CVE-2016-1000027

@@ -33,7 +33,6 @@
 import org.springframework.beans.factory.DisposableBean;
 import org.springframework.beans.factory.FactoryBean;
 import org.springframework.beans.factory.InitializingBean;
-import org.springframework.lang.UsesSunHttpServer;
 
 /**
  * {@link org.springframework.beans.factory.FactoryBean} that creates a simple
@@ -51,8 +50,10 @@
  * @since 2.5.1
  * @see #setPort
  * @see #setContexts
+ * @deprecated as of Spring Framework 5.1, in favor of embedded Tomcat/Jetty/Undertow
  */
-@UsesSunHttpServer
+@Deprecated
+@org.springframework.lang.UsesSunHttpServer
 public class SimpleHttpServerFactoryBean implements FactoryBean<HttpServer>, InitializingBean, DisposableBean {
 
 	protected final Log logger = LogFactory.getLog(getClass());

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2014 the original author or authors.
+ * Copyright 2002-2018 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -28,7 +28,9 @@
  *
  * @author Stephane Nicoll
  * @since 4.1
+ * @deprecated as of 5.1, along with Spring's Sun HTTP Server support classes
  */
+@Deprecated
 @Retention(RetentionPolicy.CLASS)
 @Target({ElementType.METHOD, ElementType.CONSTRUCTOR, ElementType.TYPE})
 @Documented

@@ -53,7 +53,6 @@
  * @since 2.5.1
  * @see #invoke(java.io.InputStream, java.io.OutputStream)
  * @see HessianServiceExporter
- * @see SimpleHessianServiceExporter
  */
 public class HessianExporter extends RemoteExporter implements InitializingBean {
 

@@ -29,9 +29,6 @@
  * Servlet-API-based HTTP request handler that exports the specified service bean
  * as Hessian service endpoint, accessible via a Hessian proxy.
  *
- * <p><b>Note:</b> Spring also provides an alternative version of this exporter,
- * for Sun's JRE 1.6 HTTP server: {@link SimpleHessianServiceExporter}.
- *
  * <p>Hessian is a slim, binary RPC protocol.
  * For information on Hessian, see the
  * <a href="http://www.caucho.com/hessian">Hessian website</a>.

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2014 the original author or authors.
+ * Copyright 2002-2018 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,7 +22,6 @@
 import com.sun.net.httpserver.HttpExchange;
 import com.sun.net.httpserver.HttpHandler;
 
-import org.springframework.lang.UsesSunHttpServer;
 import org.springframework.util.FileCopyUtils;
 
 /**
@@ -43,9 +42,10 @@
  * @since 2.5.1
  * @see org.springframework.remoting.caucho.HessianClientInterceptor
  * @see org.springframework.remoting.caucho.HessianProxyFactoryBean
- * @see org.springframework.remoting.httpinvoker.SimpleHttpInvokerServiceExporter
+ * @deprecated as of Spring Framework 5.1, in favor of {@link HessianServiceExporter}
  */
-@UsesSunHttpServer
+@Deprecated
+@org.springframework.lang.UsesSunHttpServer
 public class SimpleHessianServiceExporter extends HessianExporter implements HttpHandler {
 
 	/**

@@ -36,9 +36,6 @@
  * Servlet-API-based HTTP request handler that exports the specified service bean
  * as HTTP invoker service endpoint, accessible via an HTTP invoker proxy.
  *
- * <p><b>Note:</b> Spring also provides an alternative version of this exporter,
- * for Sun's JRE 1.6 HTTP server: {@link SimpleHttpInvokerServiceExporter}.
- *
  * <p>Deserializes remote invocation objects and serializes remote invocation
  * result objects. Uses Java serialization just like RMI, but provides the
  * same ease of setup as Caucho's HTTP-based Hessian protocol.

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2017 the original author or authors.
+ * Copyright 2002-2018 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -25,7 +25,6 @@
 import com.sun.net.httpserver.HttpExchange;
 import com.sun.net.httpserver.HttpHandler;
 
-import org.springframework.lang.UsesSunHttpServer;
 import org.springframework.remoting.rmi.RemoteInvocationSerializingExporter;
 import org.springframework.remoting.support.RemoteInvocation;
 import org.springframework.remoting.support.RemoteInvocationResult;
@@ -55,9 +54,10 @@
  * @since 2.5.1
  * @see org.springframework.remoting.httpinvoker.HttpInvokerClientInterceptor
  * @see org.springframework.remoting.httpinvoker.HttpInvokerProxyFactoryBean
- * @see org.springframework.remoting.caucho.SimpleHessianServiceExporter
+ * @deprecated as of Spring Framework 5.1, in favor of {@link HttpInvokerServiceExporter}
  */
-@UsesSunHttpServer
+@Deprecated
+@org.springframework.lang.UsesSunHttpServer
 public class SimpleHttpInvokerServiceExporter extends RemoteInvocationSerializingExporter implements HttpHandler {
 
 	/**

@@ -48,7 +48,6 @@
  * @see javax.jws.WebService
  * @see javax.xml.ws.Endpoint
  * @see SimpleJaxWsServiceExporter
- * @see SimpleHttpServerJaxWsServiceExporter
  */
 public abstract class AbstractJaxWsServiceExporter implements BeanFactoryAware, InitializingBean, DisposableBean {
 

@@ -30,7 +30,6 @@
 import org.apache.commons.logging.LogFactory;
 
 import org.springframework.lang.Nullable;
-import org.springframework.lang.UsesSunHttpServer;
 import org.springframework.util.Assert;
 
 /**
@@ -49,8 +48,10 @@
  * @see javax.jws.WebService
  * @see javax.xml.ws.Endpoint#publish(Object)
  * @see SimpleJaxWsServiceExporter
+ * @deprecated as of Spring Framework 5.1, in favor of {@link SimpleJaxWsServiceExporter}
  */
-@UsesSunHttpServer
+@Deprecated
+@org.springframework.lang.UsesSunHttpServer
 public class SimpleHttpServerJaxWsServiceExporter extends AbstractJaxWsServiceExporter {
 
 	protected final Log logger = LogFactory.getLog(getClass());

@@ -30,17 +30,12 @@
  *
  * <p>Note that this exporter will only work if the JAX-WS runtime actually
  * supports publishing with an address argument, i.e. if the JAX-WS runtime
- * ships an internal HTTP server. This is the case with the JAX-WS runtime
- * that's included in Sun's JDK 6 but not with the standalone JAX-WS 2.1 RI.
- *
- * <p>For explicit configuration of JAX-WS endpoints with Sun's JDK 6
- * HTTP server, consider using {@link SimpleHttpServerJaxWsServiceExporter}!
+ * ships an internal HTTP server.
  *
  * @author Juergen Hoeller
  * @since 2.5
  * @see javax.jws.WebService
  * @see javax.xml.ws.Endpoint#publish(String)
- * @see SimpleHttpServerJaxWsServiceExporter
  */
 public class SimpleJaxWsServiceExporter extends AbstractJaxWsServiceExporter {
 

@@ -442,31 +442,6 @@ servlet name matching the bean name of the target exporter:
 	</servlet-mapping>
 ----
 
-If you are running outside of a servlet container and are using Oracle's Java 6, then you
-can use the built-in HTTP server implementation. You can configure the
-`SimpleHttpServerFactoryBean` together with a `SimpleHttpInvokerServiceExporter` as is
-shown in this example:
-
-[source,xml,indent=0]
-[subs="verbatim,quotes"]
-----
-	<bean name="accountExporter"
-			class="org.springframework.remoting.httpinvoker.SimpleHttpInvokerServiceExporter">
-		<property name="service" ref="accountService"/>
-		<property name="serviceInterface" value="example.AccountService"/>
-	</bean>
-
-	<bean id="httpServer"
-			class="org.springframework.remoting.support.SimpleHttpServerFactoryBean">
-		<property name="contexts">
-			<util:map>
-				<entry key="/remoting/AccountService" value-ref="accountExporter"/>
-			</util:map>
-		</property>
-		<property name="port" value="8080"/>
-	</bean>
-----
-
 
 [[remoting-httpinvoker-client]]
 ==== Linking in the service at the client

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2009 the original author or authors.
+ * Copyright 2002-2016 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -36,6 +36,11 @@
  * expense of being tied to Java. Nevertheless, it is as easy to set up as
  * Hessian and Burlap, which is its main advantage compared to RMI.
  *
+ * <p><b>WARNING: Be aware of vulnerabilities due to unsafe Java deserialization:
+ * Manipulated input streams could lead to unwanted code execution on the server
+ * during the deserialization step. As a consequence, do not expose HTTP invoker
+ * endpoints to untrusted clients but rather just between your own services.</b>
+ *
  * @author Juergen Hoeller
  * @since 1.1
  * @see #setServiceInterface

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2010 the original author or authors.
+ * Copyright 2002-2016 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -47,6 +47,11 @@
  * expense of being tied to Java. Nevertheless, it is as easy to set up as
  * Hessian and Burlap, which is its main advantage compared to RMI.
  *
+ * <p><b>WARNING: Be aware of vulnerabilities due to unsafe Java deserialization:
+ * Manipulated input streams could lead to unwanted code execution on the server
+ * during the deserialization step. As a consequence, do not expose HTTP invoker
+ * endpoints to untrusted clients but rather just between your own services.</b>
+ *
  * @author Juergen Hoeller
  * @since 1.1
  * @see HttpInvokerClientInterceptor