search

batchu / owasp-esapi-java

Automatically exported from code.google.com/p/owasp-esapi-java
0 stars 0 forks source link

ESAPI 1.4.4 Built with Java 5: Compatibility Issues With Users of JDK 1.4? #105

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago 
The manifest for the ESAPI 1.4.4 jar file indicates that it was built with 
Java 5, but many of the users of ESAPI 1.4.4 will be using Java 1.4.  
Could this cause any compatibility issues?

Original issue reported on code.google.com by mhrye...@standard.com on 3 Feb 2010 at 5:27

GoogleCodeExporter commented 8 years ago 
This is an interesting question. The manifest header is created separately from 
the
compilation of the java classes. Current versions of Maven require java 1.5+ so 
when
it creates the jar it's version is used. 

There are two ways for the sources to be compiled and tested: with a external 
1.4
(see external-1.4-jdk.txt) and the jdk running maven targeting 1.4. The latter 
can
cause compatibility issues with the runtime if (and only if) methods or classes 
from
1.5 are used (eg: Boolean implements Comparable in 1.5 but not 1.4 which bit me
recently). The external jdk method has no such issues.

I know that Jim, who does the builds, is using a external 1.4 jdk as revision 
1132
attests (I had been playing with cobertura which requires 1.5 and had forgotten 
to
switch back to an external jdk. IllegalStateException doesn't provide a 
constructor
with a cause in 1.4 but doesn in 1.5) so the actual released builds use an 
external
1.4. I usually (the above being the exception) run with an external 1.4 jdk as 
well.

So, from the class level there should be no compatibility issues. The question
remains though if anything would have issues with the manifest header itself. I 
am
not aware of anything that would notice this but that doesn't mean that such 
doesn't
exist. Most environments, osgi being the exception, are rather uncaring of what 
is in
the mantifest in general. I know that WAS 6.0 doesn't care.

I'll look into changing the header in the manifest. Technically it is correct, 
the
manifest is built with 1.5. Maybe there is a way to target 1.4 for the manifest
without running a old version of maven under 1.4.

Original comment by schal...@darkmist.net on 8 Feb 2010 at 11:31

GoogleCodeExporter commented 8 years ago 
This is apparently a known issue with maven:

http://jira.codehaus.org/browse/MJAR-62

I tried:

<manifestEntries>
    <Build-Jdk>1.4.2</Build-Jdk>
</manifestEntries>

With no success as well. It is just ignored.

Unless this is actually causing issues I think it may be best to do won't fix 
on this
until the maven bug is resolved. Thoughts?

Original comment by schal...@darkmist.net on 27 Feb 2010 at 1:06

GoogleCodeExporter commented 8 years ago 
No known compatability issues caused by this so closing as WontFix for now. 
Feel free to reopen this or create a new one if this is not the case.

Original comment by schal...@darkmist.net on 9 Sep 2010 at 2:55