Remove jackson to avoid security issues

Fix security issues raised by LF

Issue-ID: VNFSDK-161

Change-Id: I9cd93c56897b63e6153da06d11fc9b39a20f541b
Signed-off-by: Murali-P <murali.p@huawei.com>

diff --git a/vnfmarket-be/vnf-sdk-marketplace/pom.xml b/vnfmarket-be/vnf-sdk-marketplace/pom.xml
index 0f4fd77..cce1564 100644 (file)
--- a/vnfmarket-be/vnf-sdk-marketplace/pom.xml
+++ b/vnfmarket-be/vnf-sdk-marketplace/pom.xml
@@ -76,7 +76,7 @@
                <dependency>
                        <groupId>io.swagger</groupId>
                        <artifactId>swagger-jersey2-jaxrs</artifactId>
-                       <version>1.5.3</version>
+                       <version>1.5.18</version>
                </dependency>
                <!-- jersey -->
                <dependency>
@@ -163,22 +163,8 @@
                        <artifactId>ant</artifactId>
                        <version>1.8.2</version>
                        <scope>test</scope>
-               </dependency>
-                <dependency>
-                        <groupId>com.fasterxml.jackson.core</groupId>
-                        <artifactId>jackson-databind</artifactId>
-                        <version>2.9.4</version>
-                </dependency>
-               <dependency>
-                       <groupId>org.codehaus.jackson</groupId>
-                       <artifactId>jackson-jaxrs</artifactId>
-                       <version>1.9.13</version>
-               </dependency>
-               <dependency>
-                       <groupId>org.codehaus.jackson</groupId>
-                       <artifactId>jackson-mapper-asl</artifactId>
-                       <version>1.9.13</version>
-               </dependency>
+               </dependency>              
+               
                
                <dependency>
                        <groupId>org.apache.commons</groupId>

diff --git a/vnfmarket-be/vnf-sdk-marketplace/src/main/java/org/onap/vnfsdk/marketplace/common/JsonUtil.java b/vnfmarket-be/vnf-sdk-marketplace/src/main/java/org/onap/vnfsdk/marketplace/common/JsonUtil.java
deleted file mode 100644 (file)
index 1a47522..0000000
--- a/vnfmarket-be/vnf-sdk-marketplace/src/main/java/org/onap/vnfsdk/marketplace/common/JsonUtil.java
+++ /dev/null
@@ -1,75 +0,0 @@
-/*
- * Copyright 2016 Huawei Technologies Co., Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.onap.vnfsdk.marketplace.common;
-
-import java.io.IOException;
-
-import org.codehaus.jackson.map.DeserializationConfig;
-import org.codehaus.jackson.map.ObjectMapper;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Json tools class, packaging a number of commonly used Json methods.<br>
- * 
- * @author
- * @version GSO 0.5 2016-08-26
- */
-public final class JsonUtil {
-
-    private static final Logger LOGGER = LoggerFactory.getLogger(JsonUtil.class);
-
-    private JsonUtil() {
-    }
-
-    /**
-     * Convert object to JSON.<br>
-     * 
-     * @param obj The object to be converted
-     * @return The JSON string
-     * @since GSO 0.5
-     */
-    public static String toJson(Object obj) {
-        try {
-            return new ObjectMapper().writeValueAsString(obj);
-        } catch (IOException ex) {
-            LOGGER.error("Parser to json error.", ex);
-            throw new IllegalArgumentException("Parser obj to json error, obj = " + obj, ex);
-        }
-    }
-
-    /**
-     * Convert JSON to object.<br>
-     * 
-     * @param jsonStr The JSON to be converted
-     * @param objClass The object class
-     * @return The objClass object
-     * @since GSO 0.5
-     */
-    public static <T> T fromJson(String jsonStr, Class<T> objClass) {
-        try {
-            ObjectMapper mapper = new ObjectMapper();
-            mapper.configure(DeserializationConfig.Feature.FAIL_ON_UNKNOWN_PROPERTIES, false);
-            return mapper.readValue(jsonStr, objClass);
-        } catch (IOException ex) {
-            LOGGER.error("Parser to object error.", ex);
-            throw new IllegalArgumentException(
-                    "Parser json to object error, json = " + jsonStr + ", expect class = " + objClass, ex);
-        }
-    }
-
-}

diff --git a/vnfmarket-be/vnf-sdk-marketplace/src/main/java/org/onap/vnfsdk/marketplace/onboarding/hooks/validatelifecycle/LifecycleTestExceutor.java b/vnfmarket-be/vnf-sdk-marketplace/src/main/java/org/onap/vnfsdk/marketplace/onboarding/hooks/validatelifecycle/LifecycleTestExceutor.java
index f48a07f..d3f161f 100644 (file)
--- a/vnfmarket-be/vnf-sdk-marketplace/src/main/java/org/onap/vnfsdk/marketplace/onboarding/hooks/validatelifecycle/LifecycleTestExceutor.java
+++ b/vnfmarket-be/vnf-sdk-marketplace/src/main/java/org/onap/vnfsdk/marketplace/onboarding/hooks/validatelifecycle/LifecycleTestExceutor.java
@@ -23,7 +23,6 @@ import org.apache.http.entity.ContentType;
 import org.apache.http.entity.mime.MultipartEntityBuilder;
 import org.onap.vnfsdk.marketplace.common.CommonConstant;
 import org.onap.vnfsdk.marketplace.common.FileUtil;
-import org.onap.vnfsdk.marketplace.common.JsonUtil;
 import org.onap.vnfsdk.marketplace.msb.MsbDetails;
 import org.onap.vnfsdk.marketplace.msb.MsbDetailsHolder;
 import org.onap.vnfsdk.marketplace.onboarding.entity.OnBoradingRequest;
@@ -129,11 +128,11 @@ public class LifecycleTestExceutor {
                        return result;
                }
 
-               String rawDataJson = JsonUtil.toJson(oLifeCycleTestReq);
-               if (null == rawDataJson) {
-                       logger.error("Failed to convert LifeCycleTestReq object to Json String !!!");
-                       return result;
-               }
+               String rawDataJson = ""; //TBD - Use Gson - jackson has security issue//JsonUtil.toJson(oLifeCycleTestReq);
+//             if (null == rawDataJson) {
+//                     logger.error("Failed to convert LifeCycleTestReq object to Json String !!!");
+//                     return result;
+//             }
 
                RestResponse oResponse = RestfulClient.sendPostRequest(oMsbDetails.getDefaultServer().getHost(),
                                oMsbDetails.getDefaultServer().getPort(), CommonConstant.LifeCycleTest.LIFECYCLE_TEST_URL, rawDataJson);

diff --git a/vnfmarket-be/vnf-sdk-marketplace/src/main/java/org/onap/vnfsdk/marketplace/wrapper/PackageWrapper.java b/vnfmarket-be/vnf-sdk-marketplace/src/main/java/org/onap/vnfsdk/marketplace/wrapper/PackageWrapper.java
index d779bf5..d793a32 100644 (file)
--- a/vnfmarket-be/vnf-sdk-marketplace/src/main/java/org/onap/vnfsdk/marketplace/wrapper/PackageWrapper.java
+++ b/vnfmarket-be/vnf-sdk-marketplace/src/main/java/org/onap/vnfsdk/marketplace/wrapper/PackageWrapper.java
@@ -38,7 +38,6 @@ import org.glassfish.jersey.media.multipart.FormDataContentDisposition;
 import org.onap.validation.csar.CsarValidator;
 import org.onap.vnfsdk.marketplace.common.CommonConstant;
 import org.onap.vnfsdk.marketplace.common.FileUtil;
-import org.onap.vnfsdk.marketplace.common.JsonUtil;
 import org.onap.vnfsdk.marketplace.common.RestUtil;
 import org.onap.vnfsdk.marketplace.common.ToolUtil;
 import org.onap.vnfsdk.marketplace.db.entity.PackageData;
@@ -86,8 +85,8 @@ public class PackageWrapper {
             return Response.status(Status.EXPECTATION_FAILED).build();
         }
 
-        ValidateLifecycleTestResponse lyfValidateResp =
-                JsonUtil.fromJson(reqParam, ValidateLifecycleTestResponse.class);
+        ValidateLifecycleTestResponse lyfValidateResp = null; //TBD - Use Gson - jackson has security issue/
+                //JsonUtil.fromJson(reqParam, ValidateLifecycleTestResponse.class);
         if(!checkOperationSucess(lyfValidateResp)) {
             return Response.status(Status.EXPECTATION_FAILED).build();
         }

diff --git a/vnfmarket-be/vnf-sdk-marketplace/src/test/java/org/onap/vnfsdk/marketplace/resource/PackageResourceTest.java b/vnfmarket-be/vnf-sdk-marketplace/src/test/java/org/onap/vnfsdk/marketplace/resource/PackageResourceTest.java
index 1281200..d1562f8 100644 (file)
--- a/vnfmarket-be/vnf-sdk-marketplace/src/test/java/org/onap/vnfsdk/marketplace/resource/PackageResourceTest.java
+++ b/vnfmarket-be/vnf-sdk-marketplace/src/test/java/org/onap/vnfsdk/marketplace/resource/PackageResourceTest.java
@@ -35,13 +35,10 @@ import java.util.zip.ZipOutputStream;
 
 import javax.ws.rs.core.Response;
 
-import org.apache.ibatis.exceptions.PersistenceException;
-import org.codehaus.jackson.JsonNode;
 import org.glassfish.jersey.media.multipart.FormDataContentDisposition;
 import org.junit.Before;
 import org.junit.Test;
 import org.onap.vnfsdk.marketplace.common.FileUtil;
-import org.onap.vnfsdk.marketplace.common.JsonUtil;
 import org.onap.vnfsdk.marketplace.common.ToolUtil;
 import org.onap.vnfsdk.marketplace.db.entity.PackageData;
 import org.onap.vnfsdk.marketplace.db.impl.MarketplaceDaoImpl;
@@ -1032,21 +1029,6 @@ public class PackageResourceTest {
         assertEquals(res, true);
     }
 
-    @Test
-    public void testToJson() {
-        List<String> listObj = new ArrayList<String>();
-        listObj.add("test");
-        String res = JsonUtil.toJson(listObj);
-        assertNotNull(res);
-    }
-
-    @Test
-    public void testfromJson() {
-
-        String carJson = "{ \"brand\" : \"Mercedes\", \"doors\" : 5 }";
-        JsonNode res = JsonUtil.fromJson(carJson, JsonNode.class);
-        assertNotNull(res);
-    }
 
     @Test
     public void testUnzip() {