From 37f851ed3531f7658fb8a1d7c39609f14a83ecef Mon Sep 17 00:00:00 2001 From: HuabingZhao Date: Fri, 19 Jan 2018 13:10:54 +0000 Subject: [PATCH] Fix Nexus-IQ security issues update dependency libs Issue-ID: MSB-129 Change-Id: Ibfaf15b9690accc1ecabfa92c78ca1cc2c1372bc Signed-off-by: HuabingZhao --- .../apiroute-service/dependency-reduced-pom.xml | 8 +- apiroute/apiroute-service/pom.xml | 402 ++++---- .../java/org/onap/msb/apiroute/ApiRouteApp.java | 7 +- .../onap/msb/apiroute/wrapper/util/Jackson.java | 3 - apiroute/pom.xml | 1059 ++++++++++++++------ 5 files changed, 981 insertions(+), 498 deletions(-) diff --git a/apiroute/apiroute-service/dependency-reduced-pom.xml b/apiroute/apiroute-service/dependency-reduced-pom.xml index 80f4497..af5b3fe 100644 --- a/apiroute/apiroute-service/dependency-reduced-pom.xml +++ b/apiroute/apiroute-service/dependency-reduced-pom.xml @@ -262,7 +262,7 @@ junit junit - 4.11 + 4.12 test @@ -303,12 +303,6 @@ - - com.fiftyonred - mock-jedis - 0.4.0 - test - diff --git a/apiroute/apiroute-service/pom.xml b/apiroute/apiroute-service/pom.xml index 48e17ea..630521c 100644 --- a/apiroute/apiroute-service/pom.xml +++ b/apiroute/apiroute-service/pom.xml @@ -1,11 +1,11 @@ - @@ -35,11 +35,6 @@ io.dropwizard dropwizard-client - - io.swagger - swagger-jersey2-jaxrs - compile - redis.clients @@ -103,21 +98,21 @@ - commons-io - commons-io - + commons-io + commons-io + - - org.onap.msb.swagger-sdk - swagger-sdk - 1.0.0 - - - org.slf4j - slf4j-log4j12 - - - + + org.onap.msb.swagger-sdk + swagger-sdk + 1.0.1-SNAPSHOT + + + org.slf4j + slf4j-log4j12 + + + @@ -172,200 +167,215 @@ - - org.codehaus.mojo - properties-maven-plugin - 1.0.0 - - - initialize - - read-project-properties - - - + + org.codehaus.mojo + properties-maven-plugin + 1.0.0 + + + initialize + + read-project-properties + + + ${basedir}/src/main/resources/swagger.properties - - - - - - - com.github.kongchen - swagger-maven-plugin - 3.1.4 - - - - ${api-rest-package} - - http - https - - ${api-host-ip}:${api-host-port} - ${api-base-path} - - ${api-title} - ${api-version} - ${api-description} - - ${api-license} - - - ${basedir}/src/main/resources - - - - - - compile - - generate - - - - - - org.apache.maven.plugins - maven-install-plugin - 2.3.1 - - - install-file-id - install - - install-file - - - ${basedir}/src/main/resources/swagger.json - ${project.groupId} - ${project.artifactId}-swagger-schema - ${project.version} - json - - - - + + + + + + + com.github.kongchen + swagger-maven-plugin + 3.1.4 + + + + ${api-rest-package} + + http + https + + ${api-host-ip}:${api-host-port} + ${api-base-path} + + ${api-title} + ${api-version} + ${api-description} + + ${api-license} + + + ${basedir}/src/main/resources + + + + + + compile + + generate + + + + + + org.apache.maven.plugins + maven-install-plugin + 2.3.1 + + + install-file-id + install + + install-file + + + ${basedir}/src/main/resources/swagger.json + ${project.groupId} + ${project.artifactId}-swagger-schema + ${project.version} + json + + + + - - + + org.apache.maven.plugins maven-antrun-plugin 1.8 - - initialize - ant-create-script - - true - - - - - - - - - - - - - - - - - - - - - - - - - - run - - + + initialize + ant-create-script + + true + + + + + + + + + + + + + + + + + + + + + + + + + + run + + - - ant-contrib - ant-contrib - 1.0b3 - - - ant - ant - - - + + ant-contrib + ant-contrib + 1.0b3 + + + ant + ant + + + - - + + io.swagger swagger-codegen-maven-plugin 2.2.1 - - - generate - - - ${basedir}/src/main/resources/swagger.json - ${project.build.directory}/generated-sources - java - - joda - - jersey2 - ${project.groupId} - ${project.artifactId} - ${project.version} - ${project.groupId}.${project.artifactId}.client.model - ${project.groupId}.${project.artifactId}.client.api - ${project.groupId}.${project.artifactId}.client.invoker - - + + + generate + + + ${basedir}/src/main/resources/swagger.json + ${project.build.directory}/generated-sources + java + + joda + + jersey2 + ${project.groupId} + ${project.artifactId} + ${project.version} + ${project.groupId}.${project.artifactId}.client.model + ${project.groupId}.${project.artifactId}.client.api + ${project.groupId}.${project.artifactId}.client.invoker + + - - + + exec-maven-plugin org.codehaus.mojo 1.5.0 - - swagger-generate-sources - generate-sources - - exec - - - ${project.build.directory}${file.separator}${swagger.sdk.script.file} - - + + swagger-generate-sources + generate-sources + + exec + + + ${project.build.directory}${file.separator}${swagger.sdk.script.file} + + - - + + org.apache.maven.plugins maven-clean-plugin 3.0.0 - - clean-generated-files - generate-sources - - clean - - - - - ${project.build.directory}/generated-sources - - - - + + clean-generated-files + generate-sources + + clean + + + + + ${project.build.directory}/generated-sources + + + + - + diff --git a/apiroute/apiroute-service/src/main/java/org/onap/msb/apiroute/ApiRouteApp.java b/apiroute/apiroute-service/src/main/java/org/onap/msb/apiroute/ApiRouteApp.java index fb8147d..697351a 100644 --- a/apiroute/apiroute-service/src/main/java/org/onap/msb/apiroute/ApiRouteApp.java +++ b/apiroute/apiroute-service/src/main/java/org/onap/msb/apiroute/ApiRouteApp.java @@ -32,6 +32,7 @@ import io.dropwizard.setup.Bootstrap; import io.dropwizard.setup.Environment; import io.swagger.jaxrs.config.BeanConfig; import io.swagger.jaxrs.listing.ApiListingResource; +import java.util.Optional; public class ApiRouteApp extends Application { @@ -111,13 +112,15 @@ public class ApiRouteApp extends Application { config.setResourcePackage("org.onap.msb.apiroute.resources"); SimpleServerFactory simpleServerFactory = (SimpleServerFactory) configuration.getServerFactory(); String basePath = simpleServerFactory.getApplicationContextPath(); - String rootPath = simpleServerFactory.getJerseyRootPath(); + Optional optRootPath = simpleServerFactory.getJerseyRootPath(); + + String rootPath = optRootPath.get(); rootPath = rootPath.substring(0, rootPath.indexOf("/*")); basePath = basePath.equals("/") ? rootPath : (new StringBuilder()).append(basePath).append(rootPath).toString(); - LOGGER.warn("getApplicationContextPath： " + basePath); + LOGGER.info("getApplicationContextPath： " + basePath); config.setBasePath(basePath); config.setScan(true); } diff --git a/apiroute/apiroute-service/src/main/java/org/onap/msb/apiroute/wrapper/util/Jackson.java b/apiroute/apiroute-service/src/main/java/org/onap/msb/apiroute/wrapper/util/Jackson.java index 85c1e3a..1e5abd1 100644 --- a/apiroute/apiroute-service/src/main/java/org/onap/msb/apiroute/wrapper/util/Jackson.java +++ b/apiroute/apiroute-service/src/main/java/org/onap/msb/apiroute/wrapper/util/Jackson.java @@ -9,13 +9,11 @@ * Unless required by applicable law or agreed to in writing, software distributed under the License * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express * or implied. See the License for the specific language governing permissions and limitations under - * the License. ******************************************************************************/ package org.onap.msb.apiroute.wrapper.util; import com.fasterxml.jackson.databind.ObjectMapper; import com.fasterxml.jackson.datatype.guava.GuavaModule; -import com.fasterxml.jackson.datatype.jdk7.Jdk7Module; import com.fasterxml.jackson.datatype.joda.JodaModule; public class Jackson { @@ -34,7 +32,6 @@ public class Jackson { private static ObjectMapper configure(ObjectMapper mapper) { mapper.registerModule(new GuavaModule()); mapper.registerModule(new JodaModule()); - mapper.registerModule(new Jdk7Module()); return mapper; } diff --git a/apiroute/pom.xml b/apiroute/pom.xml index 515f3fe..6385518 100644 --- a/apiroute/pom.xml +++ b/apiroute/pom.xml @@ -1,310 +1,789 @@ - - - - org.onap.msb.apigateway - msb-apigateway-parent - 1.1.0-SNAPSHOT - - 4.0.0 - org.onap.msb.apigateway.apiroute - apiroute-parent - onap/msb/apigateway/apiroute - pom - 1.1.0-SNAPSHOT - - - apiroute-service - apiroute-standalone - + + + + org.onap.msb.apigateway + msb-apigateway-parent + 1.1.0-SNAPSHOT + + 4.0.0 + org.onap.msb.apigateway.apiroute + apiroute-parent + onap/msb/apigateway/apiroute + pom + 1.1.0-SNAPSHOT - + + apiroute-service + apiroute-standalone + - UTF-8 - UTF-8 + - - - 1.7 - 1.7 - ${maven.compiler.source} - ${maven.compiler.target} + UTF-8 + UTF-8 + + 1.8 + 3.0.0 + 2.6.1 + 3.3 + 2.6 + 2.10.3 + 3.4 + 2.5.2 + 2.18.1 - - 1.8 - 3.0.0 - 2.6.1 - 3.3 - 2.6 - 2.10.3 - 3.4 - 2.5.2 - 2.18.1 + + 2.16 + ${maven.compile.plugin.version} + 1.4 - - 2.16 - ${maven.compile.plugin.version} - 1.4 - - 0.8.0 - 1.5.3 - 2.7.3 - 1.16.16 - 4.11 - 9.2.9.v20150224 - 2.7.9 - 2.16 - 1.7.12 - 1.2.3 - 4.5.4 - 1.6.6 - 1.17.10.01 - 0.13.8 - 4.1.2 - 2.4.3 - 0.4.0 - 1.3.2 - + + 1.2.2 + 23.5-jre + 2.25.1 + 2.9.3 + 9.4.8.v20171121 + 3.0.0.v201112011016 + 3.2.5 + 1.7.25 + 1.2.3 + 1.4.196 + 1.5.8 - - - - commons-io - commons-io - ${commons-io.version} - - - - junit - junit - ${junit.version} - test - + 2.7.3 + 1.16.16 + 4.11 + 1.6.6 + 0.13.8 + 4.1.2 + 1.3.2 + 2.4.3 + 0.4.0 + - - org.powermock - powermock-module-junit4 - ${powermock.version} - test - + + + + org.objenesis + objenesis + 2.6 + + + org.apache.commons + commons-lang3 + 3.6 + + + com.google.guava + guava + ${guava.version} + + + net.sourceforge.argparse4j + argparse4j + 0.7.0 + + + com.google.code.findbugs + jsr305 + 3.0.2 + + + joda-time + joda-time + 2.9.9 + + + org.hibernate + hibernate-validator + 5.4.2.Final + + + org.glassfish + javax.el + 3.0.0 + + + javax.servlet + javax.servlet-api + 3.1.0 + + + org.apache.httpcomponents + httpclient + 4.5.3 + + + commons-logging + commons-logging + + + + + org.apache.tomcat + tomcat-jdbc + 8.5.24 + + + com.h2database + h2 + ${h2.version} + + + org.jadira.usertype + usertype.core + 6.0.1.GA + + + org.slf4j + slf4j-api + + + org.joda + joda-money + + + org.apache.geronimo.specs + geronimo-jta_1.1_spec + + + + + org.hibernate + hibernate-core + 5.2.12.Final + + + org.jboss.logging + jboss-logging + + + + + org.javassist + javassist + 3.22.0-GA + + + com.fasterxml + classmate + 1.3.4 + + + org.hsqldb + hsqldb + 2.4.0 + + + org.liquibase + liquibase-core + 3.5.3 + + + org.yaml + snakeyaml + + + + + com.mattbertolini + liquibase-slf4j + 2.0.0 + + + org.slf4j + slf4j-api + + + org.liquibase + liquibase-core + + + + + net.jcip + jcip-annotations + 1.0 + + + com.github.spullara.mustache.java + compiler + 0.9.5 + + + com.google.guava + guava + + + + + org.freemarker + freemarker + 2.3.27-incubating + + + org.jdbi + jdbi + 2.78 + - - org.powermock - powermock-api-mockito - ${powermock.version} - test - - - com.fiftyonred - mock-jedis - ${mock-jedis.version} - test - + + + org.eclipse.jetty + jetty-server + ${jetty.version} + + + org.eclipse.jetty + jetty-util + ${jetty.version} + + + org.eclipse.jetty + jetty-webapp + ${jetty.version} + + + org.eclipse.jetty + jetty-continuation + ${jetty.version} + + + org.eclipse.jetty + jetty-servlet + ${jetty.version} + + + org.eclipse.jetty + jetty-servlet + tests + ${jetty.version} + + + org.eclipse.jetty + jetty-servlets + ${jetty.version} + + + org.eclipse.jetty + jetty-http + ${jetty.version} + + + org.eclipse.jetty + jetty-http + tests + ${jetty.version} + + + org.eclipse.jetty + jetty-alpn-openjdk8-server + ${jetty.version} + + + org.eclipse.jetty.http2 + http2-server + ${jetty.version} + + + org.eclipse.jetty.http2 + http2-client + ${jetty.version} + + + org.eclipse.jetty + jetty-client + ${jetty.version} + + + org.eclipse.jetty.http2 + http2-http-client-transport + ${jetty.version} + + + org.eclipse.jetty + jetty-alpn-openjdk8-client + ${jetty.version} + + + org.eclipse.jetty + jetty-alpn-conscrypt-server + ${jetty.version} + + + org.eclipse.jetty.toolchain.setuid + jetty-setuid-java + 1.0.3 + + + org.eclipse.jetty + jetty-util + + + org.eclipse.jetty + jetty-server + + + - - - io.dropwizard - dropwizard-core - ${dropwizard.version} - + + + com.fasterxml.jackson + jackson-bom + ${jackson.version} + pom + import + - - io.dropwizard - dropwizard-assets - ${dropwizard.version} - + + + org.glassfish.jersey + jersey-bom + ${jersey.version} + pom + import + + + + io.dropwizard.metrics + metrics-annotation + ${metrics3.version} + + + io.dropwizard.metrics + metrics-core + ${metrics3.version} + + + org.slf4j + slf4j-api + + + + + io.dropwizard.metrics + metrics-jvm + ${metrics3.version} + + + org.slf4j + slf4j-api + + + + + io.dropwizard.metrics + metrics-servlets + ${metrics3.version} + + + com.fasterxml.jackson.core + jackson-databind + + + org.slf4j + slf4j-api + + + + + io.dropwizard.metrics + metrics-healthchecks + ${metrics3.version} + + + org.slf4j + slf4j-api + + + + + io.dropwizard.metrics + metrics-logback + ${metrics3.version} + + + ch.qos.logback + logback-classic + + + org.slf4j + slf4j-api + + + + + io.dropwizard.metrics + metrics-jersey2 + ${metrics3.version} + + + org.glassfish.jersey.core + jersey-server + + + org.slf4j + slf4j-api + + + + + io.dropwizard.metrics + metrics-jetty9 + ${metrics3.version} + + + org.eclipse.jetty + jetty-server + + + org.slf4j + slf4j-api + + + + + io.dropwizard.metrics + metrics-httpclient + ${metrics3.version} + + + commons-logging + commons-logging + + + org.slf4j + slf4j-api + + + org.apache.httpcomponents + httpclient + + + + + io.dropwizard.metrics + metrics-jdbi + ${metrics3.version} + + + org.jdbi + jdbi + + + org.slf4j + slf4j-api + + + + + io.dropwizard.metrics + metrics-ganglia + ${metrics3.version} + + + org.slf4j + slf4j-api + + + + + io.dropwizard.metrics + metrics-graphite + ${metrics3.version} + + + org.slf4j + slf4j-api + + + - - io.dropwizard - dropwizard-client - ${dropwizard.version} - + + + org.slf4j + slf4j-api + ${slf4j.version} + + + org.slf4j + jul-to-slf4j + ${slf4j.version} + + + org.slf4j + log4j-over-slf4j + ${slf4j.version} + + + org.slf4j + jcl-over-slf4j + ${slf4j.version} + + + ch.qos.logback + logback-access + ${logback.version} + + + ch.qos.logback + logback-core + ${logback.version} + + + ch.qos.logback + logback-classic + ${logback.version} + + + org.slf4j + slf4j-api + + + - - io.swagger - swagger-jersey2-jaxrs - ${swagger.version} - compile - - + + + junit + junit + 4.12 + + + org.hamcrest + hamcrest-core + 1.3 + + + org.glassfish.jersey.test-framework + jersey-test-framework-core + ${jersey.version} + + + javax.servlet + javax.servlet-api + + + + + org.glassfish.jersey.test-framework.providers + jersey-test-framework-provider-grizzly2 + ${jersey.version} + + + javax.servlet + javax.servlet-api + + + + + org.glassfish.jersey.test-framework.providers + jersey-test-framework-provider-inmemory + ${jersey.version} + + + javax.servlet + javax.servlet-api + + + - - redis.clients - jedis - ${jedis.version} - - - org.projectlombok - lombok - ${lombok.version} - - - - org.glassfish.jersey.media - jersey-media-multipart - ${jersey.version} - - - org.glassfish.jersey.containers - jersey-container-servlet-core - ${jersey.version} - - - org.glassfish.jersey.core - jersey-common - ${jersey.version} - + + + io.dropwizard + dropwizard-assets + ${dropwizard.version} + + + io.dropwizard + dropwizard-auth + ${dropwizard.version} + + + io.dropwizard + dropwizard-client + ${dropwizard.version} + + + io.dropwizard + dropwizard-configuration + ${dropwizard.version} + + + io.dropwizard + dropwizard-core + ${dropwizard.version} + + + io.dropwizard + dropwizard-db + ${dropwizard.version} + + + io.dropwizard + dropwizard-forms + ${dropwizard.version} + + + io.dropwizard + dropwizard-hibernate + ${dropwizard.version} + + + io.dropwizard + dropwizard-jackson + ${dropwizard.version} + + + io.dropwizard + dropwizard-jdbi + ${dropwizard.version} + + + io.dropwizard + dropwizard-jersey + ${dropwizard.version} + + + io.dropwizard + dropwizard-jetty + ${dropwizard.version} + + + io.dropwizard + dropwizard-lifecycle + ${dropwizard.version} + + + io.dropwizard + dropwizard-logging + ${dropwizard.version} + + + io.dropwizard + dropwizard-metrics + ${dropwizard.version} + + + io.dropwizard + dropwizard-metrics-ganglia + ${dropwizard.version} + + + io.dropwizard + dropwizard-metrics-graphite + ${dropwizard.version} + + + io.dropwizard + dropwizard-migrations + ${dropwizard.version} + + + io.dropwizard + dropwizard-request-logging + ${dropwizard.version} + + + io.dropwizard + dropwizard-servlets + ${dropwizard.version} + + + io.dropwizard + dropwizard-testing + ${dropwizard.version} + + + io.dropwizard + dropwizard-util + ${dropwizard.version} + + + io.dropwizard + dropwizard-validation + ${dropwizard.version} + + + io.dropwizard + dropwizard-views + ${dropwizard.version} + + + io.dropwizard + dropwizard-views-freemarker + ${dropwizard.version} + + + io.dropwizard + dropwizard-views-mustache + ${dropwizard.version} + + + io.dropwizard + dropwizard-http2 + ${dropwizard.version} + + + commons-io + commons-io + ${commons-io.version} + + + com.orbitz.consul + consul-client + ${consul-client.version} + + + org.apache.httpcomponents + httpasyncclient + ${httpasyncclient.version} + - - - com.fasterxml.jackson.core - jackson-core - ${jackson-version} - - - com.fasterxml.jackson.core - jackson-databind - 2.7.9.1 - - - com.fasterxml.jackson.core - jackson-annotations - ${jackson-version} - - - com.fasterxml.jackson.dataformat - jackson-dataformat-xml - ${jackson-version} - - - com.fasterxml.jackson.dataformat - jackson-dataformat-yaml - ${jackson-version} - - - com.fasterxml.jackson.module - jackson-module-jaxb-annotations - ${jackson-version} - + + org.immutables + value + ${immutables.value.version} + - - - org.eclipse.jetty - jetty-io - ${jetty.version} - - - org.eclipse.jetty - jetty-util - ${jetty.version} - - - org.eclipse.jetty - jetty-http - ${jetty.version} - - - org.eclipse.jetty - jetty-client - ${jetty.version} - - - org.eclipse.jetty - jetty-continuation - ${jetty.version} - - - org.eclipse.jetty - jetty-jmx - ${jetty.version} - - - org.eclipse.jetty - jetty-webapp - ${jetty.version} - - - org.eclipse.jetty - jetty-xml - ${jetty.version} - - - org.eclipse.jetty - jetty-servlet - ${jetty.version} - - - org.eclipse.jetty - jetty-security - ${jetty.version} - - - org.eclipse.jetty - jetty-server - ${jetty.version} - - - - org.slf4j - slf4j-api - ${slf4j.version} - + + com.fiftyonred + mock-jedis + ${mock-jedis.version} + + + redis.clients + jedis + ${jedis.version} + + + org.projectlombok + lombok + ${lombok.version} + + + org.powermock + powermock-module-junit4 + ${powermock.version} + test + + + org.powermock + powermock-api-mockito + ${powermock.version} + test + + + - - ch.qos.logback - logback-classic - ${logback.version} - - - - - ch.qos.logback - logback-core - ${logback.version} - - - - - org.apache.httpcomponents - httpclient - ${httpclient.version} - - - - com.orbitz.consul - consul-client - ${consul-client.version} - - - - org.apache.httpcomponents - httpasyncclient - ${httpasyncclient.version} - - - - org.immutables - value - ${immutables.value.version} - - - - -- 2.16.6