Fix typo in ClosureException
Fix typo in GDK Specification Documentation
Refactor: minor Code style, qualified import, typed API, more parentheses
code style: asserts
Groovysh: some more default methods to Map completion
GROOVY-6563: groovysh: Patched jline CompletionHandler to allow ANSIfied candidates
GROOVY-6563: groovysh: jansi rendering of reflection completion candidates
- direct class members bold
- navigable Properties magenta
- GroovyDefaultMethods blue
- non-method members sorted to the end of the candidate list
Groovysh: minor fix: allow changing prefix length preference during session

To reproduce:

set meta-completion-prefix-length 1
'x'.fi

should show find...() methods, does not
GROOVY-6622: Groovysh: show static members only in static context
or with sufficient prefix
DDoS hash collision attack as reported by Jesse Wilson

Jesse brings out a good point, and his point might be more applicable
to Groovy. In fact, once I stopped arguing with him I realized that
Groovy impacted a lot more than Boon, and Groovy is widely used and
Boon is not.

Also I think this impacted the old Groovy JSON parser as well but I
could be wrong.

http://publicobject.com/2014/05/11/the-json-benchmarks-are-wrong/

I think Boon might is less vulnerable than Groovy, but I patched it
today as well.

http://rick-hightower.blogspot.com/2014/05/fud-gson-100x-faster-than-jac
kson-and.html

If you are using Boon and Pojos (which is the most common combination
that I have seen for a public API), then this is not an issue with
Boon. Also Boon and Groovy if using JDK 1.7 then there is a special JDK
1.7 flag that prevents this.

Groovy unlike Boon before the patch might and likely still have this
issue even for Pojos.

Boon Pojo support uses the API that knows about the index overlay for
Pojos so that is why this was not an issue with Boon.

It seems Groovy is more vulnerable because it supports JDK 1.6 (Boon
does not) and the Map to Groovy object routines would not know about
the index overlay API, and would not know to avoid the map (which I do
for performance).

You can see an example here on how to access the underlying index
overlay method.

http://rick-hightower.blogspot.com/2014/05/fud-gson-100x-faster-than-jac
kson-and.html

Groovy is impacted in pretty much every public API that uses a map
(rare) or a POJO so 100% of public APIs unless you filter at payload
size with an F5 or scan the JSON stream ahead of time. The same index
overlay API exists (shown in blog) so there is a workaround, but since
it is with both Map and Pojo, I took time off from everything else to
fix this.

This is a quick interim patch. It just works.

With this patch it should not be possible to ever do a hash key
collision attack. This patch checks for Java 1.7 and above and then
checks to see jdk.map.althashing.threshold is set if 1.7. If Java is
below 1.7, then it uses TreeMap, if Java is 1.7 and threshold not set
then this patch uses TreeMap. If Java 1.8, this patch uses
LinkedHashMap. I worked on this now because I realized it was much more
of an issue with Groovy than Boon (as described above), and Groovy is
much more widely used.
making class package protected.
Merge pull request #416 from RichardHightower/master

DDoS hash collision attack as reported by Jesse Wilson
GROOVY-6761 this changes the method finding to ignore generics and instead let the inference engine test the validity of methods. As a result many error messages change
Fix version recognition under custom JDK builds
Fix Gradle idea task
fix generics type issue with @Delegate
Merge pull request #354 from tkruse/groovy6563

Refactorings, GROOVY-6563 and GROOVY-6622
GROOVY-6563 and GROOVY-6622: Add missing license headers
GROOVY-6754 Fix test not terminating in IntelliJ (not sure why it terminates with gradle)
Fix: '::' as command prefix invalid.