Skip to content

Commit 4667f61

Browse files
ashishKhushiKumarashishKhushiKumar
committed
HERESUP-27616 IAM-6079 Fix dependency vulnurablities
Signed-off-by: ashikuma <ashish.kumar@here.com>
1 parent 7b6a3d9 commit 4667f61

5 files changed

Lines changed: 40 additions & 27 deletions

File tree

‎.github/workflows/test.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ jobs:
88
steps:
99
- uses: actions/checkout@v2
1010
- name: Cache local Maven repository
11-
uses: actions/cache@v2
11+
uses: actions/cache@v4
1212
with:
1313
path: $HOME/.m2
1414
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}

‎here-oauth-client/pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,8 +81,8 @@
8181
<dependencies>
8282
<!-- compile dependencies -->
8383
<dependency>
84-
<groupId>org.ini4j</groupId>
85-
<artifactId>ini4j</artifactId>
84+
<groupId>org.apache.commons</groupId>
85+
<artifactId>commons-configuration2</artifactId>
8686
</dependency>
8787
<dependency>
8888
<groupId>com.fasterxml.jackson.core</groupId>

‎here-oauth-client/src/main/java/com/here/account/auth/provider/FromHereCredentialsIniStream.java‎

Lines changed: 30 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,16 @@
44
import java.io.InputStream;
55
import java.io.InputStreamReader;
66
import java.io.Reader;
7+
import java.util.Iterator;
78
import java.util.Objects;
89
import java.util.Properties;
910

1011
import com.here.account.util.Clock;
1112
import com.here.account.util.SettableSystemClock;
12-
import org.ini4j.Ini;
13+
import org.apache.commons.configuration2.INIConfiguration;
14+
import org.apache.commons.configuration2.ex.ConfigurationException;
15+
import org.apache.commons.configuration2.HierarchicalConfiguration;
16+
import org.apache.commons.configuration2.tree.ImmutableNode;
1317

1418
import com.here.account.auth.OAuth1ClientCredentialsProvider;
1519
import com.here.account.http.HttpConstants.HttpMethods;
@@ -64,30 +68,38 @@ protected static ClientAuthorizationRequestProvider getClientCredentialsProvider
6468
try {
6569
Properties properties = getPropertiesFromIni(inputStream, sectionName);
6670
return FromSystemProperties.getClientCredentialsProviderWithDefaultTokenEndpointUrl(clock, properties);
67-
} catch (IOException e) {
71+
} catch (IOException | ConfigurationException e) {
6872
throw new RequestProviderException("trouble FromFile " + e, e);
6973
}
7074
}
7175

7276
static final String DEFAULT_INI_SECTION_NAME = "default";
73-
74-
static Properties getPropertiesFromIni(InputStream inputStream, String sectionName) throws IOException {
75-
Ini ini = new Ini();
77+
78+
static Properties getPropertiesFromIni(InputStream inputStream, String sectionName) throws IOException, ConfigurationException {
7679
try (Reader reader = new InputStreamReader(inputStream, OAuthConstants.UTF_8_CHARSET)) {
77-
ini.load(reader);
78-
Ini.Section section = ini.get(sectionName);
80+
INIConfiguration ini = new INIConfiguration();
81+
ini.read(reader);
82+
HierarchicalConfiguration<ImmutableNode> section = ini.getSection(sectionName);
7983
Properties properties = new Properties();
80-
properties.put(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_ENDPOINT_URL_PROPERTY,
81-
section.get(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_ENDPOINT_URL_PROPERTY));
82-
properties.put(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_ID_PROPERTY,
83-
section.get(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_ID_PROPERTY));
84-
properties.put(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_SECRET_PROPERTY,
85-
section.get(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_SECRET_PROPERTY));
86-
// scope is optional
87-
String scope = section.get(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_SCOPE_PROPERTY);
88-
if (null != scope)
89-
properties.put(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_SCOPE_PROPERTY, scope);
90-
84+
Iterator<String> it = section.getKeys();
85+
while (it.hasNext()) {
86+
String key = it.next();
87+
String value = section.getString(key);
88+
switch (key.replaceAll("\\.+", ".")) {
89+
case OAuth1ClientCredentialsProvider.FromProperties.TOKEN_ENDPOINT_URL_PROPERTY:
90+
properties.put(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_ENDPOINT_URL_PROPERTY, value);
91+
break;
92+
case OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_ID_PROPERTY:
93+
properties.put(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_ID_PROPERTY, value);
94+
break;
95+
case OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_SECRET_PROPERTY:
96+
properties.put(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_SECRET_PROPERTY, value);
97+
break;
98+
case OAuth1ClientCredentialsProvider.FromProperties.TOKEN_SCOPE_PROPERTY:
99+
properties.put(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_SCOPE_PROPERTY, value);
100+
break;
101+
}
102+
}
91103
return properties;
92104
}
93105
}

‎here-oauth-client/src/test/java/com/here/account/auth/provider/FromHereCredentialsIniStreamTest.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
import com.here.account.http.HttpProvider.HttpRequestAuthorizer;
2121
import com.here.account.oauth2.ClientAuthorizationRequestProvider;
2222
import com.here.account.util.Clock;
23+
import org.apache.commons.configuration2.ex.ConfigurationException;
2324
import org.junit.Test;
2425
import org.mockito.Mockito;
2526

@@ -84,7 +85,7 @@ public int read() throws IOException {
8485
}
8586

8687
@Test(expected = RuntimeException.class)
87-
public void test_invalid_stream() throws IOException {
88+
public void test_invalid_stream() throws IOException, ConfigurationException {
8889
FromHereCredentialsIniStream.getPropertiesFromIni(null, TEST_DEFAULT_INI_SECTION_NAME);
8990
}
9091

‎pom.xml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -65,8 +65,8 @@
6565

6666
<!-- Declare versions for dependencies -->
6767
<apache.httpclient.version>4.5.13</apache.httpclient.version>
68-
<ini4j.version>0.5.4</ini4j.version>
69-
<jackson.version>2.13.3</jackson.version>
68+
<commons-configuration2.version>2.12.0</commons-configuration2.version>
69+
<jackson.version>2.13.4.2</jackson.version>
7070
<junit.version>4.13.1</junit.version>
7171
<mockito.version>1.10.19</mockito.version>
7272
<ning.version>1.8.17</ning.version>
@@ -105,9 +105,9 @@
105105
<dependencyManagement>
106106
<dependencies>
107107
<dependency>
108-
<groupId>org.ini4j</groupId>
109-
<artifactId>ini4j</artifactId>
110-
<version>${ini4j.version}</version>
108+
<groupId>org.apache.commons</groupId>
109+
<artifactId>commons-configuration2</artifactId>
110+
<version>${commons-configuration2.version}</version>
111111
</dependency>
112112
<dependency>
113113
<groupId>com.fasterxml.jackson.core</groupId>

0 commit comments

Comments
 (0)