## CSRF Risk { #csrf-risk }

This default behavior provides protection against a class of **Cross-Site Request Forgery (CSRF)** attacks in a very specific scenario.

These attacks exploit the fact that browsers allow scripts to send requests without doing any CORS preflight check when they:

* don't have a `Content-Type` header (e.g. using `fetch()` with a `Blob` body)
* and don't send any authentication credentials.

import org.apache.maven.api.di.Named;
import org.apache.maven.api.model.Model;

/**
 * Interface for model transformers that can modify Maven project models at different stages of processing.
 * <p>
 * Model transformers allow plugins and extensions to modify the POM model during the build process.
 * Transformations can be applied at three different stages:
 * <ol>
 *   <li>File model - The raw model as read directly from the file</li>

```

```
~ mc admin policy create admin allaccess.json
```

Contents of `allaccess.json`

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:*"
      ],
      "Resource": [
        "arn:aws:s3:::*"
      ]
    }
  ]
}
```

### Visit <http://localhost:8080>

 */
@GwtCompatible
@NullUnmarked
final class LenientSerializableTester {
  /*
   * TODO(cpovirk): move this to c.g.c.testing if we allow for c.g.c.annotations dependencies so
   * that it can be GWTified?
   */
  @CanIgnoreReturnValue
  @GwtIncompatible // SerializableTester
  static <E> Set<E> reserializeAndAssertLenient(Set<E> original) {

  @Override
  int copyIntoArray(@Nullable Object[] dst, int dstOff) {
    arraycopy(array, 0, dst, dstOff, size);
    return dstOff + size;
  }

  // The fake cast to E is safe because the creation methods only allow E's
  @Override
  @SuppressWarnings("unchecked")
  public E get(int index) {
    checkElementIndex(index, size);
    // requireNonNull is safe because we guarantee that the first `size` elements are non-null.

const crossDomainXML = `<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><allow-access-from domain="*" secure="false" /></cross-domain-policy>`

// Standard path where an app would find cross domain policy information.
const crossDomainXMLEntity = "/crossdomain.xml"

        sudo rm -Rf /usr/bin/rpm
        # Work around incorrect lintian version
        #  https://github.com/elastic/elasticsearch/issues/48573
        if [ $VERSION_ID == 10 ] ; then
            sudo apt-get install -y --allow-downgrades lintian=2.15.0
        fi
    fi
else
    cat /etc/issue || true
fi

sudo bash -c 'cat > /etc/sudoers.d/elasticsearch_vars'  << SUDOERS_VARS
    Defaults   env_keep += "ES_JAVA_HOME"

     * @see DialectVersion
     * @return minimum protocol version to use/allow
     * @since 2.1
     */
    DialectVersion getMinimumVersion();

    /**
     * Maximum protocol version
     *
     * Property {@code jcifs.smb.client.maxVersion} (string, default SMB210)
     *
     * @see DialectVersion
     * @return maximum protocol version to use/allow
     * @since 2.1
     */
    DialectVersion getMaximumVersion();

  private final BaseGraph<N> graph;
  private final Iterator<N> nodeIterator;

  @Nullable N node = null; // null is safe as an initial value because graphs don't allow null nodes

  Iterator<N> successorIterator = ImmutableSet.<N>of().iterator();

  static <N> EndpointPairIterator<N> of(BaseGraph<N> graph) {
    return graph.isDirected() ? new Directed<N>(graph) : new Undirected<N>(graph);

  /**
   * Opens a new buffered {@link OutputStream} for writing to this sink. The returned stream is not
   * required to be a {@link BufferedOutputStream} in order to allow implementations to simply
   * delegate to {@link #openStream()} when the stream returned by that method does not benefit from
   * additional buffering (for example, a {@code ByteArrayOutputStream}). This method returns a new,