Skip to content

Commit 98c87a6

Browse files
ashishKhushiKumarashishKhushiKumar
committed
HERESUP-27616 IAM-6079 Replace ini4j dependency to apache commons-configuration2, update jackson-databind and async-http-client version to fix high risk vulnerablity"
Signed-off-by: ashikuma <ashish.kumar@here.com>
1 parent 7b6a3d9 commit 98c87a6

5 files changed

Lines changed: 25 additions & 21 deletions

File tree

‎.github/workflows/test.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ jobs:
88
steps:
99
- uses: actions/checkout@v2
1010
- name: Cache local Maven repository
11-
uses: actions/cache@v2
11+
uses: actions/cache@v4
1212
with:
1313
path: $HOME/.m2
1414
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}

‎here-oauth-client/pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,8 +81,8 @@
8181
<dependencies>
8282
<!-- compile dependencies -->
8383
<dependency>
84-
<groupId>org.ini4j</groupId>
85-
<artifactId>ini4j</artifactId>
84+
<groupId>org.apache.commons</groupId>
85+
<artifactId>commons-configuration2</artifactId>
8686
</dependency>
8787
<dependency>
8888
<groupId>com.fasterxml.jackson.core</groupId>

‎here-oauth-client/src/main/java/com/here/account/auth/provider/FromHereCredentialsIniStream.java‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,10 @@
99

1010
import com.here.account.util.Clock;
1111
import com.here.account.util.SettableSystemClock;
12-
import org.ini4j.Ini;
12+
import org.apache.commons.configuration2.INIConfiguration;
13+
import org.apache.commons.configuration2.ex.ConfigurationException;
14+
import org.apache.commons.configuration2.HierarchicalConfiguration;
15+
import org.apache.commons.configuration2.tree.ImmutableNode;
1316

1417
import com.here.account.auth.OAuth1ClientCredentialsProvider;
1518
import com.here.account.http.HttpConstants.HttpMethods;
@@ -64,27 +67,27 @@ protected static ClientAuthorizationRequestProvider getClientCredentialsProvider
6467
try {
6568
Properties properties = getPropertiesFromIni(inputStream, sectionName);
6669
return FromSystemProperties.getClientCredentialsProviderWithDefaultTokenEndpointUrl(clock, properties);
67-
} catch (IOException e) {
70+
} catch (IOException | ConfigurationException e) {
6871
throw new RequestProviderException("trouble FromFile " + e, e);
6972
}
7073
}
7174

7275
static final String DEFAULT_INI_SECTION_NAME = "default";
73-
74-
static Properties getPropertiesFromIni(InputStream inputStream, String sectionName) throws IOException {
75-
Ini ini = new Ini();
76+
77+
static Properties getPropertiesFromIni(InputStream inputStream, String sectionName) throws IOException, ConfigurationException {
7678
try (Reader reader = new InputStreamReader(inputStream, OAuthConstants.UTF_8_CHARSET)) {
77-
ini.load(reader);
78-
Ini.Section section = ini.get(sectionName);
79+
INIConfiguration ini = new INIConfiguration();
80+
ini.read(reader);
7981
Properties properties = new Properties();
82+
HierarchicalConfiguration<ImmutableNode> section = ini.getSection(sectionName);
8083
properties.put(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_ENDPOINT_URL_PROPERTY,
81-
section.get(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_ENDPOINT_URL_PROPERTY));
84+
section.getString(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_ENDPOINT_URL_PROPERTY));
8285
properties.put(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_ID_PROPERTY,
83-
section.get(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_ID_PROPERTY));
86+
section.getString(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_ID_PROPERTY));
8487
properties.put(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_SECRET_PROPERTY,
85-
section.get(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_SECRET_PROPERTY));
88+
section.getString(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_SECRET_PROPERTY));
8689
// scope is optional
87-
String scope = section.get(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_SCOPE_PROPERTY);
90+
String scope = section.getString(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_SCOPE_PROPERTY);
8891
if (null != scope)
8992
properties.put(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_SCOPE_PROPERTY, scope);
9093

‎here-oauth-client/src/test/java/com/here/account/auth/provider/FromHereCredentialsIniStreamTest.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
import org.junit.Test;
2424
import org.mockito.Mockito;
2525

26+
import org.apache.commons.configuration2.ex.ConfigurationException;
2627
import java.io.ByteArrayInputStream;
2728
import java.io.IOException;
2829
import java.io.InputStream;
@@ -84,7 +85,7 @@ public int read() throws IOException {
8485
}
8586

8687
@Test(expected = RuntimeException.class)
87-
public void test_invalid_stream() throws IOException {
88+
public void test_invalid_stream() throws IOException, ConfigurationException {
8889
FromHereCredentialsIniStream.getPropertiesFromIni(null, TEST_DEFAULT_INI_SECTION_NAME);
8990
}
9091

‎pom.xml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -65,11 +65,11 @@
6565

6666
<!-- Declare versions for dependencies -->
6767
<apache.httpclient.version>4.5.13</apache.httpclient.version>
68-
<ini4j.version>0.5.4</ini4j.version>
69-
<jackson.version>2.13.3</jackson.version>
68+
<commons-configuration2.version>2.12.0</commons-configuration2.version>
69+
<jackson.version>2.13.4.2</jackson.version>
7070
<junit.version>4.13.1</junit.version>
7171
<mockito.version>1.10.19</mockito.version>
72-
<ning.version>1.8.17</ning.version>
72+
<ning.version>1.9.0</ning.version>
7373
<browsermob.version>2.1.5</browsermob.version>
7474

7575
<!-- configure surefire and maven to be individually skippable -->
@@ -105,9 +105,9 @@
105105
<dependencyManagement>
106106
<dependencies>
107107
<dependency>
108-
<groupId>org.ini4j</groupId>
109-
<artifactId>ini4j</artifactId>
110-
<version>${ini4j.version}</version>
108+
<groupId>org.apache.commons</groupId>
109+
<artifactId>commons-configuration2</artifactId>
110+
<version>${commons-configuration2.version}</version>
111111
</dependency>
112112
<dependency>
113113
<groupId>com.fasterxml.jackson.core</groupId>

0 commit comments

Comments
 (0)