Java rest api by achmelo · Pull Request #1063 · zowe/zowex

achmelo · 2026-07-07T10:35:42Z

What It Does
Spring REST API for zowex that integrates with API ML.

How to Test

Review Checklist
I certify that I have:

tested my changes
added/updated automated tests
updated the changelog
followed the contribution guidelines

Additional Comments

Signed-off-by: ac892247 <a.chmelo@gmail.com>

Signed-off-by: Richard Salac <richard.salac@broadcom.com>

Signed-off-by: ac892247 <a.chmelo@gmail.com>

Signed-off-by: Richard Salac <richard.salac@broadcom.com>

Signed-off-by: ac892247 <a.chmelo@gmail.com>

Signed-off-by: Richard Salac <richard.salac@broadcom.com>

# Conflicts: # native/java/app/src/main/java/org/zowe/zowex/ffm/ZjbBindings.java # native/java/app/src/main/java/org/zowe/zowex/ffm/ZusfBindings.java

Signed-off-by: ac892247 <a.chmelo@gmail.com>

…ndler Signed-off-by: ac892247 <a.chmelo@gmail.com>

Signed-off-by: ac892247 <a.chmelo@gmail.com>

# Conflicts: # .gitignore

Signed-off-by: ac892247 <a.chmelo@gmail.com>

traeok

Thanks for all your work on this @achmelo! This looks great and I'm looking forward to seeing this in the project. I left some suggestions and requested changes regarding the non-freed password block.

traeok · 2026-07-08T19:55:21Z

+{
+    int rc = EINVAL;
+    char *platformUser = jstring_to_ebcdic(env, user);
+    char *platformPassword = jstring_to_ebcdic(env, password);


This variable is allocated but only platformUser and platformApplId are passed to free_if_not_null. Does this mean that every login leaks an un-scrubbed copy of the user's plaintext password? If so, could we scrub it and then free it?

For example:

if (platformPassword != NULL) { size_t len = strlen(platformPassword); memset(platformPassword, 0, len); // scrub before free free(platformPassword); }

traeok · 2026-07-08T19:58:23Z

+#define THLIAPPLIDLEN 0x052
+#define THLIAPPLID 0x070
+
+int lastErrno2 = 0;


This is a process-level global and not thread-local. Couldn't two concurrent requests race on this variable? See comment below about Java_org_zowe_zowex_zos_security_jni_Secur_createSecurityEnvironment

traeok · 2026-07-08T19:59:00Z

+    }
+    free_if_not_null(platformUser);
+    free_if_not_null(platformApplId);
+    return rc;


We could pack rc and errno2 into a single jlong to avoid the process-level global. We could defer this to a future PR if this requires out-of-scope changes.

traeok · 2026-07-08T20:03:49Z

+    memset(thliApplid, ' ', 8);
+    origApplid[8] = 0;
+    memcpy(origApplid, thliApplid, 8);
+    memcpy(thliApplid, applid, applidLength);


Should we check the length against the SAF THLI field's actual size? Otherwise, copying data w/ a length greater than the THLI field may corrupt adjacent memory or crash the JVM.

For example:

char *applid = jstring_to_ebcdic(env, jApplid); if (applid == NULL) { return -1; // conversion failed } const int applidLength = strlen(applid); if (applidLength > 8) { free_if_not_null(applid); return -1; // reject anything that won't fit the THLI field }

traeok · 2026-07-08T20:05:35Z

+@Tag(name = "Security")
+@RestController
+@RequestMapping("/api/v1/securityTest")
+public class SecurityContextController {


Correct me if I'm missing something, but is it true that any authenticated caller could use this controller to query whether any user has a given SAF access level to a specific resource?

For context, the class comment says "Troubleshooting only" , but there's no @Profile or admin-only guard, suggesting it could be reached by any authenticated caller in production.

traeok · 2026-07-08T20:07:27Z

+                }
+            }
+            // Free memory
+            ZdsCApi.zds_c_free_list_response(responsePtr);


If any of the readString calls fail in the above loop, the native block is never freed and it jumps straight to the catch on lines 77-80. Should we add a small helper to guarantee cleanup regardless of the outcome?

This same pattern occurs in other functions within this file, hence the suggestion for the helper.

traeok · 2026-07-08T20:09:20Z

+            return null;
+        }
+        // Reinterpret the segment to maximum size so getString can find the null terminator
+        return segment.reinterpret(Long.MAX_VALUE).getString(0);


Not opposed to using Long.MAX_VALUE, but is there a smaller and more reasonable upper bound for string read?

The Long.MAX_VALUE may allow for an unbounded memory scan, or possible segmentation fault into unmapped pages of memory.

Signed-off-by: ac892247 <a.chmelo@gmail.com>

achmelo · 2026-07-15T12:36:42Z

Thanks for all your work on this @achmelo! This looks great and I'm looking forward to seeing this in the project. I left some suggestions and requested changes regarding the non-freed password block.

Thanks @traeok for the review. I tried to address all your comments, could you please take a look?

Requested changes were implemented, taking another look

traeok · 2026-07-20T15:21:47Z

I see two critical CodeQL issues flagged around use of strcpy and possible unbounded writes.
Can you please address these? The other warnings are lower in severity, but I think those two are valid.

CBforZ · 2026-07-21T12:33:42Z

Could we add a readme for building & running the Java server please? I assume it involves the gradle tasks, but would be nice to have a guide checked in for the basics

traeok

Plan to test extensively & will likely approve once the critical CodeQL issues are addressed.

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: achmelo <37397715+achmelo@users.noreply.github.com>

traeok

Thanks for addressing the CodeQL issues.
Echoing @CBforZ suggestion: can you add a Markdown file with information on how to set up and use the Java REST API?

Also, some steps in How to Test would be greatly appreciated - sorry, I'm a bit of a newb when it comes to Java + z/OS - but it would also benefit other folks that are reviewing 😋

traeok · 2026-08-11T13:24:16Z

Hi @achmelo, I was wondering if you had a chance to review/address the latest round of feedback? Primarily around the readme + documentation for how to get the server set up 🙂 thanks!

Signed-off-by: ac892247 <a.chmelo@gmail.com>

achmelo · 2026-08-12T15:07:44Z

Hi @achmelo, I was wondering if you had a chance to review/address the latest round of feedback? Primarily around the readme + documentation for how to get the server set up 🙂 thanks!

sorry for late response, I was occupied with another work. I have added readme with details that I remember. Hope I didn't miss anything. Please, let me know if something doesn't work.

traeok · 2026-08-12T15:09:10Z

Hi @achmelo, I was wondering if you had a chance to review/address the latest round of feedback? Primarily around the readme + documentation for how to get the server set up 🙂 thanks!

sorry for late response, I was occupied with another work. I have added readme with details that I remember. Hope I didn't miss anything. Please, let me know if something doesn't work.

no worries @achmelo , thanks for the updates! I'll take a look

CBforZ · 2026-08-17T16:25:37Z

+        std::string jobid_str = jobid ? jobid : "";
+        a2e_inplace(jobid_str);
+
+        int rc = zjb_read_jobs_output_by_key(&zjb, jobid_str, key, out_response);


Was renamed to zjb_read_job_content_by_key , needs that update to compile after updating from the main branch

Signed-off-by: CBforZ <chris.boehm@broadcom.com>

Signed-off-by: Fernando Rijo Cedeno <37381190+zFernand0@users.noreply.github.com>

sonarqubecloud · 2026-09-03T18:50:52Z

Quality Gate failed

Failed conditions
C Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

traeok

Thanks @achmelo! Changes LGTM

achmelo and others added 27 commits April 30, 2026 14:22

new spring boot app with rest api to wrap native libs

91f45e8

Signed-off-by: ac892247 <a.chmelo@gmail.com>

working PoC

62facb4

Signed-off-by: ac892247 <a.chmelo@gmail.com>

apidoc

44f71d8

Signed-off-by: ac892247 <a.chmelo@gmail.com>

add rest wrapper for missing methods

ece7977

Signed-off-by: ac892247 <a.chmelo@gmail.com>

add spring security with zaas client

0aafe3f

Signed-off-by: ac892247 <a.chmelo@gmail.com>

return status code from zaasclient

fc88c4c

Signed-off-by: ac892247 <a.chmelo@gmail.com>

for client errors, return 401

07df910

Signed-off-by: ac892247 <a.chmelo@gmail.com>

add finaly block

5fae323

Signed-off-by: ac892247 <a.chmelo@gmail.com>

Merge remote-tracking branch 'origin/main' into java-rest-api

50b00d0

login user with basic auth

9522e8d

Signed-off-by: ac892247 <a.chmelo@gmail.com>

wip: platform security from legacy zowe sdk

09f9f85

Signed-off-by: Richard Salac <richard.salac@broadcom.com>

JDK25 jaas for z/os

6668779

Signed-off-by: Richard Salac <richard.salac@broadcom.com>

use jextract generated bidings

b4836f6

Signed-off-by: ac892247 <a.chmelo@gmail.com>

Merge remote-tracking branch 'origin/java-rest-api' into java-rest-api

20c3c6c

read uss files with security

2ca5e08

Signed-off-by: Richard Salac <richard.salac@broadcom.com>

add security native code

a92fe21

Signed-off-by: Richard Salac <richard.salac@broadcom.com>

remaining bindings

1383cc7

Signed-off-by: ac892247 <a.chmelo@gmail.com>

Merge remote-tracking branch 'origin/java-rest-api' into java-rest-api

c5a9772

load native libs

944e867

Signed-off-by: ac892247 <a.chmelo@gmail.com>

security enforced via aspect for all ff methods

b0cc7b6

Signed-off-by: Richard Salac <richard.salac@broadcom.com>

Merge remote-tracking branch 'origin/java-rest-api' into java-rest-api

b169690

# Conflicts: # native/java/app/src/main/java/org/zowe/zowex/ffm/ZjbBindings.java # native/java/app/src/main/java/org/zowe/zowex/ffm/ZusfBindings.java

missing parameter

791c66f

Signed-off-by: ac892247 <a.chmelo@gmail.com>

set program controlled attr, use java 8 for secur build, exception ha…

68a3f1b

…ndler Signed-off-by: ac892247 <a.chmelo@gmail.com>

remove unused variables

b4fe266

Signed-off-by: ac892247 <a.chmelo@gmail.com>

add unit tests

117fe6d

Signed-off-by: ac892247 <a.chmelo@gmail.com>

Merge remote-tracking branch 'origin/main' into java-rest-api

564bd23

# Conflicts: # .gitignore

build java with single command

b32fb7b

Signed-off-by: ac892247 <a.chmelo@gmail.com>

github-project-automation Bot added this to Zowe CLI Squad Jul 7, 2026

github-project-automation Bot moved this to New Issues in Zowe CLI Squad Jul 7, 2026

Merge branch 'main' into java-rest-api

29ee4c5

traeok previously requested changes Jul 8, 2026

View reviewed changes

zFernand0 self-requested a review July 13, 2026 15:02

achmelo added 2 commits July 15, 2026 14:35

address code review

6255f18

Signed-off-by: ac892247 <a.chmelo@gmail.com>

Merge remote-tracking branch 'origin/java-rest-api' into java-rest-api

b2eb3df

traeok self-requested a review July 15, 2026 13:13

Merge branch 'main' into java-rest-api

a3ccbc9

traeok reviewed Jul 23, 2026

View reviewed changes

achmelo and others added 3 commits July 24, 2026 11:34

Potential fix for pull request finding 'CodeQL / Unbounded write'

eeb6d70

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: achmelo <37397715+achmelo@users.noreply.github.com>

Potential fix for pull request finding 'CodeQL / Unbounded write'

daad484

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: achmelo <37397715+achmelo@users.noreply.github.com>

Potential fix for pull request finding 'CodeQL / Guarded Free'

75be059

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: achmelo <37397715+achmelo@users.noreply.github.com>

JTonda requested a review from traeok July 27, 2026 15:02

traeok reviewed Jul 27, 2026

View reviewed changes

docs

40cba61

Signed-off-by: ac892247 <a.chmelo@gmail.com>

JTonda requested a review from traeok August 12, 2026 15:09

CBforZ self-requested a review August 12, 2026 15:10

Merge branch 'main' of github.com:zowe/zowex into java-rest-api

a64f47e

CBforZ reviewed Aug 17, 2026

View reviewed changes

fix renamed function call

932e3fc

Signed-off-by: CBforZ <chris.boehm@broadcom.com>

CBforZ changed the base branch from main to staging/java-rest-api September 1, 2026 14:16

CBforZ approved these changes Sep 2, 2026

View reviewed changes

chore: update license headers

418e209

Signed-off-by: Fernando Rijo Cedeno <37381190+zFernand0@users.noreply.github.com>

traeok approved these changes Sep 4, 2026

View reviewed changes

Uh oh!

Conversation

achmelo commented Jul 7, 2026

Uh oh!

traeok left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

achmelo commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

traeok commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CBforZ commented Jul 21, 2026

Uh oh!

traeok left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

traeok left a comment

Choose a reason for hiding this comment

Uh oh!

traeok commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

achmelo commented Aug 12, 2026

Uh oh!

traeok commented Aug 12, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Sep 3, 2026

Quality Gate failed

Uh oh!

traeok left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

achmelo commented Jul 15, 2026 •

edited

Loading

traeok commented Jul 20, 2026 •

edited

Loading

traeok left a comment •

edited

Loading

traeok commented Aug 11, 2026 •

edited

Loading