{"action":"created","issue":{"url":"https://api.github.com/repos/snowplow/snowplow/issues/3875","repository_url":"https://api.github.com/repos/snowplow/snowplow","labels_url":"https://api.github.com/repos/snowplow/snowplow/issues/3875/labels{/name}","comments_url":"https://api.github.com/repos/snowplow/snowplow/issues/3875/comments","events_url":"https://api.github.com/repos/snowplow/snowplow/issues/3875/events","html_url":"https://github.com/snowplow/snowplow/issues/3875","id":352180694,"node_id":"MDU6SXNzdWUzNTIxODA2OTQ=","number":3875,"title":"Clojure Collector: update CORS configuration","user":{"login":"BenFradet","id":1737211,"node_id":"MDQ6VXNlcjE3MzcyMTE=","avatar_url":"https://avatars2.githubusercontent.com/u/1737211?v=4","gravatar_id":"","url":"https://api.github.com/users/BenFradet","html_url":"https://github.com/BenFradet","followers_url":"https://api.github.com/users/BenFradet/followers","following_url":"https://api.github.com/users/BenFradet/following{/other_user}","gists_url":"https://api.github.com/users/BenFradet/gists{/gist_id}","starred_url":"https://api.github.com/users/BenFradet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BenFradet/subscriptions","organizations_url":"https://api.github.com/users/BenFradet/orgs","repos_url":"https://api.github.com/users/BenFradet/repos","events_url":"https://api.github.com/users/BenFradet/events{/privacy}","received_events_url":"https://api.github.com/users/BenFradet/received_events","type":"User","site_admin":false},"labels":[{"id":564014,"node_id":"MDU6TGFiZWw1NjQwMTQ=","url":"https://api.github.com/repos/snowplow/snowplow/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"open","locked":false,"assignee":{"login":"BenFradet","id":1737211,"node_id":"MDQ6VXNlcjE3MzcyMTE=","avatar_url":"https://avatars2.githubusercontent.com/u/1737211?v=4","gravatar_id":"","url":"https://api.github.com/users/BenFradet","html_url":"https://github.com/BenFradet","followers_url":"https://api.github.com/users/BenFradet/followers","following_url":"https://api.github.com/users/BenFradet/following{/other_user}","gists_url":"https://api.github.com/users/BenFradet/gists{/gist_id}","starred_url":"https://api.github.com/users/BenFradet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BenFradet/subscriptions","organizations_url":"https://api.github.com/users/BenFradet/orgs","repos_url":"https://api.github.com/users/BenFradet/repos","events_url":"https://api.github.com/users/BenFradet/events{/privacy}","received_events_url":"https://api.github.com/users/BenFradet/received_events","type":"User","site_admin":false},"assignees":[{"login":"BenFradet","id":1737211,"node_id":"MDQ6VXNlcjE3MzcyMTE=","avatar_url":"https://avatars2.githubusercontent.com/u/1737211?v=4","gravatar_id":"","url":"https://api.github.com/users/BenFradet","html_url":"https://github.com/BenFradet","followers_url":"https://api.github.com/users/BenFradet/followers","following_url":"https://api.github.com/users/BenFradet/following{/other_user}","gists_url":"https://api.github.com/users/BenFradet/gists{/gist_id}","starred_url":"https://api.github.com/users/BenFradet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BenFradet/subscriptions","organizations_url":"https://api.github.com/users/BenFradet/orgs","repos_url":"https://api.github.com/users/BenFradet/repos","events_url":"https://api.github.com/users/BenFradet/events{/privacy}","received_events_url":"https://api.github.com/users/BenFradet/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/snowplow/snowplow/milestones/154","html_url":"https://github.com/snowplow/snowplow/milestone/154","labels_url":"https://api.github.com/repos/snowplow/snowplow/milestones/154/labels","id":3056983,"node_id":"MDk6TWlsZXN0b25lMzA1Njk4Mw==","number":154,"title":"SCE/SE modernization","description":"","creator":{"login":"BenFradet","id":1737211,"node_id":"MDQ6VXNlcjE3MzcyMTE=","avatar_url":"https://avatars2.githubusercontent.com/u/1737211?v=4","gravatar_id":"","url":"https://api.github.com/users/BenFradet","html_url":"https://github.com/BenFradet","followers_url":"https://api.github.com/users/BenFradet/followers","following_url":"https://api.github.com/users/BenFradet/following{/other_user}","gists_url":"https://api.github.com/users/BenFradet/gists{/gist_id}","starred_url":"https://api.github.com/users/BenFradet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BenFradet/subscriptions","organizations_url":"https://api.github.com/users/BenFradet/orgs","repos_url":"https://api.github.com/users/BenFradet/repos","events_url":"https://api.github.com/users/BenFradet/events{/privacy}","received_events_url":"https://api.github.com/users/BenFradet/received_events","type":"User","site_admin":false},"open_issues":9,"closed_issues":1,"state":"open","created_at":"2018-01-23T10:18:36Z","updated_at":"2018-08-20T15:15:37Z","due_on":null,"closed_at":null},"comments":2,"created_at":"2018-08-20T15:15:36Z","updated_at":"2018-08-20T15:49:39Z","closed_at":null,"author_association":"MEMBER","body":"Tomcat 8.0.53 changed their default CORS configuration, from [CVE-2018-8014](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8014):\r\n\r\n>The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.\r\n\r\nWe might want to replicate the approach taken in the ssc:\r\n\r\nhttps://github.com/snowplow/snowplow/blob/7ea7feb7a3b7634cd20641c4484171124c0da7f5/2-collectors/scala-stream-collector/core/src/main/scala/com.snowplowanalytics.snowplow.collectors.scalastream/CollectorService.scala#L133-L139\r\n\r\ninstead of relying on a configuration file:\r\n\r\nhttps://github.com/snowplow/snowplow/blob/7ea7feb7a3b7634cd20641c4484171124c0da7f5/2-collectors/clojure-collector/java-servlet/war-resources/.ebextensions/web.xml#L393-L400\r\n\r\ncc @jbeemster "},"comment":{"url":"https://api.github.com/repos/snowplow/snowplow/issues/comments/414366148","html_url":"https://github.com/snowplow/snowplow/issues/3875#issuecomment-414366148","issue_url":"https://api.github.com/repos/snowplow/snowplow/issues/3875","id":414366148,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNDM2NjE0OA==","user":{"login":"jbeemster","id":7984544,"node_id":"MDQ6VXNlcjc5ODQ1NDQ=","avatar_url":"https://avatars1.githubusercontent.com/u/7984544?v=4","gravatar_id":"","url":"https://api.github.com/users/jbeemster","html_url":"https://github.com/jbeemster","followers_url":"https://api.github.com/users/jbeemster/followers","following_url":"https://api.github.com/users/jbeemster/following{/other_user}","gists_url":"https://api.github.com/users/jbeemster/gists{/gist_id}","starred_url":"https://api.github.com/users/jbeemster/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbeemster/subscriptions","organizations_url":"https://api.github.com/users/jbeemster/orgs","repos_url":"https://api.github.com/users/jbeemster/repos","events_url":"https://api.github.com/users/jbeemster/events{/privacy}","received_events_url":"https://api.github.com/users/jbeemster/received_events","type":"User","site_admin":false},"created_at":"2018-08-20T15:49:39Z","updated_at":"2018-08-20T15:49:39Z","author_association":"MEMBER","body":"Fundamentally no one can use the `Java 8 with Tomcat 8 version 3.0.2` machine image.  Image 3.0.1 and lower are all fine."}}
{"actor":{"display_login":"jbeemster"}}