From 11adbcb80240b3ecba37e16226c49a2dae4a0c34 Mon Sep 17 00:00:00 2001
From: "adheli.tavares" <adheli.tavares@est.tech>
Date: Mon, 14 Apr 2025 16:37:46 +0100
Subject: [PATCH] Security uplift

- add a new openapi dependency after swagger openapi uplift
- fix error messages updated by new dependency versions
- uplift spring-cloud for participant k-serve

Issue-ID: POLICY-5302
Change-Id: I2d4cf20618aad0a4044a763c263f987fd4f6d075
Signed-off-by: adheli.tavares <adheli.tavares@est.tech>
---
 .../clamp/models/acm/persistence/concepts/JpaParticipant.java  |  5 ++++-
 participant/participant-impl/participant-impl-kserve/pom.xml   |  4 ++--
 participant/pom.xml                                            |  6 +++++-
 runtime-acm/pom.xml                                            |  6 +++++-
 .../commissioning/rest/CommissioningControllerTest.java        | 10 ++++------
 .../acm/runtime/contract/CommissioningControllerStubTest.java  |  9 ++++++---
 6 files changed, 26 insertions(+), 14 deletions(-)

diff --git a/models/src/main/java/org/onap/policy/clamp/models/acm/persistence/concepts/JpaParticipant.java b/models/src/main/java/org/onap/policy/clamp/models/acm/persistence/concepts/JpaParticipant.java
index 5bc2fc4cf..58c95b7bc 100644
--- a/models/src/main/java/org/onap/policy/clamp/models/acm/persistence/concepts/JpaParticipant.java
+++ b/models/src/main/java/org/onap/policy/clamp/models/acm/persistence/concepts/JpaParticipant.java
@@ -1,6 +1,6 @@
 /*-
  * ============LICENSE_START=======================================================
- * Copyright (C) 2021-2024 Nordix Foundation.
+ * Copyright (C) 2021-2025 OpenInfra Foundation Europe. All rights reserved.
  * ================================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,6 +31,7 @@ import jakarta.persistence.InheritanceType;
 import jakarta.persistence.JoinColumn;
 import jakarta.persistence.OneToMany;
 import jakarta.persistence.Table;
+import java.io.Serial;
 import java.io.Serializable;
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
@@ -60,6 +61,8 @@ import org.onap.policy.models.base.Validated;
 @EqualsAndHashCode(callSuper = false)
 public class JpaParticipant extends Validated
         implements PfAuthorative<Participant>, Comparable<JpaParticipant>, Serializable {
+
+    @Serial
     private static final long serialVersionUID = -4697758484642403483L;
 
     @Id
diff --git a/participant/participant-impl/participant-impl-kserve/pom.xml b/participant/participant-impl/participant-impl-kserve/pom.xml
index 499342f4b..0e15030b3 100644
--- a/participant/participant-impl/participant-impl-kserve/pom.xml
+++ b/participant/participant-impl/participant-impl-kserve/pom.xml
@@ -1,6 +1,6 @@
 <!--
   ============LICENSE_START=======================================================
-  Copyright (C) 2023-2025 Nordix Foundation.
+  Copyright (C) 2023-2025 OpenInfra Foundation Europe. All rights reserved.
   ================================================================================
   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
@@ -52,7 +52,7 @@
             <dependency>
                 <groupId>org.springframework.cloud</groupId>
                 <artifactId>spring-cloud-dependencies</artifactId>
-                <version>2024.0.0</version>
+                <version>2024.0.1</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
diff --git a/participant/pom.xml b/participant/pom.xml
index c26dfd0b3..2363ff317 100644
--- a/participant/pom.xml
+++ b/participant/pom.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
   ============LICENSE_START=======================================================
-  Copyright (C) 2021, 2023-2025 Nordix Foundation.
+  Copyright (C) 2021, 2023-2025 OpenInfra Foundation Europe. All rights reserved.
   ================================================================================
   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
@@ -120,6 +120,10 @@
             <groupId>io.micrometer</groupId>
             <artifactId>micrometer-tracing-bridge-otel</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.openapitools</groupId>
+            <artifactId>jackson-databind-nullable</artifactId>
+        </dependency>
     </dependencies>
 
     <build>
diff --git a/runtime-acm/pom.xml b/runtime-acm/pom.xml
index a44b76743..f934d9a40 100644
--- a/runtime-acm/pom.xml
+++ b/runtime-acm/pom.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
   ============LICENSE_START=======================================================
-  Copyright (C) 2021-2025 Nordix Foundation.
+  Copyright (C) 2021-2025 OpenInfra Foundation Europe. All rights reserved.
   ================================================================================
   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
@@ -157,6 +157,10 @@
             <groupId>org.aspectj</groupId>
             <artifactId>aspectjweaver</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.openapitools</groupId>
+            <artifactId>jackson-databind-nullable</artifactId>
+        </dependency>
         <dependency>
             <groupId>jakarta.servlet</groupId>
             <artifactId>jakarta.servlet-api</artifactId>
diff --git a/runtime-acm/src/test/java/org/onap/policy/clamp/acm/runtime/commissioning/rest/CommissioningControllerTest.java b/runtime-acm/src/test/java/org/onap/policy/clamp/acm/runtime/commissioning/rest/CommissioningControllerTest.java
index 16de37e7f..069708fe6 100644
--- a/runtime-acm/src/test/java/org/onap/policy/clamp/acm/runtime/commissioning/rest/CommissioningControllerTest.java
+++ b/runtime-acm/src/test/java/org/onap/policy/clamp/acm/runtime/commissioning/rest/CommissioningControllerTest.java
@@ -1,6 +1,6 @@
 /*-
  * ============LICENSE_START=======================================================
- *  Copyright (C) 2021-2024 Nordix Foundation.
+ *  Copyright (C) 2021-2025 OpenInfra Foundation Europe. All rights reserved.
  *  Modifications Copyright (C) 2021 AT&T Intellectual Property. All rights reserved.
  * ================================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -81,12 +81,12 @@ class CommissioningControllerTest extends CommonRestController {
      * starts Main and inserts a commissioning template.
      */
     @BeforeAll
-    public static void setUpBeforeClass() {
+    static void setUpBeforeClass() {
         serviceTemplate = InstantiationUtils.getToscaServiceTemplate(TOSCA_SERVICE_TEMPLATE_YAML);
     }
 
     @BeforeEach
-    public void setUpPort() {
+    void setUpPort() {
         super.setHttpPrefix(randomServerPort);
     }
 
@@ -123,9 +123,7 @@ class CommissioningControllerTest extends CommonRestController {
         assertThat(Response.Status.BAD_REQUEST.getStatusCode()).isEqualTo(resp.getStatus());
         var commissioningResponse = resp.readEntity(CommissioningResponse.class);
         assertThat(commissioningResponse.getErrorDetails())
-            .isEqualTo("org.springframework.http.converter.HttpMessageNotReadableException "
-                + "Could not read JSON: java.lang.IllegalStateException: "
-                + "Expected BEGIN_OBJECT but was STRING at line 1 column 1 path $");
+            .contains("org.springframework.http.converter.HttpMessageNotReadableException");
         assertThat(commissioningResponse.getAffectedAutomationCompositionDefinitions()).isNull();
         resp.close();
     }
diff --git a/runtime-acm/src/test/java/org/onap/policy/clamp/acm/runtime/contract/CommissioningControllerStubTest.java b/runtime-acm/src/test/java/org/onap/policy/clamp/acm/runtime/contract/CommissioningControllerStubTest.java
index 3172d4f23..7a159d959 100644
--- a/runtime-acm/src/test/java/org/onap/policy/clamp/acm/runtime/contract/CommissioningControllerStubTest.java
+++ b/runtime-acm/src/test/java/org/onap/policy/clamp/acm/runtime/contract/CommissioningControllerStubTest.java
@@ -1,6 +1,6 @@
 /*-
  * ============LICENSE_START=======================================================
- *  Copyright (C) 2022-2023 Nordix Foundation.
+ * Copyright (C) 2022-2023, 2025 OpenInfra Foundation Europe. All rights reserved.
  * ================================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -42,13 +42,13 @@ class CommissioningControllerStubTest extends CommonRestController {
 
     private static final String COMMISSIONING_ENDPOINT = "compositions";
     private static final String COMPOSITION_ID = "1aeed185-a98b-45b6-af22-8d5d20485ea3";
-    private static ToscaServiceTemplate serviceTemplate = new ToscaServiceTemplate();
+    private static final ToscaServiceTemplate serviceTemplate = new ToscaServiceTemplate();
 
     @LocalServerPort
     private int randomServerPort;
 
     @BeforeEach
-    public void setUpPort() {
+    void setUpPort() {
         super.setHttpPrefix(randomServerPort);
     }
 
@@ -71,6 +71,7 @@ class CommissioningControllerStubTest extends CommonRestController {
         var invocationBuilder = super.sendRequest(COMMISSIONING_ENDPOINT + "/" + COMPOSITION_ID);
         var respPost = invocationBuilder.put(Entity.json(serviceTemplate));
         assertThat(Response.Status.ACCEPTED.getStatusCode()).isEqualTo(respPost.getStatus());
+        respPost.close();
     }
 
     @Test
@@ -78,6 +79,7 @@ class CommissioningControllerStubTest extends CommonRestController {
         var invocationBuilder = super.sendRequest(COMMISSIONING_ENDPOINT);
         var respPost = invocationBuilder.post(Entity.json(serviceTemplate));
         assertThat(Response.Status.OK.getStatusCode()).isEqualTo(respPost.getStatus());
+        respPost.close();
     }
 
     @Test
@@ -85,5 +87,6 @@ class CommissioningControllerStubTest extends CommonRestController {
         var invocationBuilder = super.sendRequest(COMMISSIONING_ENDPOINT + "/" + COMPOSITION_ID);
         var respPost = invocationBuilder.delete();
         assertThat(Response.Status.OK.getStatusCode()).isEqualTo(respPost.getStatus());
+        respPost.close();
     }
 }
-- 
2.16.6