The HotReload is super cool :) however I think that generally it would be nice to know which properties has changed so that you can re-configure only the affected services, It can be embedded into the ReloadEvent, or it could be possible have a helper method (like I have in my code now) that is able to do a "diff" in the properties for me.

First, I'd like to say that this is likely more of a problem with gradle than it is owner, but since this is an issue that's likely to crop up for many projects wishing to utilize this lib I thought I'd post it anyway, and perhaps someone else will do some additional digging. So... I'm having problems using owner in a project because it seems not all of the beans get transitively added to the apk that I am building. The setup is of a multi-module type in android studio, because the android and java plugins for gradle don't quite get along, and the owner code resides in a pure java library.

  java.lang.NoClassDefFoundError: java.beans.PropertyEditorManager
        at org.aeonbits.owner.Converters$4.tryConvert(Converters.java:147)
        at org.aeonbits.owner.Converters.doConvert(Converters.java:227)
        at org.aeonbits.owner.Converters.convert(Converters.java:222)
        at org.aeonbits.owner.PropertiesInvocationHandler.resolveProperty(PropertiesInvocationHandler.java:83)
        at org.aeonbits.owner.PropertiesInvocationHandler.invoke(PropertiesInvocationHandler.java:54)
        at $Proxy2.local_server_url(Native Method)
        at se.springworks.api.client.M2HClient.<init>(M2HClient.java:40)
        at se.springworks.apiexample.androidexampleapp.ExampleActivity.onCreate(ExampleActivity.java:18)
        at android.app.Activity.performCreate(Activity.java:5426)
        at android.app.Instrumentation.callActivityOnCreate(Instrumentation.java:1105)
        at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:2269)
        at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:2363)
        at android.app.ActivityThread.access$900(ActivityThread.java:161)
        at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1265)
        at android.os.Handler.dispatchMessage(Handler.java:102)
        at android.os.Looper.loop(Looper.java:157)
        at android.app.ActivityThread.main(ActivityThread.java:5356)
        at java.lang.reflect.Method.invokeNative(Native Method)
        at java.lang.reflect.Method.invoke(Method.java:515)
        at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:1265)
        at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1081)
        at dalvik.system.NativeStart.main(Native Method)

The module that contains owner directly is free from this issue. What are your recommendations?

Also created a Stack Overflow q for this type of problem:

http://stackoverflow.com/questions/22988376/missing-runtime-dependencies-with-owner-gradle-for-android

If you feel this is completely removed from what you're trying to do here, don't hesitate to close the issue. : )

Here is a suggestion for a ByteSizeConverter for what was requested in #155.

I've added this to the owner-extras module as this is not a part of core functionality.

The code should be Java5 compatible and includes a unit test.

I also did a little refactoring by introducing a ConverterUtil class to avoid duplicating code in the DurationConverter and ByteSizeConverter classes. I added that to the owner core module so that both owner-extras and owner-java8 modules would have access to it. That code is Java5 compliant so that should be fine.

Given that a properties file is not nearly as convenient to edit as a YAML or JSON file, support to load configuration in these formats would definitely be a good thing.

In my case, it would make the choice of owner to manage application settings a no-brainer.

Consider the following case:

# config.properties
server.host=http://localhost
server.port=80
qa.server.host=http://example.com

// Config.java
public interface Config extends org.aeonbits.owner.Config {
    @DefaultValue("qa")
    String env();
    String host();
    int port();
}

// Main.java
public static void main(String[] args) {
    Config config = getConfig();
    System.out.println("---> env: " + config.env());
    System.out.println("---> host: " + config.host());
    System.out.println("---> port: " + config.port());
}

Expected:

[java] ---> env: qa
[java] ---> host: http://example.com
[java] ---> port: 80

Actual:

[java] ---> env: qa
[java] ---> host: http://example.com
[java] Exception in thread "main" java.lang.NullPointerException
[java]         at com.sun.proxy.$Proxy6.port(Unknown Source)
[java]         at Main.main(Unknown Source)
[java] Java Result: 1

Java string replace methods don't properly handle backslashes in the replacement string. See http://stackoverflow.com/questions/9575116/forward-slash-in-java-regex

Suggestion as of that SO page is to replace backslash with double backslash ("" with "\") in the replacement string prior to replacing.

I ran into this because user.home on windows machines is something like C:\Users\NiXXeD, and several of the tests failed for me on a clean repo. I updated the affected tests to reproduce the issue prior to making changes.

I noticed that when calling values ​​from different threads, it can returns values ​​from other methods. The wrong method is invoked somehow. Bug reproduced on version 1.0.11 I tried 1.0.8 - 1.0.10 and all ok.

src/test/resources/config.properties

firstName=Pasha
lastName=Bairov

import org.aeonbits.owner.Config;

@Config.Sources({"file:src/test/resources/config.properties"})
public interface MyConfig extends Config {

    @Key("firstName")
    String firstName();

    @Key("lastName")
    String lastName();
}

public static void main(String[] args) {
        MyConfig cfg = ConfigFactory.create(MyConfig.class);


        new Thread(() -> {
            for (int i = 0; i < 1000; i++) {
                String name = cfg.firstName();

                if (!name.equals("Pasha")) {
                    System.out.println("name " + name);
                }
            }
        }).start();

        new Thread(() -> {
            for (int i = 0; i < 1000; i++) {
                cfg.lastName();
            }
        }).start();
    }

I executed it 1000 times and here it stdout:

name Bairov
name Bairov
name Bairov
name Bairov
name Bairov

I can provide any necessary information for debugging.

Hi Luigi,

please have a look on those changes. It adds a new Interface JMXBean (maybe change to according naming pattern) which allows to dynamicly register a config class to a running mbean service (necessary methods added to PropertiesManager).

I was not sure if further checking for Accessible, Mutable and Reloadable is necessary in PropertiesManager (so I guess Mbean now could write on mutable config object).

Maybe take a look at the changes and revise if necessary. I would find a jmx accessibele config very useful. MBeans are accessible in jvm through jconsole.

Thanks for your time!

Regards, Robin

Hi Iviggiano, I'm very interested in your amaizing project OWNER. But now i have a problem with correctly loading properties. I need load properties with czech diacritic (like as áčďéěíňóřšťůúýž) in UTF-8 format. Properties of file names.properties are set on UTF-8 like as my Ecliplse project, but OWNER still load String čďéěíňóřÅ.

Can u help me ?

Thank u very much

Sometimes it may be desirable to determine source location at runtime, and pass them to ConfigFactory explicitly (e.g. if we want to find config files relative to the jar file's directory http://stackoverflow.com/questions/2837263/how-do-i-get-the-directory-that-the-currently-executing-jar-file-is-in).

Owner seems to load all properties from a given source regardless whether these properties are mapped by appropriate interface or not. Especially when using system properties or system environment as source, this behaviour causes a lot of head ache when trying to process the overall set of effective properties using the property traversing methods provided by Accessible interface.

Maybe, my use case is somewhat special as I need to hand over the effective properties for a given configuration to another Java process. As long as my code does not explicitly filter out unwanted properties - such as user.dir, java.vendor.name etc. - I cannot use system properties as source for mapping interface.

Please let me know if you need any further information. And mille grazie for this awesome library!

Hello,

I am the Debian maintainer of owner. In Debian unstable with OpenJDK 17.0.5 and mockito 2.23.0, I get

[ERROR] testListPrintStream(org.aeonbits.owner.PropertiesInvocationHandlerTest) Time elapsed: 0.542 s <<< ERROR! java.lang.NullPointerException: Cannot invoke "java.util.concurrent.ConcurrentHashMap.putAll(java.util.Map)" because "this.map" is null at org.aeonbits.owner.PropertiesInvocationHandlerTest.before(PropertiesInvocationHandlerTest.java:46)

[ERROR] testListPrintWriter(org.aeonbits.owner.PropertiesInvocationHandlerTest) Time elapsed: 0.002 s <<< ERROR! java.lang.NullPointerException: Cannot invoke "java.util.concurrent.ConcurrentHashMap.putAll(java.util.Map)" because "this.map" is null at org.aeonbits.owner.PropertiesInvocationHandlerTest.before(PropertiesInvocationHandlerTest.java:46)

Interestingly, it seems there is an issue with properties in the before method being declared with the @Spy annotation. Indeed, changing slightly the test file to the enclosed one (see lines 31, 32, 46, 47) causes an error on line 46 but not on line 47. PropertiesInvocationHandlerTest.java.txt

Honestly I cannot explain what causes this, but if you can then I am interested in knowing.

Bye, Pierre

Current solution does not allow nesting keys in variable expansion for the ＠Key annnotation. Let us assume the following scenario:

    @Key("environment")
    @DefaultValue("global")
    String env();

    @Key("environments.${environment}.webdriver.url")
    String webDriverUrl();

    @Key("environments.${environment}.browser")
    @DefaultValue("chrome")
    String usedBrowser();

I want to have a property based on the selected browser property which is already based on the selected environment property. I am trying to access the property in the following ways:

    @Key("environments.${environment}.webdriver.${usedBrowser}.switches")
    String webDriverOptions();

    @Key("environments.${environment}.webdriver.${environments.${environment}.browser}.switches")
    String webDriverOptions();

but neither solution is working. This pull request adds ability to nest variable expansion inside @Key annotiation.

Security Vulnerability Fix

This pull request fixes a Temporary File Information Disclosure Vulnerability, which existed in this project.

Preamble

The system temporary directory is shared between all users on most unix-like systems (not MacOS, or Windows). Thus, code interacting with the system temporary directory must be careful about file interactions in this directory, and must ensure that the correct file posix permissions are set.

This PR was generated because a call to File.createTempFile(..) was detected in this repository in a way that makes this project vulnerable to local information disclosure. With the default uname configuration, File.createTempFile(..) creates a file with the permissions -rw-r--r--. This means that any other user on the system can read the contents of this file.

Impact

Information in this file is visible to other local users, allowing a malicious actor co-resident on the same machine to view potentially sensitive files.

Other Examples

• CVE-2020-15250 - junit-team/junit
• CVE-2021-21364 - swagger-api/swagger-codegen
• CVE-2022-24823 - netty/netty
• CVE-2022-24823 - netty/netty

The Fix

The fix has been to convert the logic above to use the following API that was introduced in Java 1.7.

File tmpDir = Files.createTempFile("temp dir").toFile();

The API both creates the file securely, ie. with a random, non-conflicting name, with file permissions that only allow the currently executing user to read or write the contents of this file. By default, Files.createTempFile("temp dir") will create a file with the permissions -rw-------, which only allows the user that created the file to view/write the file contents.

:arrow_right: Vulnerability Disclosure :arrow_left:

:wave: Vulnerability disclosure is a super important part of the vulnerability handling process and should not be skipped! This may be completely new to you, and that's okay, I'm here to assist!

First question, do we need to perform vulnerability disclosure? It depends!

1. Is the vulnerable code only in tests or example code? No disclosure required!
2. Is the vulnerable code in code shipped to your end users? Vulnerability disclosure is probably required!

Vulnerability Disclosure How-To

You have a few options options to perform vulnerability disclosure. However, I'd like to suggest the following 2 options:

1. Request a CVE number from GitHub by creating a repository-level GitHub Security Advisory. This has the advantage that, if you provide sufficient information, GitHub will automatically generate Dependabot alerts for your downstream consumers, resolving this vulnerability more quickly.
2. Reach out to the team at Snyk to assist with CVE issuance. They can be reached at the Snyk's Disclosure Email.

Detecting this and Future Vulnerabilities

This vulnerability was automatically detected by GitHub's CodeQL using this CodeQL Query.

You can automatically detect future vulnerabilities like this by enabling the free (for open-source) GitHub Action.

I'm not an employee of GitHub, I'm simply an open-source security researcher.

Source

This contribution was automatically generated with an OpenRewrite refactoring recipe, which was lovingly hand crafted to bring this security fix to your repository.

The source code that generated this PR can be found here: SecureTempFileCreation

Opting-Out

If you'd like to opt-out of future automated security vulnerability fixes like this, please consider adding a file called .github/GH-ROBOTS.txt to your repository with the line:

User-agent: JLLeitschuh/security-research
Disallow: *

This bot will respect the ROBOTS.txt format for future contributions.

Alternatively, if this project is no longer actively maintained, consider archiving the repository.

CLA Requirements

This section is only relevant if your project requires contributors to sign a Contributor License Agreement (CLA) for external contributions.

It is unlikely that I'll be able to directly sign CLAs. However, all contributed commits are already automatically signed-off.

The meaning of a signoff depends on the project, but it typically certifies that committer has the rights to submit this work under the same license and agrees to a Developer Certificate of Origin (see https://developercertificate.org/ for more information).

- Git Commit Signoff documentation

If signing your organization's CLA is a strict-requirement for merging this contribution, please feel free to close this PR.

Sponsorship & Support

This contribution is sponsored by HUMAN Security Inc. and the new Dan Kaminsky Fellowship, a fellowship created to celebrate Dan's memory and legacy by funding open-source work that makes the world a better (and more secure) place.

This PR was generated by Moderne, a free-for-open source SaaS offering that uses format-preserving AST transformations to fix bugs, standardize code style, apply best practices, migrate library versions, and fix common security vulnerabilities at scale.

Tracking

All PR's generated as part of this fix are tracked here: https://github.com/JLLeitschuh/security-research/issues/18

The section on Type Conversion says "The suffixes supported by ByteSizeConverter are:"...

• kilobyte, kilobytes, k, ki, kib
• kibibyte, kibibytes, kb

which would be clearer if grouped as

• kibibyte, kibibytes, k, ki, kib
• kilobyte, kilobytes, kb

so that all of the options that multiply by 1024 or 1000 would be grouped on separate lines respectively. The same goes for all of the similar larger groupings.

Snyk has created this PR to fix one or more vulnerable packages in the `maven` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • owner-extras/pom.xml

Vulnerabilities that will be fixed

With an upgrade:

Severity | Priority Score (*) | Issue | Upgrade | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:-------------------------|:------------------------- | 486/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.3 | Information Disclosure
SNYK-JAVA-COMGOOGLEGUAVA-1015415 | org.apache.curator:curator-framework:
2.13.0 -> 5.4.0
| Yes | Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.