Usage of Whitelist Tool (Oracle JCS_SX)

JCS_SX provides tool called "Whitelist" tool to validate your deployment files like war or ear in order to find out dis allowed packages.

This is very useful when you are working with JCS_SX. Before the actual deployment you can validate your war or ear file for dis allowed packages.

Steps:

1. download the JCS_SX cloud SDK from cloud developer download section and extract it. Below is the screen shot of the contents of SDK

Under the lib folder you can find whitelist.jar and you have to navigate to this directory to run whitelist command

I have copied contents from official oracle document which is self explainatory

The Whitelist Tool Command

Run the Whitelist by issuing this command:

./whitelist [-argument ...] [-help] [file1 file2 dir1 dir2 ...]

For example:

./whitelist -log /home/log/newlog.log /home/apps/myapp.war 

The valid arguments are:

Argument	Description	Default	Shortcut
log	The path to the log file to which the scan result will be written.		l
grid	The true/false flag that indicates if the error listing should be rendered in a grid. Ensure that your console window is wide enough so that the grid does not wrap.	false	g
gridwidth	The maximum width of the grid. You can use this value if you want to limit the width of the grid display (for instance, when you have a smaller display). Note: If you specify a smaller width, the grid might not fit within the width. This is applicable when grid is true.	100	gw
includesummary	A true/false flag that, when set to true, causes a summary report to be printed.	false	is
showall	A true/false flag that, when set to true, displays all the warning and errors from a trusted third party API. If you are trying to deploy an application that uses APIs from trusted third parties, it is recommended that you set this flag to true.	false	sa

Using the Whitelist Tool

In this example, we’ll test the file benefits.war, which is on the local file system in the D:\\Applications folder, and send the log, as file called benefits.log. to the folder C:\\java_logs.

To use the Whitelist tool and specify a path for the log file, do the following:

1. Locate the JAR files, deployable archives (WAR or EAR), or exploded directories you want to check.
2. Open a command prompt and navigate to the SDK_HOME\lib directory (where SDK_HOME is the Oracle Java Cloud Service - SaaS Extension SDK installation directory; for example, D:\oracle_javacloud_sdk 15.1.2\oracle-javacloud-sdk\lib.
3. Run the Whitelist tool by entering:

   ./whitelist -log C:\\java_logs\benefits.log D:\\Applications\benefits.war

   A check of C:\\java_logs\ shows the file benefits.log:
   
   Description of the illustration java_logs.gif

If you wanted to output the log directly to your screen, you could use the grid argument, like this:

./whitelist D:\\Applications\benefits.war -grid

The problem I have faced is with running ./whitelist command.

I was always getting ./ is not recognized as an internal or external command.

To solve this and to run ./whitelist command i have java approach

Navigate to the directory where whitelist.jar is present (i.e. /lib) folder den run the command

java -jar <jar-file-name>.jar

For example, 

java - jar whitelist.jar D:\\Applications\benefits.war -grid

This worked me . Hope this helps!