JDK
Mule Runtime 3.8.4 Release Notes
March 31, 2017
Security Notification for On-Premises Deployments: A security vulnerability was found in this version of the Mule runtime engine. Error handlers do not escape exceptions generated for 404 and other response codes before adding the exceptions to the HTTP response. If the exception contains executable code, the interpreter will execute the code. If you are using this version of the Mule runtime engine on premises, upgrade to the latest version of Mule 3.8.x or to version 3.9.x. Alternatively, you can migrate to Mule 4. Note that extended support of Mule 3.8.x ends in 2021. |
Mule Runtime 3.8.4 includes API Gateway enhancements, bug fixes, and a library change.
Key enhancements are:
-
Two new block definitions on the policies are defined: After and Before exception blocks.
Similar to the functionality of HTTP after and before blocks, these blocks enhance the catch exception strategy of a flow without the need to modify it.
-
Increased security by upgrading Gatekeeper to v2.0.
The enhancements include cluster support with improved performance, zero security gaps while the feature is in active mode, and small improvements in runtime startup when the feature is in active mode. Several corner cases have been fixed.
-
XML threat protection policy now can protect also against XXe attacks.
-
Various security risks related to policies not being correctly applied in particular scenarios addressed.
-
Performance improvements.
Supported Software
Mule was tested on the following software:
Software | Version |
---|---|
JRE 1.7.0, JRE 1.8.0 (Recommended JRE 1.8.0_91/92) |
|
OS |
MacOS 10.11.4, HP-UX 11i V3, AIX 7.2, Windows 2012 R2 Server, Windows 8.1, Solaris 11.3, RHEL 7, Ubuntu Server 15.04 |
Application Servers |
Tomcat 7 and 8, WebLogic 12c, WebSphere 8, WildFly 8 and 9, Jetty 8 and 9 |
Databases |
Oracle 11g, Oracle 12c, MySQL 5.5+, IBM DB2 10, PostgreSQL 9, Derby 10, Microsoft SQL Server 2014 |
The unified Mule Runtime 3.8.4 and API Gateway is compatible with APIkit 3.8.4.
Bundled Runtime Manager Agent
This version of Mule runtime comes bundled with the Runtime Manager Agent plugin version 1.6.4.
DataWeave Language Improvements
-
Now DataWeave can process input files of any size. Previously the limit was 2GB.
-
Improved CSV performance for small files
-
Added XML writer option to omit header
-
Added another option to specify how missing values are shown with flatfile/copybook output
-
Allow trimming a field as per its definition in flatfile
-
Changes to support another fill character configuration of '0' to zero-fill text numeric values but space-fill alphas in flatfile
-
Added option for truncating output values that are too long for field rather than generating an error in flatfile
DataWeave Language Bug Fixes
-
Fixed temporary files leak when accessing flow vars
-
Fixed output encoding in the message
-
Now XmlStreamReaders are not consumed with the MEL
dw()
function -
Fixed data-weave not picking up the correct properties file with
p()
function -
Coercion from number to string now doesn’t lose precision
-
DW now fully supports ISO-8601 format
-
XML Indexed reader now supports escaped XML characters
Fixed issues
Issue | Description |
---|---|
EE-5313 |
Batch block size cannot be set as a context property |
EE-5308 |
Use of Round Robin with IIS results in invalid session token |
EE-5297 |
WMQ connector doesn’t use endpoint attributes |
EE-5282 |
BatchRecordDispatcherDelegate does not catch RejectedExecutionException |
EE-5250 |
Resuming batchjob that finished all batch steps (send to on complete) |
EE-5195 |
Create new BatchTransactionContextFactory each time the DefaultBatchEngine is started |
EE-5055 |
Batch should auto stop job instances when queues are corrupted |
MULE-11949 |
OAuth: token refresh overrides payload when resending request |
MULE-11918 |
Credentials are shown in generic db connection when an exception is raised |
MULE-11914 |
Email transport does not invoke exception strategy when flow processing strategy is synchronous |
MULE-11891 |
NotPermittedException in http sends status 405 (method not allowed) instead of 403 (forbidden) |
MULE-11879 |
Mule does not recognize zip file as deployment units if extension is not in lowercase |
MULE-11877 |
Wrong description for org.mule.transport.sftp.getLastModifiedTime() |
MULE-11875 |
Race condition when putting an object in the registry asynchronously and disposing the muleContext at the same time |
MULE-11865 |
Sftp endpoints does not preserve session serialized variables |
MULE-11850 |
Paths for processors in dynamically referenced subflows are not recalculated |
MULE-11829 |
VM Receiver process message read from queue and does not process further message till the previous processing has ended |
MULE-11828 |
Wrapper does not log boot error before stopping wrapped JVM in WARN loglevel |
MULE-11766 |
DefaultExtensionManager’s method attemptToCreateImplicitConfigurationInstance should be synchronized |
MULE-11635 |
No reconnection attempt in case of LDAP communication error |
MULE-11598 |
HTTP Listener error responses don’t include content-length nor last chunk |
MULE-11549 |
VM does not manage retrieval and storage of session and loses variables when session is serialized or encoded. |
MULE-11539 |
No content response includes Transfer-Encoding header |
MULE-11535 |
HTTP transport returns 500 instead of 400 when URL isn’t correctly encoded |
MULE-11534 |
XmlMetaDataFieldFactory returns empty field list for element with complexType/any |
MULE-11532 |
JsonTransformerResolver doesn’t reuse transformers when there are more than one |
MULE-11510 |
Nodes coming xpath3 functions output do not work with Xquery-transformer |
MULE-11498 |
SFTP connector uses a period for listing and some implementations don’t support it |
MULE-11497 |
Encoding is ignored account in SFTP endpoint |
MULE-11488 |
XmlToXMLStreamReader does not support ByteArrayOutputStream as source type |
MULE-11479 |
HTTP requester ignores socket properties connect timeout |
MULE-11455 |
JMS connector doesn’t allow subclasses to change send() parameters |
MULE-11382 |
Fix: after until successful flow variables loses mime type |
MULE-11381 |
Bring ASM fix from SPR-13695 into Mule |
MULE-11369 |
Exception behavior for XML vulnerabilities is inconsistent |
MULE-11358 |
Path Element is not correctly created for elements after a MessageFilter |
MULE-11337 |
Listener sends error response when connection is closed |
MULE-11333 |
Fix: In Message Enricher a double copy is made and changes are lost after handling exception |
MULE-11323 |
Fix: A more declarative exception message has to be added to unsupported methods in DefaultMessageCollection |
MULE-11302 |
Default XML Transformer factory does nor support StAXSource |
MULE-11300 |
File outbound ignoring encoding attribute |
MULE-11298 |
Fix: wsconsumer ignores proxy when retrieving wsdl in initialization phase |
MULE-11286 |
Fix: avoid verification of timestamp action matching in request and response of a soap service. |
MULE-11282 |
Fix: QuartzMessageReceiver handles the stop message by default and does not stop current scheduled jobs. |
MULE-11274 |
MVEL optimizer does not refresh when the payload type changes |
MULE-11271 |
Fix: Multiple Quartz connectors register quartz scheduler with the same name. |
MULE-11266 |
Fix: Text file object store does not update persistent file stored record according to expiration policy. |
MULE-11240 |
Apply changes from CXF-7162 (Inconsistent reading of formatted XML when validating schema) |
MULE-11206 |
Prevent possible hash collision attacks in Java 7 |
MULE-11204 |
Memory leak on mule db module on high load scenario when streaming is enabled |
MULE-11147 |
Retry HTTP requests where connection has become stale since obtaining it from connection pool |
MULE-11145 |
Apply Processors to Custom Validators |
MULE-11125 |
XMLInputFactory allows inline DTDs by default |
MULE-11124 |
content-type set in HTTP request builder should not be case sensitive |
MULE-11118 |
Return a 5xx response when thread pool is exhausted instead of ignoring the request |
MULE-10996 |
Content-Length header case conflicts with streaming |
MULE-10995 |
Negative threadWaitTimeout used with SEDA processing strategy fails rather than waiting forever to enqueue. |
MULE-10975 |
AbstractAggregator eventGroups object store ignores the object store configuration in the registry |
MULE-9039 |
NPE when doing multiple http outbound calls. |
MULE-8777 |
HttpMapParam expects multiple values in ParameterMap but ParameterMap only returns one |
MULE-6331 |
Client so_timeout is replaced by responseTimeout |
MULE-11970 |
Update of logs which are indirectly causing a deadlock condition |
MULE-11940 |
Fix: For each collection doesn’t work with iterator. |
MULE-11924 |
After multiform request, Mule Message has an invalid data type. |
MULE-11903 |
Fix: Http requester can’t handle large headers. |
MULE-11869 |
Default Reconnect Strategy is ignored in DB Config. |
MULE-11835 |
RSS parser isn’t parsing elements with namespaces. |
MULE-11665 |
Fix: Memory Leak in Custom Agreggator. |
MULE-11571 |
Add support for the WITH clause in the DB module |
MULE-11416 |
WS Consumer Module: Should use Mule TLS implementation to read the Remote WSDL instead of using the Java classes directly |
MULE-11293 |
Fix: Session property disappearing after dispatchEvent() |
MULE-11281 |
Fix: SFTP Inbound Endpoint doesn’t set the MimeType |
MULE-11273 |
ER: When a null value is passed to a request query param, it should be removed. |
MULE-11203 |
Add Error Message about not supported Asynchronous Retry Policies in DB Connection. |
MULE-11191 |
Fix: FTP reconnect Notifier is not working |
MULE-11185 |
Fix: sftpclient unable to validate duplicate files for relative paths involving ~ symbol |
MULE-11161 |
Update the cipher block used in PGP encryption |
MULE-11159 |
Fix: FileToString Transform is not able to process incoming message payload retrieved from file connector when streaming attribute is set to false. |
MULE-11138 |
Make easier to work with UDT on DB connector |
MULE-11110 |
Fix: fileAge of Connector is replaced by fileAge of endpoint |
MULE-11080 |
Add support to auto convert Strings to CLOB values |
MULE-11079 |
Fix: Set Payload doesn’t work correctly with special characters in a variable value. |
MULE-11022 |
Http Conflicts with Wildcard in the middle of the path. |
MULE-11008 |
Fix: JsonData doesn’t have to implement Serializable |
MULE-10986 |
Fix conflict Similar HTTP Listener Path with Wildcards |
MULE-10979 |
Remove System Properties Configuration |
AGW-1014 |
When trying to track an API and return code is not 200, policies of that API are deleted. |
AGW-982 |
NullPointerException when unapplying policy in cluster with Log4j in DEBUG mode |
AGW-978 |
When invalid proxy settings are provided, policies based on clients, do not work. |
AGW-977 |
When bad organization credentials are provided, policies based on clients, do not work. |
AGW-936 |
Small insecurity window when deploying app with Gatekeeper enabled. |
AGW-920 |
XML Threat Protection Policy does not prevent XXE attack. |
AGW-687 |
PingFederate policy is not using proxy settings by default. |
Library Changes
Issue | Description |
---|---|
MULE-11983 |
Upgrade JSCH to version 0.154 |
MULE-11366 |
Upgrade Mockito version |
MULE-11326 |
Update JUnit to 4.12 and disable timeout when debugging |
MULE-11262 |
Update commons-net to 3.5 |
Migration Guide
Issue | Description |
---|---|
MULE-10979 |
The default response timeout and default transaction timeout can’t be configured using system properties on the command line or in the wrapper.conf file anymore. In replacement, use the configuration element. For example: <configuration defaultResponseTimeout="20000" defaultTransactionTimeout="40000"/>. |
MULE-11118 |
The HTTP listener now replies with status code 503 when the thread pool is exhausted (and poolExhaustedAction="ABORT") instead of closing the socket. |