deployment. Because CDI and EAR archives sometimes don't play well together. Can you check what happen if you change your packaging to *.war?
If you don't have a very, very good reason to migrate to a non-built-in JAX-RS implementation when still using Java EE app server and CDI, please don't do it. It's a tough task.
Ps. JFYI amount of problems with Weld and App servers which I've encountered pushed me to abandon them wherever I can.
UPDATE
You said you are using Weld 1.1.23.FINAL - this is very important information. Jersey + Weld integration changed heavily since Jersey 2.15. Personally, I wasn't able to make it work without some newer Weld version (2.3.5 in my case) - probably because this combination isn't supported.
In your case, as you're using extremely old Weld version, I would advice you to try at most Jersey 2.14.
In Jersey 2.14, needed dependencies were different. Please remove jersey-cdi1x-servlet and try this instead:
<dependency>
<groupId>org.glassfish.jersey.containers.glassfish</groupId>
<artifactId>jersey-gf-cdi</artifactId>
<version>2.14</version>
</dependency>
<dependency>
<groupId>org.glassfish.jersey.containers.glassfish</groupId>
<artifactId>jersey-gf-cdi-ban-custom-hk2-binding</artifactId>
<version>2.14</version>
</dependency>
<!-- is it needed for you?
<dependency>
<groupId>org.jboss.weld.servlet</groupId>
<artifactId>weld-servlet-core</artifactId>
</dependency>
-->
BTW: may I know why you are changing JAX-RS implementation inside JBoss?

I have migrated to latest versions last month and this works for me.
try this.
<properties>
<version.jersey>2.23.2</version.jersey>
<version.glassfish>2.4.0</version.glassfish>
</properties>
<dependencies>
<dependency>
<groupId>org.glassfish.hk2.external</groupId>
<artifactId>asm-all-repackaged</artifactId>
<version>${version.glassfish}</version>
</dependency>
<dependency>
<artifactId>hk2-utils</artifactId>
<groupId>org.glassfish.hk2</groupId>
<version>${version.glassfish}</version>
<exclusions>
<exclusion>
<artifactId>javax.inject</artifactId>
<groupId>javax.inject</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>javax.annotation</groupId>
<artifactId>javax.annotation-api</artifactId>
<version>1.2</version>
</dependency>
<dependency>
<groupId>javax.ws.rs</groupId>
<artifactId>javax.ws.rs-api</artifactId>
<version>2.0.1</version>
</dependency>
<dependency>
<groupId>javax.xml.bind</groupId>
<artifactId>jaxb-api</artifactId>
<version>2.2.12</version>
</dependency>
<dependency>
<groupId>org.glassfish.jersey.core</groupId>
<artifactId>jersey-common</artifactId>
<version>${version.jersey}</version>
<exclusions>
<exclusion>
<groupId>org.glassfish.hk2</groupId>
<artifactId>osgi-resource-locator</artifactId>
</exclusion>
<exclusion>
<groupId>org.glassfish.hk2.external</groupId>
<artifactId>aopalliance-repackaged</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.glassfish.jersey.containers</groupId>
<artifactId>jersey-container-servlet</artifactId>
<version>${version.jersey}</version>
</dependency>
<dependency>
<groupId>org.glassfish.jersey.media</groupId>
<artifactId>jersey-media-multipart</artifactId>
<version>${version.jersey}</version>
</dependency>
</dependencies>

You might be using wrong dependancies. Check this:
https://jersey.java.net/documentation/latest/modules-and-dependencies.html

Spring Web Services 2.2.5 in Jboss 5.1.0 GA

I'm having some problem while running a Spring WS quick start example in Jboss 5.1.GA.
When I'm trying to deploy a jar, with my web service, I get this error:
DEPLOYMENTS IN ERROR:
Deployment "vfszip:/.../.metadata/.plugins/org.jboss.ide.eclipse.as.core/JBoss_5.1_Runtime_Server/deploy/SpringWS.jar/" is in error due to the following reason(s): java.lang.IllegalStateException: Factory$org.jboss.aspects.remoting.InvokeRemoteInterceptor is already installed.
I'm using Maven2 and these dependencies:
<dependency>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
<version>${log4j.version}</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-ws</artifactId>
<version>1.3.0.RELEASE</version>
</dependency>
<dependency>
<groupId>wsdl4j</groupId>
<artifactId>wsdl4j</artifactId>
<version>1.6.1</version>
</dependency>
I think, there is a conflict of jars in JBossand spring-boot-starter-ws's dependencies.
Can jboss 5.1 deploy spring WS projects? Can any body help me?