Update

Author: lfeigen

.gitignore

@@ -42,3 +42,4 @@ client.log.*
 weblogic-bean-info-harvester/build-*
 run/work
 fortify-output/**
+owasp-output/**

README.md

@@ -22,12 +22,12 @@ The WebLogic Server Remote Console provides an alternative WebLogic Server admin
 ## Differences With the WebLogic Server Administration Console
 If you are already familiar with the WebLogic Server Administration Console deployed as part of your WebLogic domain, you'll notice these key differences in the WebLogic Server Remote Console:
 * The user interface has been completely redesigned to conform to the Oracle Alta UI Design system and the Oracle Redwood theme included with Oracle JET.
-* The configuration and monitoring content is separated into separate pages in the Remote Console. In the WebLogic Server Administration Console, the configuration and runtime information is presented on one page.
+* The configuration and monitoring content is separated into separate pages in the Remote Console. In the WebLogic Server Administration Console, the configuration and runtime information is presented on one page. See [Separation of Configuration and Runtime Data](site/console_uidesign.md#separation).
 * The Change Center is now expressed as a shopping cart.
 * Instead of logging directly into the Administration Console deployed in a WebLogic domain, the Remote Console connects to the Administration Server in a WebLogic domain, with the credentials supplied by the user, using WebLogic REST APIs.
 
 ## Get Started
-The Oracle WebLogic Server Remote Console project repository is located at GitHub-URL. You can download a `console.zip` installer, or build the console from source. In this version, the console consists of the Remote Console JAR file, associated libraries necessary to use the console, and a web application that provides an extension that you can configure in your WebLogic Server domain. The extension provides additional functionality that is not available with the console only. Although installing the extension is optional, we recommend that you install it to get the optimum functionality from the Remote Console.
+You can download a `console.zip` installer, or build the console from source. In this version, the console consists of the Remote Console JAR file, associated libraries necessary to use the console, and a web application that provides an extension that you can configure in your WebLogic Server domain. The extension provides additional functionality that is not available with the console only. Although installing the extension is optional, we recommend that you install it to get the optimum functionality from the Remote Console.
 
 To install the software, simply unzip the `console.zip` installer on a machine that has JDK 11 installed. After unzipping the archive, the console is ready to use. You simply start the console application, enter the console URL in a browser, and provide the Administration credentials and URL for the domain of your choice.
 

common/pom.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!-- Copyright 2020, Oracle Corporation and/or its affiliates.  All rights reserved.
+<!-- Copyright 2020, 2021, Oracle and/or its affiliates.
      Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.  -->
 <project xmlns="http://maven.apache.org/POM/4.0.0"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
@@ -21,6 +21,12 @@
         <dependency>
             <groupId>io.helidon.microprofile.bundles</groupId>
             <artifactId>helidon-microprofile</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.jboss.weld.probe</groupId>
+                    <artifactId>weld-probe-core</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.jaxrs</groupId>

common/src/main/java/weblogic/console/backend/JavaxJsonUtils.java

@@ -76,11 +76,25 @@ private static JsonArray throwableAsMessagesJsonArray(
       list.add(new Message(text, severity));
     }
     if (throwable != null) {
-      String text1 = throwable.getLocalizedMessage();
+      String text1 = getExceptionMessage(throwable);
       if (text1 != null && !text1.equals(text)) {
         list.add(new Message(text1, severity));
       }
     }
     return createMessagesJsonArray(list);
   }
+
+  private static String getExceptionMessage(Throwable t) {
+    if (t == null) {
+      return "";
+    }
+    String message = t.getLocalizedMessage();
+    if (StringUtils.isEmpty(message)) {
+      message = t.toString();
+    }
+    if (StringUtils.isEmpty(message)) {
+      message = t.getClass().getName();
+    }
+    return message;
+  }
 }

common/src/main/java/weblogic/console/backend/filter/CorsFilter.java

@@ -1,4 +1,4 @@
-// Copyright (c) 2020, Oracle Corporation and/or its affiliates.
+// Copyright (c) 2020, 2021, Oracle and/or its affiliates.
 // Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
 
 package weblogic.console.backend.filter;
@@ -16,7 +16,6 @@ public class CorsFilter implements ContainerResponseFilter {
   // From https://www.baeldung.com/cors-in-jax-rs
   @Override
   public void filter(ContainerRequestContext req, ContainerResponseContext res) throws IOException {
-    // TODO: These settings are not for production use!
     List<String> origin = req.getHeaders().get("Origin");
 
     // whitelist localhost:8000 - ojet serve

common/src/main/java/weblogic/console/backend/integration/WebLogicRestRequest.java

@@ -1,4 +1,4 @@
-// Copyright (c) 2020, 2021, Oracle Corporation and/or its affiliates.
+// Copyright (c) 2020, 2021, Oracle and/or its affiliates.
 // Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
 
 package weblogic.console.backend.integration;
@@ -104,7 +104,6 @@ public Builder header(String key, Object value) {
      */
     public Builder asynchronous(boolean asynchronous) {
       // Synchronously wait for 2 seconds if case the operation returns quickly.
-      // TBD - should the wait time be configurable?
       if (asynchronous) {
         return header("Prefer", "wait=2");
       } else {

console-rest-ext/src/main/java/weblogic/console/wls/rest/extension/ChangesFormatter.java

@@ -1,4 +1,4 @@
-// Copyright (c) 2020, Oracle Corporation and/or its affiliates.
+// Copyright (c) 2020, 2021, Oracle and/or its affiliates.
 // Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
 
 package weblogic.console.wls.rest.extension;
@@ -12,7 +12,6 @@
 import org.codehaus.jettison.json.JSONObject;
 import org.glassfish.admin.rest.utils.JsonFilter;
 import weblogic.descriptor.BeanUpdateEvent;
-import weblogic.management.rest.lib.bean.Constants;
 import weblogic.management.rest.lib.bean.utils.AttributeType;
 import weblogic.management.rest.lib.bean.utils.BeanType;
 import weblogic.management.rest.lib.bean.utils.BeanUtils;
@@ -362,7 +361,7 @@ private Object getPropertyValue(InvocationContext ic) throws Exception {
       return ((PropertyType)attrType).getMarshaller().marshal(ic, null, attrType, true);
     }
     if (this.attrType instanceof ReferencedBeanType) {
-      return wrapIfExpandedValues(ic, getIdentity(value));
+      return wrapIfExpandedValuesEnabled(ic, getIdentity(value));
     }
     if (this.attrType instanceof ReferencedBeansType) {
       JSONArray refs = new JSONArray();
@@ -371,7 +370,7 @@ private Object getPropertyValue(InvocationContext ic) throws Exception {
         identity.put("identity", getIdentity(ref));
         refs.put(identity);
       }
-      return wrapIfExpandedValues(ic, refs);
+      return wrapIfExpandedValuesEnabled(ic, refs);
     }
     throw
       new AssertionError(
@@ -486,12 +485,10 @@ private PropertyDescriptor findPropertyDescriptor(String propertyName) throws Ex
   // Converts an unexpanded property value into an expanded value
   // if the client asked for expanded values (including finding
   // out whether the property is set).  Otherwise returns the unexpanded value.
-  private Object wrapIfExpandedValues(InvocationContext ic, Object unwrappedValue) throws Exception {
+  private Object wrapIfExpandedValuesEnabled(InvocationContext ic, Object unwrappedValue) throws Exception {
     if (ic.expandedValues()) {
-      JSONObject wrappedValue = new JSONObject();
-      wrappedValue.put(Constants.PROP_VALUE, unwrappedValue);
-      wrappedValue.put(Constants.PROP_SET, BeanUtils.isBeanPropertySet(ic, this.attrType, true));
-      return wrappedValue;
+      boolean set =  BeanUtils.isBeanPropertySet(ic, this.attrType, true);
+      return ConsoleUtils.createExpandedValue(unwrappedValue, set);
     } else {
       return unwrappedValue;
     }

console-rest-ext/src/main/java/weblogic/console/wls/rest/extension/ChangesResource.java

@@ -1,4 +1,4 @@
-// Copyright (c) 2020, Oracle Corporation and/or its affiliates.
+// Copyright (c) 2020, 2021, Oracle and/or its affiliates.
 // Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
 
 package weblogic.console.wls.rest.extension;
@@ -10,6 +10,12 @@
 
 /**
  * Returns the unactivated (saved and unsaved) changes in the default edit session.
+ *
+ * The remote console uses this endpoint to display the shopping cart contents.
+ *
+ * Since WLS REST api does not have an endpoint for getting the pending changes yet,
+ * the console REST extension adds one.  Long term, this functionality should be
+ * moved into the WLS REST api.
  */
 public class ChangesResource extends CustomSingletonChildResource {
 

console-rest-ext/src/main/java/weblogic/console/wls/rest/extension/ConsoleBackendResource.java

@@ -1,4 +1,4 @@
-// Copyright (c) 2020, Oracle Corporation and/or its affiliates.
+// Copyright (c) 2020, 2021, Oracle and/or its affiliates.
 // Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
 
 package weblogic.console.wls.rest.extension;
@@ -10,11 +10,22 @@
 /**
  * The console backend resource returns information the console backend's
  * Weblogic REST extension.
+ *
+ * Currently the remote console does not call this endpoint.
+ * Longer term, the CBE will use it to check whether the domain has a
+ * compatible version of the console REST extension installed.
+ *
+ * The endpoint is
+ *   management/weblogic/<version>/edit/consoleBackend
+ *
+ * This endpoint is only visible if the client specifies the
+ * enableConsoleRestExtension query parameter.
  */
 public class ConsoleBackendResource extends CustomSingletonChildResource {
 
   private static final String VERSION = "CBE_WLS_REST_EXTENSION_V1";
 
+  // Return the version of the console REST extension.
   @Override
   protected JSONObject getModel(JsonFilter.Scope filter) throws Exception {
     JSONObject item = new JSONObject();

console-rest-ext/src/main/java/weblogic/console/wls/rest/extension/ConsoleChangeManagerResource.java

@@ -8,9 +8,17 @@
 import weblogic.management.rest.lib.bean.resources.CustomSingletonChildResource;
 
 /**
- * The console provides the tree of resources that the console needs
+ * The remote console provides the tree of resources that the console needs
  * for managing weblogic configuration transactions that the WLS REST
  * changeManager tree of resources doesn't provide.
+ *
+ * Long term, this functionality should be moved into the WLS REST api.
+ *
+ * Currently, it just adds one endpoint:
+ *   management/weblogic/<version>/edit/consoleChangeManager/changes
+ *
+ * This endpoint is only visible if the client specifies the
+ * enableConsoleRestExtension query parameter.
  */
 public class ConsoleChangeManagerResource extends CustomSingletonChildResource {