From bfe8dc174989c3220872be6e4d795d39b6c50f03 Mon Sep 17 00:00:00 2001 From: ashikuma Date: Mon, 7 Jul 2025 03:12:00 +0530 Subject: [PATCH] HERESUP-27616 IAM-6079 Fix dependency vulnurablities Signed-off-by: ashikuma --- here-oauth-client/pom.xml | 6 +- .../FromHereCredentialsIniStream.java | 48 ++++++++++------ .../account/auth/SignatureCalculatorTest.java | 55 ++++++++++--------- .../FromHereCredentialsIniStreamTest.java | 3 +- pom.xml | 16 +++--- 5 files changed, 71 insertions(+), 57 deletions(-) diff --git a/here-oauth-client/pom.xml b/here-oauth-client/pom.xml index 8b58712b..0c442815 100644 --- a/here-oauth-client/pom.xml +++ b/here-oauth-client/pom.xml @@ -81,8 +81,8 @@ - org.ini4j - ini4j + org.apache.commons + commons-configuration2 com.fasterxml.jackson.core @@ -105,7 +105,7 @@ test - com.ning + org.asynchttpclient async-http-client test diff --git a/here-oauth-client/src/main/java/com/here/account/auth/provider/FromHereCredentialsIniStream.java b/here-oauth-client/src/main/java/com/here/account/auth/provider/FromHereCredentialsIniStream.java index f033fc5c..a788ef69 100644 --- a/here-oauth-client/src/main/java/com/here/account/auth/provider/FromHereCredentialsIniStream.java +++ b/here-oauth-client/src/main/java/com/here/account/auth/provider/FromHereCredentialsIniStream.java @@ -4,12 +4,16 @@ import java.io.InputStream; import java.io.InputStreamReader; import java.io.Reader; +import java.util.Iterator; import java.util.Objects; import java.util.Properties; import com.here.account.util.Clock; import com.here.account.util.SettableSystemClock; -import org.ini4j.Ini; +import org.apache.commons.configuration2.INIConfiguration; +import org.apache.commons.configuration2.ex.ConfigurationException; +import org.apache.commons.configuration2.HierarchicalConfiguration; +import org.apache.commons.configuration2.tree.ImmutableNode; import com.here.account.auth.OAuth1ClientCredentialsProvider; import com.here.account.http.HttpConstants.HttpMethods; @@ -64,30 +68,38 @@ protected static ClientAuthorizationRequestProvider getClientCredentialsProvider try { Properties properties = getPropertiesFromIni(inputStream, sectionName); return FromSystemProperties.getClientCredentialsProviderWithDefaultTokenEndpointUrl(clock, properties); - } catch (IOException e) { + } catch (IOException | ConfigurationException e) { throw new RequestProviderException("trouble FromFile " + e, e); } } static final String DEFAULT_INI_SECTION_NAME = "default"; - - static Properties getPropertiesFromIni(InputStream inputStream, String sectionName) throws IOException { - Ini ini = new Ini(); + + static Properties getPropertiesFromIni(InputStream inputStream, String sectionName) throws IOException, ConfigurationException { try (Reader reader = new InputStreamReader(inputStream, OAuthConstants.UTF_8_CHARSET)) { - ini.load(reader); - Ini.Section section = ini.get(sectionName); + INIConfiguration ini = new INIConfiguration(); + ini.read(reader); + HierarchicalConfiguration section = ini.getSection(sectionName); Properties properties = new Properties(); - properties.put(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_ENDPOINT_URL_PROPERTY, - section.get(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_ENDPOINT_URL_PROPERTY)); - properties.put(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_ID_PROPERTY, - section.get(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_ID_PROPERTY)); - properties.put(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_SECRET_PROPERTY, - section.get(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_SECRET_PROPERTY)); - // scope is optional - String scope = section.get(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_SCOPE_PROPERTY); - if (null != scope) - properties.put(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_SCOPE_PROPERTY, scope); - + Iterator it = section.getKeys(); + while (it.hasNext()) { + String key = it.next(); + String value = section.getString(key); + switch (key.replaceAll("\\.+", ".")) { + case OAuth1ClientCredentialsProvider.FromProperties.TOKEN_ENDPOINT_URL_PROPERTY: + properties.put(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_ENDPOINT_URL_PROPERTY, value); + break; + case OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_ID_PROPERTY: + properties.put(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_ID_PROPERTY, value); + break; + case OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_SECRET_PROPERTY: + properties.put(OAuth1ClientCredentialsProvider.FromProperties.ACCESS_KEY_SECRET_PROPERTY, value); + break; + case OAuth1ClientCredentialsProvider.FromProperties.TOKEN_SCOPE_PROPERTY: + properties.put(OAuth1ClientCredentialsProvider.FromProperties.TOKEN_SCOPE_PROPERTY, value); + break; + } + } return properties; } } diff --git a/here-oauth-client/src/test/java/com/here/account/auth/SignatureCalculatorTest.java b/here-oauth-client/src/test/java/com/here/account/auth/SignatureCalculatorTest.java index a017c3e0..fb32791e 100644 --- a/here-oauth-client/src/test/java/com/here/account/auth/SignatureCalculatorTest.java +++ b/here-oauth-client/src/test/java/com/here/account/auth/SignatureCalculatorTest.java @@ -15,12 +15,15 @@ */ package com.here.account.auth; -import com.ning.http.client.FluentStringsMap; -import com.ning.http.client.oauth.ConsumerKey; -import com.ning.http.client.oauth.OAuthSignatureCalculator; -import com.ning.http.client.oauth.RequestToken; +import org.asynchttpclient.Param; +import org.asynchttpclient.oauth.ConsumerKey; +import org.asynchttpclient.oauth.OAuthSignatureCalculatorInstance; +import org.asynchttpclient.oauth.RequestToken; +import org.asynchttpclient.uri.Uri; +import org.asynchttpclient.util.Utf8UrlEncoder; import org.junit.Test; +import java.lang.reflect.Method; import java.security.*; import java.security.spec.*; import java.util.*; @@ -49,7 +52,7 @@ public class SignatureCalculatorTest { /////////////////////////////// HMAC-SHA1 ////////////////////////////////////////// @Test - public void testSignatureHmacSha1() { + public void testSignatureHmacSha1() throws Exception { String expectedSignature = computeSHA1SignatureUsingLibrary(baseURL, null, null); SignatureCalculator sc = new SignatureCalculator(consumerKey, consumerSecret); @@ -59,7 +62,7 @@ public void testSignatureHmacSha1() { } @Test - public void testSignatureHmacSha1WithFormParams() { + public void testSignatureHmacSha1WithFormParams() throws Exception { String expectedSignature = computeSHA1SignatureUsingLibrary(baseURL, params, null); SignatureCalculator sc = new SignatureCalculator(consumerKey, consumerSecret); @@ -69,7 +72,7 @@ public void testSignatureHmacSha1WithFormParams() { } @Test - public void testSignatureHmacSha1WithFormParamsWithSpacesInValue() { + public void testSignatureHmacSha1WithFormParamsWithSpacesInValue() throws Exception { Map> nestedParams = new HashMap<>(); nestedParams.put("http_method", Arrays.asList("POST")); @@ -87,7 +90,7 @@ public void testSignatureHmacSha1WithFormParamsWithSpacesInValue() { } @Test - public void testSignatureHmacSha1WithQueryParams() { + public void testSignatureHmacSha1WithQueryParams() throws Exception { String expectedSignature = computeSHA1SignatureUsingLibrary(baseURL, null, params); SignatureCalculator sc = new SignatureCalculator(consumerKey, consumerSecret); @@ -97,7 +100,7 @@ public void testSignatureHmacSha1WithQueryParams() { } @Test - public void testSignatureHmacSha1WithFormAndQueryParams() { + public void testSignatureHmacSha1WithFormAndQueryParams() throws Exception { String expectedSignature = computeSHA1SignatureUsingLibrary(baseURL, params, params); SignatureCalculator sc = new SignatureCalculator(consumerKey, consumerSecret); @@ -107,7 +110,7 @@ public void testSignatureHmacSha1WithFormAndQueryParams() { } @Test - public void testSignatureHmacSha1WithBaseURLWithPort() { + public void testSignatureHmacSha1WithBaseURLWithPort() throws Exception { String expectedSignature = computeSHA1SignatureUsingLibrary(baseURLWithPort, params, params); SignatureCalculator sc = new SignatureCalculator(consumerKey, consumerSecret); @@ -117,7 +120,7 @@ public void testSignatureHmacSha1WithBaseURLWithPort() { } @Test - public void testSignatureHmacSha1WithBaseURLWithNonStandardPort() { + public void testSignatureHmacSha1WithBaseURLWithNonStandardPort() throws Exception { String expectedSignature = computeSHA1SignatureUsingLibrary(baseURLWithNonStandardPort, params, params); SignatureCalculator sc = new SignatureCalculator(consumerKey, consumerSecret); @@ -127,7 +130,7 @@ public void testSignatureHmacSha1WithBaseURLWithNonStandardPort() { } @Test - public void testVerifySha1Signature() { + public void testVerifySha1Signature() throws Exception { String expectedSignature = computeSHA1SignatureUsingLibrary(baseURLWithNonStandardPort, params, params); boolean verified = SignatureCalculator.verifySignature(consumerKey, method, baseURLWithNonStandardPort, timestamp, nonce, @@ -260,23 +263,21 @@ public static KeyPair generateES512KeyPair() { } } - private static String computeSHA1SignatureUsingLibrary(String url, Map> formParams, Map> queryParams) { - RequestToken emptyUserAuth = new RequestToken(null, ""); - OAuthSignatureCalculator calculator = new OAuthSignatureCalculator(new ConsumerKey(consumerKey, consumerSecret), emptyUserAuth); - - FluentStringsMap fluentFormParams = null; - if (null != formParams && !formParams.isEmpty()) { - fluentFormParams = new FluentStringsMap(); - fluentFormParams.putAll(formParams); - } + private static String computeSHA1SignatureUsingLibrary(String url, Map> formParams, Map> queryParams) throws Exception { + Method computeSignature = OAuthSignatureCalculatorInstance.class.getDeclaredMethod("computeSignature", ConsumerKey.class, RequestToken.class, Uri.class, String.class, List.class, List.class, long.class, String.class); + computeSignature.setAccessible(true); + return (String) computeSignature.invoke(new OAuthSignatureCalculatorInstance(), new ConsumerKey(consumerKey, consumerSecret), new RequestToken(null, ""), Uri.create(url), method, toParamList(formParams), toParamList(queryParams), timestamp, Utf8UrlEncoder.percentEncodeQueryElement(nonce)); + } - FluentStringsMap fluentQueryParams = null; - if (null != queryParams && !queryParams.isEmpty()) { - fluentQueryParams = new FluentStringsMap(); - fluentQueryParams.putAll(queryParams); + private static List toParamList(Map> paramMap) { + if (paramMap == null || paramMap.isEmpty()) return null; + List paramList = new ArrayList<>(); + for (Map.Entry> entry : paramMap.entrySet()) { + for (String value : entry.getValue()) { + paramList.add(new Param(entry.getKey(), value)); + } } - - return calculator.calculateSignature(method, url, timestamp, nonce, fluentFormParams, fluentQueryParams); + return paramList; } private static Map> createParamsList() { diff --git a/here-oauth-client/src/test/java/com/here/account/auth/provider/FromHereCredentialsIniStreamTest.java b/here-oauth-client/src/test/java/com/here/account/auth/provider/FromHereCredentialsIniStreamTest.java index c4aaaebc..2f3369d0 100644 --- a/here-oauth-client/src/test/java/com/here/account/auth/provider/FromHereCredentialsIniStreamTest.java +++ b/here-oauth-client/src/test/java/com/here/account/auth/provider/FromHereCredentialsIniStreamTest.java @@ -20,6 +20,7 @@ import com.here.account.http.HttpProvider.HttpRequestAuthorizer; import com.here.account.oauth2.ClientAuthorizationRequestProvider; import com.here.account.util.Clock; +import org.apache.commons.configuration2.ex.ConfigurationException; import org.junit.Test; import org.mockito.Mockito; @@ -84,7 +85,7 @@ public int read() throws IOException { } @Test(expected = RuntimeException.class) - public void test_invalid_stream() throws IOException { + public void test_invalid_stream() throws IOException, ConfigurationException { FromHereCredentialsIniStream.getPropertiesFromIni(null, TEST_DEFAULT_INI_SECTION_NAME); } diff --git a/pom.xml b/pom.xml index be881c1a..4f2d8f4d 100644 --- a/pom.xml +++ b/pom.xml @@ -65,11 +65,11 @@ 4.5.13 - 0.5.4 - 2.13.3 + 2.12.0 + 2.19.1 4.13.1 1.10.19 - 1.8.17 + 2.12.4 2.1.5 @@ -105,9 +105,9 @@ - org.ini4j - ini4j - ${ini4j.version} + org.apache.commons + commons-configuration2 + ${commons-configuration2.version} com.fasterxml.jackson.core @@ -139,9 +139,9 @@ test - com.ning + org.asynchttpclient async-http-client - ${ning.version} + ${org.asynchttpclient.version} test