Skip to content

Commit

Permalink
Fix CVE-2022-22965
Browse files Browse the repository at this point in the history
  • Loading branch information
@hmiguim
hmiguim committed May 26, 2022
1 parent de625a7 commit 386ca6a
Show file tree
Hide file tree
Showing 31 changed files with 447 additions and 741 deletions.
101 changes: 44 additions & 57 deletions pom.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,27 +27,19 @@
<version.gwt>2.9.0-jetty94</version.gwt>
<scope.gwt-dev>provided</scope.gwt-dev>
<version.dbptk>2.9.10</version.dbptk>
<version.roda>3.0.2</version.roda>
<version.jersey>2.29.1</version.jersey>
<version.swagger>1.5.20</version.swagger>
<version.springfox-swagger>2.9.2</version.springfox-swagger>
<version.jackson>2.10.5</version.jackson>
<version.jackson-databind>2.10.5.1</version.jackson-databind>
<cas.client.version>3.6.1</cas.client.version>
<cas.client.version>3.5.0</cas.client.version>
<solr.version>8.4.1</solr.version>
<springboot.version>2.2.2.RELEASE</springboot.version>
<version.roda>3.7.0</version.roda>
<version.jersey>2.35</version.jersey>
<version.swagger>2.2.0</version.swagger>
<version.jackson>2.13.3</version.jackson>
<version.cas-client>3.6.4</version.cas-client>
<version.solr>8.11.1</version.solr>
<version.springboot>2.6.8</version.springboot>

<desktop>com.databasepreservation.desktop.Desktop</desktop>
<server>com.databasepreservation.server.Server</server>
</properties>

<repositories>
<repository>
<id>KEEPS-Artifacts</id>
<name>KEEP Artifacts-releases</name>
<url>https://artifactory.keep.pt/keep</url>
</repository>
<repository>
<id>github</id>
<name>GitHub Packages</name>
Expand All @@ -66,7 +58,7 @@
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.1.9.RELEASE</version>
<version>2.6.7</version>
</parent>

<build>
Expand Down Expand Up @@ -116,7 +108,7 @@
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
<version>${springboot.version}</version>
<version>${version.springboot}</version>
<configuration>
<excludes>
<exclude>
Expand Down Expand Up @@ -253,7 +245,7 @@
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
<version>${springboot.version}</version>
<version>${version.springboot}</version>
<configuration>
<jvmArguments>
-Djava.net.preferIPv4Stack=true
Expand Down Expand Up @@ -300,7 +292,7 @@
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
<version>${springboot.version}</version>
<version>${version.springboot}</version>
<configuration>
<jvmArguments>
-Djava.net.preferIPv4Stack=true
Expand Down Expand Up @@ -447,7 +439,7 @@
<dependency>
<groupId>com.github.jknack</groupId>
<artifactId>handlebars</artifactId>
<version>4.1.2</version>
<version>4.3.0</version>
</dependency>

<!-- gwt -->
Expand All @@ -470,7 +462,7 @@
<dependency>
<groupId>com.github.nmorel.gwtjackson</groupId>
<artifactId>gwt-jackson</artifactId>
<version>0.15.2</version>
<version>0.15.4</version>
</dependency>
<dependency>
<groupId>com.tractionsoftware</groupId>
Expand All @@ -485,7 +477,7 @@
<dependency>
<groupId>org.jasig.cas.client</groupId>
<artifactId>cas-client-core</artifactId>
<version>${cas.client.version}</version>
<version>${version.cas-client}</version>
<exclusions>
<exclusion>
<groupId>javax.servlet</groupId>
Expand All @@ -503,7 +495,7 @@
<dependency>
<groupId>javax.xml.bind</groupId>
<artifactId>jaxb-api</artifactId>
<version>2.3.0</version>
<version>2.3.1</version>
<classifier>sources</classifier>
<scope>provided</scope>
</dependency>
Expand All @@ -512,7 +504,7 @@
<dependency>
<groupId>org.fusesource.restygwt</groupId>
<artifactId>restygwt</artifactId>
<version>2.2.6</version>
<version>2.2.7</version>
</dependency>
<dependency>
<groupId>org.glassfish.jersey.containers</groupId>
Expand Down Expand Up @@ -545,21 +537,6 @@
<groupId>org.glassfish.jersey.media</groupId>
<artifactId>jersey-media-json-jackson</artifactId>
</dependency>
<dependency>
<groupId>io.swagger</groupId>
<artifactId>swagger-jersey2-jaxrs</artifactId>
<version>${version.swagger}</version>
</dependency>
<dependency>
<groupId>io.springfox</groupId>
<artifactId>springfox-swagger2</artifactId>
<version>${version.springfox-swagger}</version>
</dependency>
<dependency>
<groupId>io.springfox</groupId>
<artifactId>springfox-swagger-ui</artifactId>
<version>${version.springfox-swagger}</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
Expand All @@ -568,7 +545,7 @@
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>${version.jackson-databind}</version>
<version>${version.jackson}</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
Expand All @@ -583,7 +560,7 @@
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-csv</artifactId>
<version>1.7</version>
<version>1.9.0</version>
</dependency>
<!-- REST API related dependencies - end -->

Expand Down Expand Up @@ -653,12 +630,12 @@
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
<version>${springboot.version}</version>
<version>${version.springboot}</version>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-jersey</artifactId>
<version>${springboot.version}</version>
<version>${version.springboot}</version>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
Expand Down Expand Up @@ -695,6 +672,22 @@
<artifactId>micrometer-registry-prometheus</artifactId>
</dependency>

<dependency>
<groupId>io.swagger.core.v3</groupId>
<artifactId>swagger-core</artifactId>
<version>${version.swagger}</version>
</dependency>
<dependency>
<groupId>io.swagger.core.v3</groupId>
<artifactId>swagger-jaxrs2</artifactId>
<version>${version.swagger}</version>
</dependency>
<dependency>
<groupId>io.swagger.core.v3</groupId>
<artifactId>swagger-jaxrs2-servlet-initializer-v2</artifactId>
<version>${version.swagger}</version>
</dependency>

<!-- other -->
<dependency>
<groupId>org.slf4j</groupId>
Expand All @@ -704,12 +697,12 @@
<dependency>
<groupId>org.apache.solr</groupId>
<artifactId>solr-solrj</artifactId>
<version>${solr.version}</version>
<version>${version.solr}</version>
</dependency>
<dependency>
<groupId>org.apache.solr</groupId>
<artifactId>solr-core</artifactId>
<version>${solr.version}</version>
<version>${version.solr}</version>
<exclusions>
<!-- 20160218 hsilva: this is needed for apache tika parsers, so commenting
out -->
Expand Down Expand Up @@ -740,29 +733,23 @@
<dependency>
<groupId>io.dropwizard.metrics</groupId>
<artifactId>metrics-core</artifactId>
<version>3.2.6</version>
<version>4.2.9</version>
</dependency>
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
<version>1.2.3</version>
<version>1.2.11</version>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
<version>3.7</version>
<version>3.12.0</version>
</dependency>
<dependency>
<groupId>commons-configuration</groupId>
<artifactId>commons-configuration</artifactId>
<version>1.10</version>
</dependency>
<dependency>
<groupId>org.w3c</groupId>
<artifactId>w3c-utils</artifactId>
<version>1.0.0</version>
</dependency>


<!-- testing -->
<dependency>
Expand All @@ -774,19 +761,19 @@
<dependency>
<groupId>org.testng</groupId>
<artifactId>testng</artifactId>
<version>6.9.4</version>
<version>7.5</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.mockito</groupId>
<artifactId>mockito-core</artifactId>
<version>2.0.28-beta</version>
<version>4.5.1</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>4.13.1</version>
<version>4.13.2</version>
<scope>test</scope>
</dependency>

Expand Down
40 changes: 18 additions & 22 deletions src/main/java/com/databasepreservation/DBVTK.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,31 +36,13 @@
import com.databasepreservation.common.server.BrowserServiceImpl;
import com.databasepreservation.common.server.ViewerConfiguration;

import springfox.documentation.swagger2.annotations.EnableSwagger2;

@SpringBootApplication
@EnableSwagger2
public class DBVTK {
public static void main(String[] args) {
ViewerConfiguration.getInstance();
SpringApplication.run(DBVTK.class, args);
}

@Configuration
public static class DefaultView implements WebMvcConfigurer {

@Override
public void addViewControllers(ViewControllerRegistry registry) {
if (ViewerConstants.APPLICATION_ENV_DESKTOP
.equals(System.getProperty(ViewerConstants.APPLICATION_ENV_KEY, ViewerConstants.APPLICATION_ENV_SERVER))) {
registry.addViewController("/").setViewName("forward:/desktop.html");
registry.setOrder(Ordered.HIGHEST_PRECEDENCE);
}
registry.addRedirectViewController("/api-docs", "/swagger-ui.html");
registry.setOrder(Ordered.HIGHEST_PRECEDENCE);
}
}

@Bean
public ServletRegistrationBean<HttpServlet> browserService() {
ServletRegistrationBean<HttpServlet> bean;
Expand Down Expand Up @@ -135,7 +117,7 @@ public FilterRegistrationBean<OnOffFilter> internalApiAuthFilter() {

// Comma separated list of relative paths to exclude in filter logic (using
// regular expressions for extra power)
registrationBean.addInitParameter("exclusions", "^/swagger.json,^/v1/theme/?");
registrationBean.addInitParameter("exclusions", "^/openapi.json,^/v1/theme/?");

registrationBean.addUrlPatterns("/api/*");

Expand Down Expand Up @@ -172,9 +154,9 @@ public FilterRegistrationBean<OnOffFilter> casValidationFilter() {
registrationBean.addInitParameter("serverName", "https://localhost:8888");
registrationBean.addInitParameter("exceptionOnValidationFailure", "false");
registrationBean.addInitParameter("redirectAfterValidation", "false");
registrationBean.addInitParameter("proxyCallbackUrl", "https://localhost:8888/callback");
registrationBean.addInitParameter("proxyReceptorUrl", "/callback");
registrationBean.addInitParameter("acceptAnyProxy", "true");
registrationBean.addInitParameter("proxyCallbackUrl", "");
registrationBean.addInitParameter("proxyReceptorUrl", "");
registrationBean.addInitParameter("acceptAnyProxy", "false");
registrationBean.addUrlPatterns("/*");

return registrationBean;
Expand Down Expand Up @@ -248,6 +230,20 @@ public DataSource getDataSource() {
return dataSourceBuilder.build();
}

@Configuration
public static class DefaultView implements WebMvcConfigurer {

@Override
public void addViewControllers(ViewControllerRegistry registry) {
if (ViewerConstants.APPLICATION_ENV_DESKTOP
.equals(System.getProperty(ViewerConstants.APPLICATION_ENV_KEY, ViewerConstants.APPLICATION_ENV_SERVER))) {
registry.addViewController("/").setViewName("forward:/desktop.html");
registry.setOrder(Ordered.HIGHEST_PRECEDENCE);
}
registry.setOrder(Ordered.HIGHEST_PRECEDENCE);
}
}

// @Bean
// MultipartConfigElement multipartConfigElement() {
// MultipartConfigFactory factory = new MultipartConfigFactory();
Expand Down
20 changes: 0 additions & 20 deletions src/main/java/com/databasepreservation/common/api/MyApiListingResource.java
View file

This file was deleted.

Loading

0 comments on commit 386ca6a

Please sign in to comment.