AngularJS - Escaping the Expression Sandbox for XSS

Engineering | Rob Winch | January 28, 2016 | ...

UPDATE: This is a summary of XSS without HTML: Client-Side Template Injection with AngularJS. Previously the citation was in the middle of the document and difficult to find. The goal of the summary is to present the exploit and a fix without all the nuances, not to claim the work as my own.

Introduction

AngularJS is a popular JavaScript framework that allows embedding expressions within double curly braces. For example, the expression 1+2={{1+2}} will render as 1+2=3.

This means that if the server echos out user input that contains double curly braces, the user can perform a XSS exploit using…

Java DSL for Spring Integration 1.1.2 is available now

Releases | Artem Bilan | January 28, 2016 | ...

Dear Spring Community,

The Spring Integration Java DSL 1.1.2 has been released and is available now from repo.spring.io and Maven Central.

This maintenance release includes several fixes and 3rd party dependency updates.

Thank you everyone for contribution and any kind of feedback!

We don't have particular plans for version 1.2, because we are looking into the absorption of Java DSL project by the Spring Integration 5.0, where Java 8 is minimal, but feel free to ask us for more features and share any concerns which can be considered to be included in the next maintenance release.

Project Page | JIRA | [Contributions] (https://github.com/spring-projects/spring-integration/blob/master/CONTRIBUTING.md) | StackOverflow (spring-integration

Introducing Spring Cloud Task

Releases | Michael Minella | January 27, 2016 | ...

Today we are pleased to introduce a new project in the Spring portfolio, Spring Cloud Task. Under the umbrella of the Spring Cloud grouping of projects and the sister project of Spring Cloud Stream, Spring Cloud Task aims to bring functionality required to support short lived microservices to Spring Boot based applications. With this blog post, we are releasing our first milestone of the project and are eager for your input and feedback.

The Goals of Spring Cloud Task

In most cases, the modern cloud environment is designed around the execution of processes that are not expected to end (think web applications or stream modules). If they do, it's considered a failure by the platform and they are typically restarted. While many platforms do have some method to execute a process that is expected to end (a batch job for example), the results of that execution are typically not maintained in a consumable way. Yet for mission critical applications, even though they are short lived, they still have the same non-functional requirements long lived processes have.

While this functionality is useful in a cloud environment, the same issues can arise in a traditional deployment model as well. When executing Spring Boot applications via a scheduler like cron, it can be useful to be able to monitor the results of the application after it’s completion.

A Spring Cloud Task takes the approach that a Spring Boot application can have a start and an end and still be production grade. Batch applications are just one example of where short lived processes can be helpful.

Getting Started

In this first release of Spring Cloud Task, we introduce the basics of the configuration mechanisms as well as a repository to record what happens when a task is executed. Those who are familiar with Spring Batch and its job repository should find the general paradigms of Spring Cloud Task familiar.

To get familiar with Spring Cloud Task, the easiest way is to write an application. The documentation walks you through the creation of an initial task and its execution. You can read more about that here.

Where we're going

Tasks will be a new primitive within Spring Cloud Data Flow in the coming releases allowing users to execute virtually any Spring Boot application as a short lived task. This provides the flexibility to run everything from a simple CommandLineRunner to a full batch job in dynamic way, allowing resources to be consumed on demand and returned once complete. The upcoming releases including Spring Cloud Task 1.0 GA which we plan for just before Spring Cloud Data Flow goes 1.0 GA, will be adding features to support that effort.

Tell us what you think!

Spring Cloud Task is a new and exciting project that we feel fills an under served area of enterprise development. However, we want to know what you think. Please let us know via the issues in Github Issues, StackOverflow, or directly on Twitter!

This Week in Spring - January 26th, 2016

Engineering | Josh Long | January 26, 2016 | ...

Welcome to another installation of This Week in Spring! Here we are, already staring at the second month of the year and, boy!, are things getting exciting! I'm about to start hitting the road again and I'd love to talk to you and your organization if you're near any of the following places and events in February:

Anyway, without further ado, let's get into it!

Spring Boot 1.3.2 released

Releases | Phil Webb | January 22, 2016 | ...

Spring Boot 1.3.2 has been released and is available now from repo.spring.io and Maven Central.

This maintenance release includes a number of fixes and 3rd party dependency updates.

If you are upgrading from 1.3.1 there is one potentially breaking change; we now only search for messages.properties (and not messages*.properties) to enable auto-configuration of a message source. If you previously had a message file of the form messages_en.properties and you didn't include a default messages.properties file, you will now need to add one.

Project Page | GitHub | Issues | Documentation

This Week in Spring - January 19th, 2016

Engineering | Josh Long | January 20, 2016 | ...

Welcome to another installment of This Week in Spring! What a week it's been! Last week saw me visit St. Louis to speak to some customers and deliver a talk at a meetup with my pal Mark Heckler

SpringOne2GX 2015 replay: Spring XD today and tomorrow

News | Pieter Humphrey | January 18, 2016 | ...

Recorded at SpringOne2GX 2015 Presenter: Mark Pollack Big Data Track Slides: http://www.slideshare.net/SpringCentral/spring-xd-today-and-tomorrow In this talk we will cover the major new features added to Spring XD since last year as well as upcoming changes for the next major version. Key integrations driven by the Big Data ecosystem at large such as Kafka, Spark, functional programming, integration with Python, and designer/monitoring UIs will be introduced and demonstrated. The next major version of XD will shift to a foundation based on Cloud-Native architectural principles, where each…

SpringOne2GX 2015 replay: Get the Most out of Testing with Spring 4.2

News | Pieter Humphrey | January 18, 2016 | ...

Recorded at SpringOne2GX 2015 Presenters: Sam Brannen & Nicolas Fränkel Core Spring Track Slides: http://www.slideshare.net/SpringCentral/get-the-most-out-of-testing-with-spring-42-53128369

Join Sam Brannen and Nicolas Fränkel to discover what's new in Spring Framework 4.2's testing support and learn tips and best practices for testing modern, Spring-based applications. Sam Brannen is the Spring Test component lead and author of the Spring TestContext Framework, and Nicolas Fränkel is the author of the book "Integration Testing from the Trenches".

In this session, Sam and Nicolas will cover…

Webinar: What's new in Spring Data

News | Pieter Humphrey | January 18, 2016 | ...

Speaker: Oliver Gierke

A year has passed and the Spring Data shipped two release train iterations packed with interesting features. This talk will give a broad overview of the most important introduced in the Fowler and Gosling release trains. We will cover recent additions and improvements in Spring Data Commons - the module that's shared amongst the store specific ones. We'll then delve into the latest and greatest features of individual store modules, like JPA, MongoDB and the community ones as well.

Tuesday, Jan 26th, 2016 3:00PM GMT Register

Tuesday, Jan 26th, 2016 10:00AM PST (San Francisco GMT-08:00) Register

Get the Spring newsletter

Stay connected with the Spring newsletter

Subscribe

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all