Skip to content

Commit 8018a91

Browse files
ashishKhushiKumarashishKhushiKumar
committed
HERESUP-27616 IAM-6079 Replace ini4j dependency to apache commons-configuration2, update jackson-databind and async-http-client version to fix high risk vulnerablity"
Signed-off-by: ashikuma <ashish.kumar@here.com>
1 parent 7b6a3d9 commit 8018a91

6 files changed

Lines changed: 39 additions & 32 deletions

File tree

‎.github/workflows/test.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ jobs:
88
steps:
99
- uses: actions/checkout@v2
1010
- name: Cache local Maven repository
11-
uses: actions/cache@v2
11+
uses: actions/cache@v4
1212
with:
1313
path: $HOME/.m2
1414
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}

‎here-oauth-client/pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,8 +81,8 @@
8181
<dependencies>
8282
<!-- compile dependencies -->
8383
<dependency>
84-
<groupId>org.ini4j</groupId>
85-
<artifactId>ini4j</artifactId>
84+
<groupId>org.apache.commons</groupId>
85+
<artifactId>commons-configuration2</artifactId>
8686
</dependency>
8787
<dependency>
8888
<groupId>com.fasterxml.jackson.core</groupId>

‎here-oauth-client/src/main/java/com/here/account/auth/provider/FromHereCredentialsIniStream.java‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,10 @@
99

1010
import com.here.account.util.Clock;
1111
import com.here.account.util.SettableSystemClock;
12-
import org.ini4j.Ini;
12+
import org.apache.commons.configuration2.INIConfiguration;
13+
import org.apache.commons.configuration2.ex.ConfigurationException;
14+
import org.apache.commons.configuration2.HierarchicalConfiguration;
15+
import org.apache.commons.configuration2.tree.ImmutableNode;
1316

1417
import com.here.account.auth.OAuth1ClientCredentialsProvider;
1518
import com.here.account.http.HttpConstants.HttpMethods;
@@ -64,27 +67,27 @@ protected static ClientAuthorizationRequestProvider getClientCredentialsProvider
6467
try {
6568
Properties properties = getPropertiesFromIni(inputStream, sectionName);
6669
return FromSystemProperties.getClientCredentialsProviderWithDefaultTokenEndpointUrl(clock, properties);
67-
} catch (IOException e) {
70+
} catch (IOException | ConfigurationException e) {
6871
throw new RequestProviderException("trouble FromFile " + e, e);
6972
}
7073
}
7174

7275
static final String DEFAULT_INI_SECTION_NAME = "default";
73-
74-
static Properties getPropertiesFromIni(InputStream inputStream, String sectionName) throws IOException {
75-
Ini ini = new Ini();
76+
77+
static Properties getPropertiesFromIni(InputStream inputStream, String sectionName) throws IOException, ConfigurationException {
7678
try (Reader reader = new InputStreamReader(inputStream, OAuthConstants.UTF_8_CHARSET)) {
77-
ini.load(reader);
78-
Ini.Section section = ini.get(sectionName);
79+
INIConfiguration ini = new INIConfiguration();
80+
ini.read(reader);
7981
Properties properties = new Properties();
82+
HierarchicalConfiguration<ImmutableNode> section = ini.getSection(sectionName);
8083
properties.put(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_ENDPOINT_URL_PROPERTY,
81-
section.get(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_ENDPOINT_URL_PROPERTY));
84+
section.getString(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_ENDPOINT_URL_PROPERTY));
8285
properties.put(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_ID_PROPERTY,
83-
section.get(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_ID_PROPERTY));
86+
section.getString(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_ID_PROPERTY));
8487
properties.put(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_SECRET_PROPERTY,
85-
section.get(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_SECRET_PROPERTY));
88+
section.getString(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_SECRET_PROPERTY));
8689
// scope is optional
87-
String scope = section.get(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_SCOPE_PROPERTY);
90+
String scope = section.getString(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_SCOPE_PROPERTY);
8891
if (null != scope)
8992
properties.put(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_SCOPE_PROPERTY, scope);
9093

‎here-oauth-client/src/test/java/com/here/account/auth/SignatureCalculatorTest.java‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,11 @@
1616
package com.here.account.auth;
1717

1818
import com.ning.http.client.FluentStringsMap;
19+
import com.ning.http.client.Param;
1920
import com.ning.http.client.oauth.ConsumerKey;
2021
import com.ning.http.client.oauth.OAuthSignatureCalculator;
2122
import com.ning.http.client.oauth.RequestToken;
23+
import com.ning.http.client.uri.Uri;
2224
import org.junit.Test;
2325

2426
import java.security.*;
@@ -264,19 +266,20 @@ private static String computeSHA1SignatureUsingLibrary(String url, Map<String, L
264266
RequestToken emptyUserAuth = new RequestToken(null, "");
265267
OAuthSignatureCalculator calculator = new OAuthSignatureCalculator(new ConsumerKey(consumerKey, consumerSecret), emptyUserAuth);
266268

267-
FluentStringsMap fluentFormParams = null;
268-
if (null != formParams && !formParams.isEmpty()) {
269-
fluentFormParams = new FluentStringsMap();
270-
fluentFormParams.putAll(formParams);
271-
}
269+
return calculator.calculateSignature(method, Uri.create(url), timestamp, nonce, convertToParamList(formParams), convertToParamList(queryParams));
270+
}
272271

273-
FluentStringsMap fluentQueryParams = null;
274-
if (null != queryParams && !queryParams.isEmpty()) {
275-
fluentQueryParams = new FluentStringsMap();
276-
fluentQueryParams.putAll(queryParams);
272+
private static List<Param> convertToParamList(Map<String, List<String>> paramMap) {
273+
List<Param> paramList = new ArrayList<>();
274+
if (paramMap != null) {
275+
for (Map.Entry<String, List<String>> entry : paramMap.entrySet()) {
276+
String key = entry.getKey();
277+
for (String value : entry.getValue()) {
278+
paramList.add(new Param(key, value));
279+
}
280+
}
277281
}
278-
279-
return calculator.calculateSignature(method, url, timestamp, nonce, fluentFormParams, fluentQueryParams);
282+
return paramList;
280283
}
281284

282285
private static Map<String, List<String>> createParamsList() {

‎here-oauth-client/src/test/java/com/here/account/auth/provider/FromHereCredentialsIniStreamTest.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
import org.junit.Test;
2424
import org.mockito.Mockito;
2525

26+
import org.apache.commons.configuration2.ex.ConfigurationException;
2627
import java.io.ByteArrayInputStream;
2728
import java.io.IOException;
2829
import java.io.InputStream;
@@ -84,7 +85,7 @@ public int read() throws IOException {
8485
}
8586

8687
@Test(expected = RuntimeException.class)
87-
public void test_invalid_stream() throws IOException {
88+
public void test_invalid_stream() throws IOException, ConfigurationException {
8889
FromHereCredentialsIniStream.getPropertiesFromIni(null, TEST_DEFAULT_INI_SECTION_NAME);
8990
}
9091

‎pom.xml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -65,11 +65,11 @@
6565

6666
<!-- Declare versions for dependencies -->
6767
<apache.httpclient.version>4.5.13</apache.httpclient.version>
68-
<ini4j.version>0.5.4</ini4j.version>
69-
<jackson.version>2.13.3</jackson.version>
68+
<commons-configuration2.version>2.12.0</commons-configuration2.version>
69+
<jackson.version>2.13.4.2</jackson.version>
7070
<junit.version>4.13.1</junit.version>
7171
<mockito.version>1.10.19</mockito.version>
72-
<ning.version>1.8.17</ning.version>
72+
<ning.version>1.9.0</ning.version>
7373
<browsermob.version>2.1.5</browsermob.version>
7474

7575
<!-- configure surefire and maven to be individually skippable -->
@@ -105,9 +105,9 @@
105105
<dependencyManagement>
106106
<dependencies>
107107
<dependency>
108-
<groupId>org.ini4j</groupId>
109-
<artifactId>ini4j</artifactId>
110-
<version>${ini4j.version}</version>
108+
<groupId>org.apache.commons</groupId>
109+
<artifactId>commons-configuration2</artifactId>
110+
<version>${commons-configuration2.version}</version>
111111
</dependency>
112112
<dependency>
113113
<groupId>com.fasterxml.jackson.core</groupId>

0 commit comments

Comments
 (0)