Google Web Toolkit

Friday, September 9, 2022

Re: How to remove tabindex=0 from the cell table html

What kind of Cell is this? Can you show part of the code that sets up the table?

Did you set KeyboardSelectionPolicy to DISABLED?

On Friday, September 9, 2022 at 1:48:45 AM UTC+2 nidhi....@gmail.com wrote:

I am working on adding keyboard accessibility to my product. When I am tabbing from a widget say a button, outside of the cell table to the another button that is after the table my tabbing sequence includes the first element on the celltable into the sequence. This element is just a data and can not be edited. Due to the fact that html generated by GWT for cell table that include tabindex= 0 it is added in the tabbing sequence.
<tr __gwt_row="0" __gwt_subrow="0" class="com-jenzabar-jx-ui-widgets-item-grid-JXCellTable-Style-cellTableEvenRow com-jenzabar-jx-ui-widgets-item-grid-JXCellTable-Style-cellTableHoveredRow">
<td class="com-jenzabar-jx-ui-widgets-item-grid-JXCellTable-Style-cellTableCell com-jenzabar-jx-ui-widgets-item-grid-JXCellTable-Style-cellTableEvenRowCell com-jenzabar-jx-ui-widgets-item-grid-JXCellTable-Style-cellTableFirstColumn dataGridCell textLeftAlignment wrapText com-jenzabar-jx-ui-widgets-item-grid-JXCellTable-Style-cellTableHoveredRowCell">
<div style="outline-style:none;" __gwt_cell="cell-gwt-uid-93" tabindex="0">10/06/2021</div>

My question is how to remove this tabindex. I tried setting tabindex to -1 but that does not affect the div tag tabindex value. Any help will be really appreciated. Thank you

--
You received this message because you are subscribed to the Google Groups "GWT Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-web-toolkit+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-web-toolkit/6f0aa62b-f9ad-4420-8088-eee90b79a0c8n%40googlegroups.com.

Thursday, September 8, 2022

How to remove tabindex=0 from the cell table html

I am working on adding keyboard accessibility to my product. When I am tabbing from a widget say a button, outside of the cell table to the another button that is after the table my tabbing sequence includes the first element on the celltable into the sequence. This element is just a data and can not be edited. Due to the fact that html generated by GWT for cell table that include tabindex= 0 it is added in the tabbing sequence.

My question is how to remove this tabindex. I tried setting tabindex to -1 but that does not affect the div tag tabindex value. Any help will be really appreciated. Thank you

--
You received this message because you are subscribed to the Google Groups "GWT Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-web-toolkit+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-web-toolkit/f56d4d93-a632-4d5b-9ed6-07ebcf9edde9n%40googlegroups.com.

Re: GWT 2.10.0 DTD

You're right, GWT Project updates with https now but still I also cannot download it:

https://gwtproject.org/doctype/2.10.0/gwt-module.dtd

But I never use it, or do you really need it?

Sara Youssef schrieb am Donnerstag, 8. September 2022 um 13:25:43 UTC+2:

I can't access GWT 2.10.0 DTD from http://gwtproject.org/doctype/2.10.0/gwt-module.dtd
So is there any reason that DTD isn't uploaded to gwt website till now although the source repository has a version of it or it's uploaded to a different server?

--
You received this message because you are subscribed to the Google Groups "GWT Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-web-toolkit+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-web-toolkit/6b57fb32-cac9-45ee-8cd1-93682ea56fc4n%40googlegroups.com.

Re: Spring dependency-check' is not allowed to appear in element 'bean'

You should separate the Spring project and the GWT project... That's the best way so that you could update each projects with their dependencies as you wish.

Remember GWT projects only need the Jar dependencies in compile / test time. In runtime they are just JavaScript 😀

Here is an example: https://github.com/lofidewanto/stockwatcher/tree/master/stockwatcher-springboot

Hope this helps!

dhia.xd...@gmail.com schrieb am Mittwoch, 10. August 2022 um 15:50:38 UTC+2:

the error is the same as the title

Spring dependency-check' is not allowed to appear in element 'bean'

Le mercredi 10 août 2022 à 15:47:20 UTC+2, iweb Appe a écrit :

I am using a gwt app and when I upgraded spring from 2.X to 5X I get this error when I deploy on jetty

<bean id="demo.sessionFactory"
class = "org.springframework.oring.hibernate5.LocalSessionFactoryBean"
abstract="false" lazy-init="defaullt" autowire="default"
dependency-check="default">
<property name="hibernateProperties">
<ref bean="demo.hibernateProperties"/>
</property>
</bean>

I made sure to change the xsd file version to 2.5 but I still get the error.

--
You received this message because you are subscribed to the Google Groups "GWT Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-web-toolkit+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-web-toolkit/beb405c8-ceb5-4d03-8bac-787b50acfba6n%40googlegroups.com.

GWT 2.10.0 DTD

I can't access GWT 2.10.0 DTD from http://gwtproject.org/doctype/2.10.0/gwt-module.dtd
So is there any reason that DTD isn't uploaded to gwt website till now although the source repository has a version of it or it's uploaded to a different server?

--
You received this message because you are subscribed to the Google Groups "GWT Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-web-toolkit+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-web-toolkit/6963ce2e-4a53-41f5-beed-f316f6af1e03n%40googlegroups.com.

Thursday, September 1, 2022

Re: Security Vulnerabilities with GWT 2.10

On Thursday, September 1, 2022 at 11:57:07 AM UTC+2 priyako...@gmail.com wrote:

Thanks for response.

There is one more CVE has been reported for gwt-dev jar for htmlUnit component. Details of CVE are as below -
CVE - CVE-2022-29546
severity - 7.5
Description - HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption.

Are there any plans to mitigate above vulnerablity?
As we know that gwt-dev.jar is used for development purpose( in our application, we remove gwt-dev.jar post compilation) , still are there any attack surfaces exists?

It depends whether you a) use GWTTestCase b) run them with the HtmlUnit runner c) those tests load external resources not under your control (that could contain the processing instruction triggering the OOME)

--
You received this message because you are subscribed to the Google Groups "GWT Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-web-toolkit+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-web-toolkit/fac4e58a-26cb-49df-a2a0-2f0ec8d87d6dn%40googlegroups.com.

Re: Security Vulnerabilities with GWT 2.10

Thanks for response.

There is one more CVE has been reported for gwt-dev jar for htmlUnit component. Details of CVE are as below -

CVE - CVE-2022-29546

severity - 7.5

Description - HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption.

Are there any plans to mitigate above vulnerablity?

As we know that gwt-dev.jar is used for development purpose( in our application, we remove gwt-dev.jar post compilation) , still are there any attack surfaces exists?

On Saturday, 30 July 2022 at 03:15:45 UTC+5:30 t.br...@gmail.com wrote:

On Friday, July 29, 2022 at 1:27:36 PM UTC+2 priyako...@gmail.com wrote:
Hi All,

Below Security Vulnerabilities in gwt-dev.jar in latest GWT 2.10 release have been reported by Dependency checker tool -

Given above vulnerabilities -
1. Are those security issues addressed in latest 2.10.0 release?
2. If no, is there a plan to include them in any future release say 3.x?
3. As we know that gwt-dev.jar is used for development purpose( in our application, we remove gwt-dev.jar post compilation) , still are there any attack surfaces exists?

IIRC, GSON is used to load sourcemaps when deobfuscating stacktraces (it might also be used for generating source maps at build time, I don't remember) ; sourcemaps are bundled with your application so they can hardly be considered "untrusted data".
James (mime4j) is a transitive dependency of HTMLUnit, used for testing. It's not clear whether the mime4j component of James is vulnerable (I'd say no), but it's only used for unit tests where I'd say you shouldn't load any untrusted data.
Jetty as used in GWT won't do HTTP/2.

So, the only possible attack surface would be untrusted URLs loaded during tests.

--
You received this message because you are subscribed to the Google Groups "GWT Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-web-toolkit+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-web-toolkit/846a98bc-8022-42bc-a5ab-fac3de4ed377n%40googlegroups.com.