apache
diff --git a/‎.gitignore‎
Lines changed: 0 additions & 2 deletions b/‎.gitignore‎
Lines changed: 0 additions & 2 deletions
diff --git a/‎oak-auth-ldap/pom.xml‎
Lines changed: 1 addition & 1 deletion b/‎oak-auth-ldap/pom.xml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎oak-blob-cloud-azure/src/main/java/org/apache/jackrabbit/oak/blob/cloud/azure/blobstorage/AbstractAzureDataStoreService.java‎
Lines changed: 3 additions & 0 deletions b/‎oak-blob-cloud-azure/src/main/java/org/apache/jackrabbit/oak/blob/cloud/azure/blobstorage/AbstractAzureDataStoreService.java‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎oak-blob-cloud-azure/src/main/java/org/apache/jackrabbit/oak/blob/cloud/azure/blobstorage/AzureDataStoreWrapper.java‎
Lines changed: 5 additions & 1 deletion b/‎oak-blob-cloud-azure/src/main/java/org/apache/jackrabbit/oak/blob/cloud/azure/blobstorage/AzureDataStoreWrapper.java‎
Lines changed: 5 additions & 1 deletion
diff --git a/‎oak-doc/src/site/markdown/osgi_config.md‎
Lines changed: 4 additions & 3 deletions b/‎oak-doc/src/site/markdown/osgi_config.md‎
Lines changed: 4 additions & 3 deletions
diff --git a/‎oak-doc/src/site/markdown/plugins/blobstore.md‎
Lines changed: 5 additions & 3 deletions b/‎oak-doc/src/site/markdown/plugins/blobstore.md‎
Lines changed: 5 additions & 3 deletions
diff --git a/‎oak-http/src/main/java/org/apache/jackrabbit/oak/http/AuthorizationField.java‎
Lines changed: 27 additions & 7 deletions b/‎oak-http/src/main/java/org/apache/jackrabbit/oak/http/AuthorizationField.java‎
Lines changed: 27 additions & 7 deletions
diff --git a/‎oak-http/src/test/java/org/apache/jackrabbit/oak/http/AuthorizationFieldTest.java‎
Lines changed: 62 additions & 6 deletions b/‎oak-http/src/test/java/org/apache/jackrabbit/oak/http/AuthorizationFieldTest.java‎
Lines changed: 62 additions & 6 deletions
diff --git a/‎oak-it-osgi/pom.xml‎
Lines changed: 1 addition & 1 deletion b/‎oak-it-osgi/pom.xml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎oak-it/src/test/java/org/apache/jackrabbit/oak/plugins/blob/DocumentBlobTrackerRegistrationTest.java‎
Lines changed: 3 additions & 0 deletions b/‎oak-it/src/test/java/org/apache/jackrabbit/oak/plugins/blob/DocumentBlobTrackerRegistrationTest.java‎
Lines changed: 3 additions & 0 deletions
@@ -12,6 +12,4 @@ atlassian-ide-plugin.xml
 derby.log
 .java-version
 oak-shaded-guava/dependency-reduced-pom.xml
-.DS_Store
-.claude/settings.local.json
 pom.xml.versionsBackup
@@ -94,7 +94,7 @@
         <dependency>
             <groupId>org.apache.mina</groupId>
             <artifactId>mina-core</artifactId>
-            <version>2.1.12</version>
+            <version>2.1.15</version>
         </dependency>
         <dependency>
             <groupId>org.apache.servicemix.bundles</groupId>
 
@@ -33,6 +33,9 @@
 import org.osgi.service.component.ComponentContext;
 
 /**
+ * @deprecated Use {@link AzureDataStoreWrapper} instead.
+ */
+@Deprecated(since = "2.3", forRemoval = true)
  * Kept for binary compatibility with existing callers. Use {@link AzureDataStoreWrapper} instead.
  *
  * @deprecated
 
@@ -78,6 +78,9 @@ public class AzureDataStoreWrapper extends AbstractDataStoreService {
 
     private static final Logger log = LoggerFactory.getLogger(AzureDataStoreWrapper.class);
 
+    // Intentionally set to the legacy v8 PID rather than this class's own FQN.
+    // Existing OSGi configurations reference the v8 PID, so reusing it here means
+    // no config migration is required when switching to this wrapper.
     public static final String NAME = "org.apache.jackrabbit.oak.plugins.blob.datastore.AzureDataStore";
 
     // Same name for now; kept as separate constants so they can diverge if the sources need different keys later.
@@ -189,7 +192,8 @@ protected void setStatisticsProvider(StatisticsProvider statisticsProvider) {
 
     @Override
     protected String[] getDescription() {
-        return new String[]{"type=AzureBlob"};
+        String sdkVersion = (activeImpl instanceof AzureDataStoreV12) ? "v12" : "v8";
+        return new String[]{"type=AzureBlob", "sdkVersion=" + sdkVersion};
     }
 
     // -- Inner DelegatingDataStore (returned from createDataStore) -------
 
@@ -229,8 +229,9 @@ blobTrackSnapshotIntervalInSecs (long) - 0
 deletions will be visible to other cluster nodes or repositories connected to the shared DatStore after this. This 
 should be less than the blobGcMaxAgeInSecs parameter above and the frequency of blob gc. See [Blob 
 tracker][blobtracker].
-A value of `0` (the default since Oak 2.4.0) disables blob ID tracking entirely for the Segment Node Store. To enable tracking,
-set this to a positive value (e.g. `43200` for 12 hours). Note that DocumentNodeStore defaults to `43200`.
+A value of `0` disables blob ID tracking entirely. This has been the default for both SegmentNodeStore and
+DocumentNodeStore since Oak 2.4.0.
+To enable tracking, set this to a positive value (e.g. `43200` for 12 hours).
 
 <a name="document-node-store"></a>
 #### DocumentNodeStore
@@ -262,7 +263,7 @@ docChildrenCachePercentage | 0 (was 3 until 1.5.6) | Percentage of `cache` alloc
 cacheSegmentCount | 16 | The number of segments in the LIRS cache | 1.0.15, 1.2.3, 1.3.0
 cacheStackMoveDistance | 16 | The delay to move entries to the head of the queue in the LIRS cache | 1.0.15, 1.2.3, 1.3.0
 sharedDSRepoId | "" | Custom SharedDataStore repositoryId. Used when custom blobstore configured. Should be unique among the repositories sharing the datastore. | 1.2.11
-blobTrackSnapshotIntervalInSecs | 43200 (12 hrs) | The blob ids cached/tracked locally are synchronized with the DataStore at this interval. Any additions and deletions will be visible to other cluster nodes or repositories connected to the shared DatStore after this. This should be less than the blobGcMaxAgeInSecs parameter above and the frequency of blob gc. See [Blob tracker][blobtracker]. | 1.5.6 
+blobTrackSnapshotIntervalInSecs | 0 | The blob ids cached/tracked locally are synchronized with the DataStore at this interval. Any additions and deletions will be visible to other cluster nodes or repositories connected to the shared DatStore after this. This should be less than the blobGcMaxAgeInSecs parameter above and the frequency of blob gc. A value of `0` disables blob ID tracking (default since Oak 2.4.0). See [Blob tracker][blobtracker]. | 1.5.6 
 updateLimit | 100000 | The number of updates kept in memory until changes are written to a branch in the DocumentStore | 1.7.0  
 leaseCheckMode | STRICT | The lease check mode. `STRICT` is the default and will stop the DocumentNodeStore as soon as the lease expires. `LENIENT` will give the background lease update a chance to renew the lease even when the lease expired. This mode is only recommended for development, e.g. when debugging an application and the lease may expire when the JVM is stopped at a breakpoint. | 1.9.6
 documentStoreType | MONGO | Set to "RDB" for `RDBDocumentStore`; will require a configured Sling DataSource called `oak`. | 1.0
 
@@ -237,9 +237,11 @@ configured NodeStore services.
 **Default behavior by NodeStore:**
 
 * **SegmentNodeStore** (`SegmentNodeStoreService` / `SegmentNodeStoreFactory`): blob ID tracking is **disabled by
-  default** (`blobTrackSnapshotIntervalInSecs = 0`). To enable it, set a positive value such as `43200` (12 hours).
-* **DocumentNodeStore**: blob ID tracking is **enabled by default** with a 12-hour sync interval
-  (`blobTrackSnapshotIntervalInSecs = 43200`).
+  default** (`blobTrackSnapshotIntervalInSecs = 0`, default since Oak 2.4.0). To enable it, set a positive value such as
+  `43200` (12 hours).
+* **DocumentNodeStore**: blob ID tracking is **disabled by default**
+  (`blobTrackSnapshotIntervalInSecs = 0`, default since Oak 2.4.0). To enable it, set a positive value such as `43200`
+  (12 hours).
 
 When tracking is disabled (interval = 0), blob IDs are not cached locally and the warnings described below do
 not apply. The full blob ID list is always retrieved directly from the DataStore during GC.
 
@@ -16,11 +16,12 @@
  */
 package org.apache.jackrabbit.oak.http;
 
-import org.apache.jackrabbit.util.Base64;
-
 import javax.jcr.SimpleCredentials;
 import javax.security.auth.login.LoginException;
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
 import java.util.Enumeration;
+import java.util.Locale;
 import java.util.NoSuchElementException;
 
 public class AuthorizationField {
@@ -44,11 +45,30 @@ public static SimpleCredentials valueOf(Enumeration<String> values) throws Login
         return parseCredentials(field);
     }
 
-    private static SimpleCredentials parseCredentials(String fieldValue) throws LoginException {
-        if (fieldValue.startsWith("Basic ")) {
-            String[] basic =
-                    Base64.decode(fieldValue.substring("Basic ".length())).split(":");
-            return new SimpleCredentials(basic[0], basic[1].toCharArray());
+    private static SimpleCredentials parseCredentials(String rawFieldValue) throws LoginException {
+        boolean hasControls = rawFieldValue.chars().anyMatch(c -> c < ' ');
+        if (hasControls) {
+            throw new LoginException("Control characters are not allowed");
+        }
+
+        String fieldValue = rawFieldValue.trim().replaceAll(" +", " ");
+
+        if (fieldValue.toLowerCase(Locale.ENGLISH).startsWith("basic ")) {
+            String token68 = fieldValue.substring("basic ".length());
+            try {
+                String decoded = new String(Base64.getDecoder().decode(token68), StandardCharsets.UTF_8);
+                int colon = decoded.indexOf(':');
+                if (colon < 0) {
+                    throw new LoginException(
+                            "Malformed Basic credentials: missing ':' separator");
+                }
+                String userId = decoded.substring(0, colon);
+                String password = decoded.substring(colon + 1);
+
+                return new SimpleCredentials(userId, password.toCharArray());
+            } catch (IllegalArgumentException ex) {
+                throw new LoginException(ex.getMessage());
+            }
         } else {
             throw new LoginException("Only Basic Authentication supported");
         }
 
@@ -47,12 +47,10 @@ public void testValid() throws LoginException {
         assertEquals("bar", new String(credentials.getPassword()));
     }
 
-    @Test(expected = ArrayIndexOutOfBoundsException.class) // BUG: OAK-12259
+    @Test(expected = LoginException.class)
     public void testInvalidBase64() throws LoginException {
         String b64 = Base64.getEncoder().encodeToString("foo:bar".getBytes(StandardCharsets.UTF_8));
-        SimpleCredentials credentials = AuthorizationField.valueOf(Collections.enumeration(List.of("Basic dksjdkj" + b64)));
-        assertEquals("foo", credentials.getUserID());
-        assertEquals("bar", new String(credentials.getPassword()));
+        AuthorizationField.valueOf(Collections.enumeration(List.of("Basic dksjdkj" + b64)));
     }
 
     @Test(expected = LoginException.class)
@@ -64,9 +62,67 @@ public void testNoScheme() throws LoginException {
     @Test
     public void testColonInPassword() throws LoginException {
         String b64 = "Basic " + Base64.getEncoder().encodeToString("foo:bar:qux".getBytes(StandardCharsets.UTF_8));
-        SimpleCredentials credentials =AuthorizationField.valueOf(Collections.enumeration(List.of(b64)));
+        SimpleCredentials credentials = AuthorizationField.valueOf(Collections.enumeration(List.of(b64)));
+        assertEquals("foo", credentials.getUserID());
+        assertEquals("bar:qux", new String(credentials.getPassword()));
+    }
+
+    @Test(expected = LoginException.class)
+    public void testMissingColon() throws LoginException {
+        String b64 = "Basic " + Base64.getEncoder().encodeToString("foobarqux".getBytes(StandardCharsets.UTF_8));
+        AuthorizationField.valueOf(Collections.enumeration(List.of(b64)));
+    }
+
+    @Test
+    public void testSchemeCase() throws LoginException {
+        String b64 = Base64.getEncoder().encodeToString("foo:bar".getBytes(StandardCharsets.UTF_8));
+        SimpleCredentials credentials = AuthorizationField.valueOf(Collections.enumeration(List.of("BaSiC " + b64)));
+        assertEquals("foo", credentials.getUserID());
+        assertEquals("bar", new String(credentials.getPassword()));
+    }
+
+    @Test
+    public void testMoreWhitespace() throws LoginException {
+        String b64 = Base64.getEncoder().encodeToString("foo:bar".getBytes(StandardCharsets.UTF_8));
+        SimpleCredentials credentials = AuthorizationField.valueOf(Collections.enumeration(List.of("Basic   " + b64)));
+        assertEquals("foo", credentials.getUserID());
+        assertEquals("bar", new String(credentials.getPassword()));
+    }
+
+    @Test(expected = LoginException.class)
+    public void testNonSpWhitespace() throws LoginException {
+        String b64 = Base64.getEncoder().encodeToString("foo:bar".getBytes(StandardCharsets.UTF_8));
+        AuthorizationField.valueOf(Collections.enumeration(List.of("Basic \t " + b64)));
+    }
+
+    @Test(expected = LoginException.class)
+    public void testBrokenBase64() throws LoginException {
+        String b64 = Base64.getEncoder().encodeToString("foo:bar".getBytes(StandardCharsets.UTF_8));
+        // insert a single SP into the base64 sequence
+        b64 = b64.substring(0,5) + " " + b64.substring(5);
+        AuthorizationField.valueOf(Collections.enumeration(List.of("Basic " + b64)));
+    }
+
+    @Test(expected = LoginException.class)
+    public void testMoreBrokenBase64() throws LoginException {
+        String b64 = Base64.getEncoder().encodeToString("foo:bar".getBytes(StandardCharsets.UTF_8));
+        b64 = b64.substring(0,5) + "=" + b64.substring(5);
+        AuthorizationField.valueOf(Collections.enumeration(List.of("Basic " + b64)));
+    }
+
+    @Test
+    public void testMoreNonAscii() throws LoginException {
+        String b64 = Base64.getEncoder().encodeToString("test:123\u00a3".getBytes(StandardCharsets.UTF_8));
+        SimpleCredentials credentials = AuthorizationField.valueOf(Collections.enumeration(List.of("Basic " + b64)));
+        assertEquals("test", credentials.getUserID());
+        assertEquals("123\u00a3", new String(credentials.getPassword()));
+    }
+
+    @Test
+    public void testBasic64NoPadding() throws LoginException {
+        String b64 = Base64.getEncoder().withoutPadding().encodeToString("foo:bar".getBytes(StandardCharsets.UTF_8));
+        SimpleCredentials credentials = AuthorizationField.valueOf(Collections.enumeration(List.of("Basic " + b64)));
         assertEquals("foo", credentials.getUserID());
-        // BUG: OAK-12259
         assertEquals("bar", new String(credentials.getPassword()));
     }
 }
@@ -198,7 +198,7 @@
     </dependency>
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>elasticsearch</artifactId>
+      <artifactId>testcontainers-elasticsearch</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>
 
@@ -63,6 +63,9 @@ protected void registerNodeStoreService() {
         properties.put("repository.home", repoHome);
         properties.put("mongouri", MongoUtils.URL);
         properties.put("db", MongoUtils.DB);
+        // Explicitly enable blob ID tracking (default is 0/disabled since Oak 2.4.0).
+        // This test verifies tracker reinitialization which requires an active tracker.
+        properties.put("blobTrackSnapshotIntervalInSecs", 3600L);
         MockOsgi.setConfigForPid(context.bundleContext(),
                 DocumentNodeStoreService.class.getName(), properties);
         service = context.registerInjectActivateService(new DocumentNodeStoreService());
Original file line number	Diff line number	Diff line change
`@@ -33,6 +33,9 @@`
`33`	`33`	`import org.osgi.service.component.ComponentContext;`
`34`	`34`
`35`	`35`	`/**`
	`36`	`+ * @deprecated Use {@link AzureDataStoreWrapper} instead.`
	`37`	`+ */`
	`38`	`+@Deprecated(since = "2.3", forRemoval = true)`
`36`	`39`	`* Kept for binary compatibility with existing callers. Use {@link AzureDataStoreWrapper} instead.`
`37`	`40`	`*`
`38`	`41`	`* @deprecated`