org.apache.shiro:shiro-test-coverage

###########################################################

Improvement

[SHIRO-290] Implement bcrypt and argon2 KDF algorithms

Backwards Incompatible Changes

• Changed default DefaultPasswordService.java algorithm to "Argon2id".
• PasswordService.encryptPassword(Object plaintext) will now throw a NullPointerException on null parameter. It was never specified how this method would behave.
• Made salt non-nullable.
• Removed methods in PasswordMatcher.

###########################################################

###########################################################

Bug

[SHIRO-797] - Shiro 1.7.0 is lower than using springboot version 2.0.7 dependency error

###########################################################

###########################################################

Bug

[SHIRO-767] - org.apache.shiro.util.ClassUtil cannot load the array of Primitive DataType when use undertow as web container
[SHIRO-792] - ShiroWebFilterConfiguration seems to conflict with other FilterRegistrationBean

New Feature

[SHIRO-789] - Also add cookie SameSite option to Spring

Improvement

[SHIRO-740] - SslFilter with HTTP Strict Transport Security (HSTS)
[SHIRO-794] - Add system property to enable backslash path normalization
[SHIRO-795] - Disable session path rewriting by default

Task

[SHIRO-793] - deleteMe cookie should use the defined "sameSite"

###########################################################

###########################################################

Bug

[SHIRO-610] - Incorrect filterchainResolver in 1.4.0-RC2
[SHIRO-762] - SecurityUtils.securityManager should be volatile
[SHIRO-766] - ArrayIndexOutOfBoundsException in Base64#decode

New Feature

[SHIRO-788] - Add support for Global Filters

Wish

[SHIRO-780] - NOTICE files of shiro components don't match NOTICE in source code repository

###########################################################

###########################################################

Bug

[SHIRO-530] - INI parser does not properly handled backslashes at end of values
[SHIRO-751] - SimplePrincipalMap and SimplePrincipalCollection throw different exceptions for the same problem
[SHIRO-753] - Regression in URI parsing in Shiro 1.5.2

Dependency upgrade

[SHIRO-754] - Upgrade to Apache Commons Codec 1.14
[SHIRO-755] - Upgrade to Hazelcast 3.12.6
[SHIRO-756] - Upgrade to Spring 5.2.5.RELEASE and Spring boot 2.2.6.RELEASE
[SHIRO-757] - Upgrade to Htmlunit 2.39.0
[SHIRO-758] - Upgrade to Jetty 9.4.27.v20200227
[SHIRO-759] - Upgrade to Karaf 4.2.8

###########################################################

###########################################################

Bug

[SHIRO-747] - FirstSuccessfulStrategy doesn't properly short circuit
[SHIRO-749] - shiro-all jar is missing cache package

Improvement

[SHIRO-748] - Update Commons Configuration to 2.7

###########################################################

###########################################################

Bug

[SHIRO-736] - DefaultCipherInstance is an alias which is not available in every JVM or JCA Provider
[SHIRO-739] - Bean reflection property failed with Enum values
[SHIRO-741] - Matching of / (root) is broken
[SHIRO-742] - fix throw exception when request uri is /

Dependency upgrade

[SHIRO-738] - Upgrade to Spring 5.2.3.RELEASE and Spring boot 2.2.4.RELEASE

###########################################################

###########################################################

Notes: this release require a JRE 8 minimum.

Bug

[SHIRO-458] - Possible leaked timing information from DefaultPasswordService
[SHIRO-469] - Wrong description of JdbcRealm#setPermissionsQuery
[SHIRO-552] - JdbcRealm in SaltStyle.COLUMN assumes that password column is Base64 but salt column is utf8 bytes
[SHIRO-661] - Add check for the principal of subject whether is null
[SHIRO-682] - fix the potential threat when use "uri = uri + '/' " to bypassed shiro protect
[SHIRO-684] - INI parser keeps escape characters in keys and values
[SHIRO-685] - Potential NullPointerException if PermissionResolver return null/empty string
[SHIRO-687] - Additional Servlet Filters are not available to ShiroFilterFactorBean (unless using XML based beans)

New Feature

[SHIRO-694] - Adds BearerToken support
[SHIRO-722] - Add SameSite option to cookies

Improvement

[SHIRO-668] - Catch unexpected errors which can lead to oom
[SHIRO-669] - Included a boolean flag in FirstSuccessfulStrategy to break after first successful authentication
[SHIRO-670] - ByteSource Serializable
[SHIRO-681] - Upgrade to compiler Java 8
[SHIRO-693] - Update plugins
[SHIRO-700] - Minor spring updates
[SHIRO-706] - Switch to Guice4 by default in the build
[SHIRO-709] - Fix Shiro Spring feature
[SHIRO-710] - Update Commons Lang3 + remove older Commons Lang
[SHIRO-711] - Deprecate JavaEnvironment
[SHIRO-712] - Add BasicIniEnvironment
[SHIRO-715] - Remove old JSTL jars
[SHIRO-720] - Update Commons BeanUtils
[SHIRO-724] - Update Jetty, Spring, Spring Boot, Htmlunit dependencies
[SHIRO-726] - Add dynamic import package
[SHIRO-728] - Update Spring Boot to 2.1.10
[SHIRO-729] - Update Quartz
[SHIRO-730] - Updates the default Cipher mode to GCM in AesCipherService
[SHIRO-731] - Use OWasp Java Encoder to escape user supplied content to the logs

Test

[SHIRO-697] - Reduce shiro test logging level to INFO

Task

[SHIRO-690] - Validate JDK11 compatibility
[SHIRO-692] - Upgrade and enforce min build maven version to 3.5.0
[SHIRO-698] - Improve build with maven profile
[SHIRO-734] - Remove Spring-client sample
[SHIRO-735] - Shiro does not support servlet-3.1 void method(@Suspended AsyncResponse)

Dependency upgrade

[SHIRO-688] - Upgrade to commons-cli 1.4
[SHIRO-689] - Upgrade to commons-codec 1.12
[SHIRO-691] - Upgrade to maven-jar-plugin 3.1.1
[SHIRO-695] - Update Hazelcast
[SHIRO-696] - Update Jetty
[SHIRO-699] - Fix maven warning for exec-maven-plugin and upgrade to 1.6.0
[SHIRO-701] - Update logback
[SHIRO-702] - Upgrade to jacoco-maven-plugin 0.8.4
[SHIRO-703] - Update HSQL
[SHIRO-704] - Update Spring, Spring Boot, Hibernate
[SHIRO-705] - Update Easymock + Powermock
[SHIRO-707] - Misc dependency updates
[SHIRO-716] - Upgrade to commons-codec 1.13
[SHIRO-717] - Upgrade to maven-pmd-plugin 3.12.0
[SHIRO-718] - Upgrade to xmlsec 2.1.4
[SHIRO-719] - Upgrade to Karaf 4.2.6

Request

[SHIRO-723] - Provide Minor Shiro Release that includes CVE-2019-10086 Fix

###########################################################

###########################################################

Bug

[SHIRO-721] - RememberMe Padding Oracle Vulnerability

Improvement

[SHIRO-730] - Updates the default Cipher mode to GCM in AesCipherService

###########################################################

###########################################################

Bug

[SHIRO-457] - Login without static VM security manager cause exception in debug
[SHIRO-563] - shiro-aspectj karaf feature can't be installed
[SHIRO-624] - OSGI: commons configuration import should be optional
[SHIRO-626] - Bundle symbolic name conflict
[SHIRO-637] - Refresh cached session in HTTP request after user logs out
[SHIRO-650] - Shiro JAX-RS is not an OSGi bundle
[SHIRO-653] - Spring-boot registers shiro filter only on REQUEST dispatcher
[SHIRO-655] - shiro-core has an undesirable runtime OSGi dependency to spring-beans
[SHIRO-658] - Problems building shiro on openjdk-8 on current debian stable (9.6 "stretch")
[SHIRO-660] - Bug in FirstSuccessfulStrategy
[SHIRO-680] - Duplicate Bundle-SymbolicName for Different Shiro Modules

New Feature

[SHIRO-638] - Update osgi bundle manifest to support Spring 4.x

Improvement

[SHIRO-560] - Shiro-web feature can't be installed in karaf 4.0.4
[SHIRO-652] - Upgrade Shiro Feature to Karaf 4.x
[SHIRO-664] - Upgrade to Apache pom parent 21
[SHIRO-665] - Upgrade to maven-bundle-plugin 4.1.0
[SHIRO-667] - Upgrade to Spring 4.3.22-RELEASE
[SHIRO-672] - Upgrade to jacoco-maven-plugin 0.8.3
[SHIRO-673] - Upgrade to maven-compiler-plugin 3.8.0
[SHIRO-674] - Upgrade to maven-dependency-plugin to 3.1.1
[SHIRO-675] - Upgrade to maven-surefire-plugins 3.0.0-M3
[SHIRO-676] - Upgrade to maven-jar-plugin 3.1.0
[SHIRO-677] - Upgrade to versions-maven-plugin 2.7
[SHIRO-683] - Upgrade to spring-boot 1.5.19.RELEASE

Task

[SHIRO-662] - Constant Name Change in AuthenticationRealm
[SHIRO-663] - Clean up pom parent relative path

Dependency upgrade

[SHIRO-659] - Upgrade to OWASP dependency-check-maven plugin 4.0.0

###########################################################

###########################################################

Bug

[SHIRO-559] - shiro-guice violates the JEE specification
[SHIRO-579] - Permission filter is validating last matched path
[SHIRO-603] - Endless recursion in ShiroSecurityContext.getUserPrincipal()
[SHIRO-605] - ShiroWebModule creates out of order filter chain.
[SHIRO-607] - AuthorizationAttributeSourceAdvisor ignores type-annotations
[SHIRO-608] - Use a ServiceLoader to discover WebEnvironments
[SHIRO-611] - Spring web module does not load correct SessionStorageEvaluator

Improvement

[SHIRO-596] - shiro-tools-hasher needs private salt option
[SHIRO-618] - Spring Boot Web Starter- Autoconfiguration for Realm and ShiroFilterChainDefinition

###########################################################

###########################################################

Bug

[SHIRO-493] - shiro-guice not working with the guice 4.x
[SHIRO-576] - Commons-beanutils dependency is not security compliant
[SHIRO-586] - Can't Search For Groups In Active Directory Without A System User
[SHIRO-587] - Can't Access Groups If userPrincipalName Doesn't Exist
[SHIRO-591] - Basic Auth Filter permissive mode does NOT work
[SHIRO-592] - ModularRealmAuthenticator causes log spam when one realm throws exception
[SHIRO-593] - Allow for IniWebEnvironment subclasses to specify defaults objects to ReflectionBuilder
[SHIRO-594] - Update Hazelcast version to latest supported version (3.7.2)
[SHIRO-595] - Allow for POST only logout requests
[SHIRO-612] - Need to upgrade BeanUtils to avoid vulnerability

New Feature

[SHIRO-501] - Add ability to set system properties in shiro.ini
[SHIRO-589] - Add Servlet 3.x fragment
[SHIRO-590] - Add Spring Boot support / starters

Improvement

[SHIRO-296] - Typo fixes
[SHIRO-301] - Call permissionResolver directly in AuthorizingRealm
[SHIRO-392] - Shiro Extension for JAX-RS
[SHIRO-599] - Fix file encoding warnings during maven build and reporting

###########################################################