Skip to content

Commit 1308d6f

Browse files
ashishKhushiKumarashishKhushiKumar
committed
HERESUP-27616 IAM-6079 Fix dependency vulnurablities
Signed-off-by: ashikuma <ashish.kumar@here.com>
1 parent 7b6a3d9 commit 1308d6f

6 files changed

Lines changed: 71 additions & 57 deletions

File tree

‎.github/workflows/test.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ jobs:
88
steps:
99
- uses: actions/checkout@v2
1010
- name: Cache local Maven repository
11-
uses: actions/cache@v2
11+
uses: actions/cache@v4
1212
with:
1313
path: $HOME/.m2
1414
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}

‎here-oauth-client/pom.xml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -81,8 +81,8 @@
8181
<dependencies>
8282
<!-- compile dependencies -->
8383
<dependency>
84-
<groupId>org.ini4j</groupId>
85-
<artifactId>ini4j</artifactId>
84+
<groupId>org.apache.commons</groupId>
85+
<artifactId>commons-configuration2</artifactId>
8686
</dependency>
8787
<dependency>
8888
<groupId>com.fasterxml.jackson.core</groupId>
@@ -105,7 +105,7 @@
105105
<scope>test</scope>
106106
</dependency>
107107
<dependency>
108-
<groupId>com.ning</groupId>
108+
<groupId>org.asynchttpclient</groupId>
109109
<artifactId>async-http-client</artifactId>
110110
<scope>test</scope>
111111
</dependency>

‎here-oauth-client/src/main/java/com/here/account/auth/provider/FromHereCredentialsIniStream.java‎

Lines changed: 30 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,16 @@
44
import java.io.InputStream;
55
import java.io.InputStreamReader;
66
import java.io.Reader;
7+
import java.util.Iterator;
78
import java.util.Objects;
89
import java.util.Properties;
910

1011
import com.here.account.util.Clock;
1112
import com.here.account.util.SettableSystemClock;
12-
import org.ini4j.Ini;
13+
import org.apache.commons.configuration2.INIConfiguration;
14+
import org.apache.commons.configuration2.ex.ConfigurationException;
15+
import org.apache.commons.configuration2.HierarchicalConfiguration;
16+
import org.apache.commons.configuration2.tree.ImmutableNode;
1317

1418
import com.here.account.auth.OAuth1ClientCredentialsProvider;
1519
import com.here.account.http.HttpConstants.HttpMethods;
@@ -64,30 +68,38 @@ protected static ClientAuthorizationRequestProvider getClientCredentialsProvider
6468
try {
6569
Properties properties = getPropertiesFromIni(inputStream, sectionName);
6670
return FromSystemProperties.getClientCredentialsProviderWithDefaultTokenEndpointUrl(clock, properties);
67-
} catch (IOException e) {
71+
} catch (IOException | ConfigurationException e) {
6872
throw new RequestProviderException("trouble FromFile " + e, e);
6973
}
7074
}
7175

7276
static final String DEFAULT_INI_SECTION_NAME = "default";
73-
74-
static Properties getPropertiesFromIni(InputStream inputStream, String sectionName) throws IOException {
75-
Ini ini = new Ini();
77+
78+
static Properties getPropertiesFromIni(InputStream inputStream, String sectionName) throws IOException, ConfigurationException {
7679
try (Reader reader = new InputStreamReader(inputStream, OAuthConstants.UTF_8_CHARSET)) {
77-
ini.load(reader);
78-
Ini.Section section = ini.get(sectionName);
80+
INIConfiguration ini = new INIConfiguration();
81+
ini.read(reader);
82+
HierarchicalConfiguration<ImmutableNode> section = ini.getSection(sectionName);
7983
Properties properties = new Properties();
80-
properties.put(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_ENDPOINT_URL_PROPERTY,
81-
section.get(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_ENDPOINT_URL_PROPERTY));
82-
properties.put(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_ID_PROPERTY,
83-
section.get(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_ID_PROPERTY));
84-
properties.put(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_SECRET_PROPERTY,
85-
section.get(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_SECRET_PROPERTY));
86-
// scope is optional
87-
String scope = section.get(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_SCOPE_PROPERTY);
88-
if (null != scope)
89-
properties.put(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_SCOPE_PROPERTY, scope);
90-
84+
Iterator<String> it = section.getKeys();
85+
while (it.hasNext()) {
86+
String key = it.next();
87+
String value = section.getString(key);
88+
switch (key.replaceAll("\\.+", ".")) {
89+
case OAuth1ClientCredentialsProvider.FromProperties.TOKEN_ENDPOINT_URL_PROPERTY:
90+
properties.put(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_ENDPOINT_URL_PROPERTY, value);
91+
break;
92+
case OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_ID_PROPERTY:
93+
properties.put(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_ID_PROPERTY, value);
94+
break;
95+
case OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_SECRET_PROPERTY:
96+
properties.put(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_SECRET_PROPERTY, value);
97+
break;
98+
case OAuth1ClientCredentialsProvider.FromProperties.TOKEN_SCOPE_PROPERTY:
99+
properties.put(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_SCOPE_PROPERTY, value);
100+
break;
101+
}
102+
}
91103
return properties;
92104
}
93105
}

‎here-oauth-client/src/test/java/com/here/account/auth/SignatureCalculatorTest.java‎

Lines changed: 28 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,15 @@
1515
*/
1616
package com.here.account.auth;
1717

18-
import com.ning.http.client.FluentStringsMap;
19-
import com.ning.http.client.oauth.ConsumerKey;
20-
import com.ning.http.client.oauth.OAuthSignatureCalculator;
21-
import com.ning.http.client.oauth.RequestToken;
18+
import org.asynchttpclient.Param;
19+
import org.asynchttpclient.oauth.ConsumerKey;
20+
import org.asynchttpclient.oauth.OAuthSignatureCalculatorInstance;
21+
import org.asynchttpclient.oauth.RequestToken;
22+
import org.asynchttpclient.uri.Uri;
23+
import org.asynchttpclient.util.Utf8UrlEncoder;
2224
import org.junit.Test;
2325

26+
import java.lang.reflect.Method;
2427
import java.security.*;
2528
import java.security.spec.*;
2629
import java.util.*;
@@ -49,7 +52,7 @@ public class SignatureCalculatorTest {
4952

5053
/////////////////////////////// HMAC-SHA1 //////////////////////////////////////////
5154
@Test
52-
public void testSignatureHmacSha1() {
55+
public void testSignatureHmacSha1() throws Exception {
5356
String expectedSignature = computeSHA1SignatureUsingLibrary(baseURL, null, null);
5457

5558
SignatureCalculator sc = new SignatureCalculator(consumerKey, consumerSecret);
@@ -59,7 +62,7 @@ public void testSignatureHmacSha1() {
5962
}
6063

6164
@Test
62-
public void testSignatureHmacSha1WithFormParams() {
65+
public void testSignatureHmacSha1WithFormParams() throws Exception {
6366
String expectedSignature = computeSHA1SignatureUsingLibrary(baseURL, params, null);
6467

6568
SignatureCalculator sc = new SignatureCalculator(consumerKey, consumerSecret);
@@ -69,7 +72,7 @@ public void testSignatureHmacSha1WithFormParams() {
6972
}
7073

7174
@Test
72-
public void testSignatureHmacSha1WithFormParamsWithSpacesInValue() {
75+
public void testSignatureHmacSha1WithFormParamsWithSpacesInValue() throws Exception {
7376

7477
Map<String, List<String>> nestedParams = new HashMap<>();
7578
nestedParams.put("http_method", Arrays.asList("POST"));
@@ -87,7 +90,7 @@ public void testSignatureHmacSha1WithFormParamsWithSpacesInValue() {
8790
}
8891

8992
@Test
90-
public void testSignatureHmacSha1WithQueryParams() {
93+
public void testSignatureHmacSha1WithQueryParams() throws Exception {
9194
String expectedSignature = computeSHA1SignatureUsingLibrary(baseURL, null, params);
9295

9396
SignatureCalculator sc = new SignatureCalculator(consumerKey, consumerSecret);
@@ -97,7 +100,7 @@ public void testSignatureHmacSha1WithQueryParams() {
97100
}
98101

99102
@Test
100-
public void testSignatureHmacSha1WithFormAndQueryParams() {
103+
public void testSignatureHmacSha1WithFormAndQueryParams() throws Exception {
101104
String expectedSignature = computeSHA1SignatureUsingLibrary(baseURL, params, params);
102105

103106
SignatureCalculator sc = new SignatureCalculator(consumerKey, consumerSecret);
@@ -107,7 +110,7 @@ public void testSignatureHmacSha1WithFormAndQueryParams() {
107110
}
108111

109112
@Test
110-
public void testSignatureHmacSha1WithBaseURLWithPort() {
113+
public void testSignatureHmacSha1WithBaseURLWithPort() throws Exception {
111114
String expectedSignature = computeSHA1SignatureUsingLibrary(baseURLWithPort, params, params);
112115

113116
SignatureCalculator sc = new SignatureCalculator(consumerKey, consumerSecret);
@@ -117,7 +120,7 @@ public void testSignatureHmacSha1WithBaseURLWithPort() {
117120
}
118121

119122
@Test
120-
public void testSignatureHmacSha1WithBaseURLWithNonStandardPort() {
123+
public void testSignatureHmacSha1WithBaseURLWithNonStandardPort() throws Exception {
121124
String expectedSignature = computeSHA1SignatureUsingLibrary(baseURLWithNonStandardPort, params, params);
122125

123126
SignatureCalculator sc = new SignatureCalculator(consumerKey, consumerSecret);
@@ -127,7 +130,7 @@ public void testSignatureHmacSha1WithBaseURLWithNonStandardPort() {
127130
}
128131

129132
@Test
130-
public void testVerifySha1Signature() {
133+
public void testVerifySha1Signature() throws Exception {
131134
String expectedSignature = computeSHA1SignatureUsingLibrary(baseURLWithNonStandardPort, params, params);
132135

133136
boolean verified = SignatureCalculator.verifySignature(consumerKey, method, baseURLWithNonStandardPort, timestamp, nonce,
@@ -260,23 +263,21 @@ public static KeyPair generateES512KeyPair() {
260263
}
261264
}
262265

263-
private static String computeSHA1SignatureUsingLibrary(String url, Map<String, List<String>> formParams, Map<String, List<String>> queryParams) {
264-
RequestToken emptyUserAuth = new RequestToken(null, "");
265-
OAuthSignatureCalculator calculator = new OAuthSignatureCalculator(new ConsumerKey(consumerKey, consumerSecret), emptyUserAuth);
266-
267-
FluentStringsMap fluentFormParams = null;
268-
if (null != formParams && !formParams.isEmpty()) {
269-
fluentFormParams = new FluentStringsMap();
270-
fluentFormParams.putAll(formParams);
271-
}
266+
private static String computeSHA1SignatureUsingLibrary(String url, Map<String, List<String>> formParams, Map<String, List<String>> queryParams) throws Exception {
267+
Method computeSignature = OAuthSignatureCalculatorInstance.class.getDeclaredMethod("computeSignature", ConsumerKey.class, RequestToken.class, Uri.class, String.class, List.class, List.class, long.class, String.class);
268+
computeSignature.setAccessible(true);
269+
return (String) computeSignature.invoke(new OAuthSignatureCalculatorInstance(), new ConsumerKey(consumerKey, consumerSecret), new RequestToken(null, ""), Uri.create(url), method, toParamList(formParams), toParamList(queryParams), timestamp, Utf8UrlEncoder.percentEncodeQueryElement(nonce));
270+
}
272271

273-
FluentStringsMap fluentQueryParams = null;
274-
if (null != queryParams && !queryParams.isEmpty()) {
275-
fluentQueryParams = new FluentStringsMap();
276-
fluentQueryParams.putAll(queryParams);
272+
private static List<Param> toParamList(Map<String, List<String>> paramMap) {
273+
if (paramMap == null || paramMap.isEmpty()) return null;
274+
List<Param> paramList = new ArrayList<>();
275+
for (Map.Entry<String, List<String>> entry : paramMap.entrySet()) {
276+
for (String value : entry.getValue()) {
277+
paramList.add(new Param(entry.getKey(), value));
278+
}
277279
}
278-
279-
return calculator.calculateSignature(method, url, timestamp, nonce, fluentFormParams, fluentQueryParams);
280+
return paramList;
280281
}
281282

282283
private static Map<String, List<String>> createParamsList() {

‎here-oauth-client/src/test/java/com/here/account/auth/provider/FromHereCredentialsIniStreamTest.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
import com.here.account.http.HttpProvider.HttpRequestAuthorizer;
2121
import com.here.account.oauth2.ClientAuthorizationRequestProvider;
2222
import com.here.account.util.Clock;
23+
import org.apache.commons.configuration2.ex.ConfigurationException;
2324
import org.junit.Test;
2425
import org.mockito.Mockito;
2526

@@ -84,7 +85,7 @@ public int read() throws IOException {
8485
}
8586

8687
@Test(expected = RuntimeException.class)
87-
public void test_invalid_stream() throws IOException {
88+
public void test_invalid_stream() throws IOException, ConfigurationException {
8889
FromHereCredentialsIniStream.getPropertiesFromIni(null, TEST_DEFAULT_INI_SECTION_NAME);
8990
}
9091

‎pom.xml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -65,11 +65,11 @@
6565

6666
<!-- Declare versions for dependencies -->
6767
<apache.httpclient.version>4.5.13</apache.httpclient.version>
68-
<ini4j.version>0.5.4</ini4j.version>
69-
<jackson.version>2.13.3</jackson.version>
68+
<commons-configuration2.version>2.12.0</commons-configuration2.version>
69+
<jackson.version>2.13.4.2</jackson.version>
7070
<junit.version>4.13.1</junit.version>
7171
<mockito.version>1.10.19</mockito.version>
72-
<ning.version>1.8.17</ning.version>
72+
<ning.version>2.12.4</ning.version>
7373
<browsermob.version>2.1.5</browsermob.version>
7474

7575
<!-- configure surefire and maven to be individually skippable -->
@@ -105,9 +105,9 @@
105105
<dependencyManagement>
106106
<dependencies>
107107
<dependency>
108-
<groupId>org.ini4j</groupId>
109-
<artifactId>ini4j</artifactId>
110-
<version>${ini4j.version}</version>
108+
<groupId>org.apache.commons</groupId>
109+
<artifactId>commons-configuration2</artifactId>
110+
<version>${commons-configuration2.version}</version>
111111
</dependency>
112112
<dependency>
113113
<groupId>com.fasterxml.jackson.core</groupId>
@@ -139,7 +139,7 @@
139139
<scope>test</scope>
140140
</dependency>
141141
<dependency>
142-
<groupId>com.ning</groupId>
142+
<groupId>org.asynchttpclient</groupId>
143143
<artifactId>async-http-client</artifactId>
144144
<version>${ning.version}</version>
145145
<scope>test</scope>

0 commit comments

Comments
 (0)