[DMAAP-MR] Fix vulnerabilities for rel I 55/122655/1
authorefiacor <fiachra.corcoran@est.tech>
Thu, 15 Jul 2021 13:13:18 +0000 (14:13 +0100)
committerefiacor <fiachra.corcoran@est.tech>
Thu, 15 Jul 2021 13:13:22 +0000 (14:13 +0100)
Signed-off-by: efiacor <fiachra.corcoran@est.tech>
Change-Id: Ie900556f2542c154cbef8c5a11db86bcc46402f7
Issue-ID: DMAAP-1608

13 files changed:
pom.xml
src/main/ajsc/dmaap_v1/dmaap/v1/conf/jaxrsBeans.groovy
src/main/java/org/onap/dmaap/service/MMRestService.java
src/main/resources/docker-compose/docker-compose.yml
src/main/resources/docker-compose/kafka/zk_client_jaas.conf
src/main/resources/docker-compose/zk/zk_server_jaas.conf
src/test/java/org/onap/dmaap/JUnitTestSuite.java
src/test/java/org/onap/dmaap/TestRunner.java
src/test/java/org/onap/dmaap/mmagent/TestRunner.java
src/test/java/org/onap/dmaap/mr/cambria/embed/ZooKeeperLocal.java
src/test/java/org/onap/dmaap/mr/cambria/resources/streamReaders/CambriaJsonStreamReaderTest.java
src/test/java/org/onap/dmaap/mr/cambria/resources/streamReaders/CambriaRawStreamReaderTest.java
src/test/java/org/onap/dmaap/util/JUnitTestSuite.java

diff --git a/pom.xml b/pom.xml
index 26809db..1ebf280 100644 (file)
--- a/pom.xml
+++ b/pom.xml
@@ -86,9 +86,9 @@
                <camel.version>2.21.5</camel.version>
                <camel.version.latest>3.5.0</camel.version.latest>
                <sitePath>/content/sites/site/org/onap/dmaap/messagerouter/messageservice/${project.artifactId}/${project.version}</sitePath>
-               <skip.docker.build>true</skip.docker.build>
-               <skip.docker.tag>true</skip.docker.tag>
-               <skip.docker.push>true</skip.docker.push>
+               <skip.docker.build>false</skip.docker.build>
+               <skip.docker.tag>false</skip.docker.tag>
+               <skip.docker.push>false</skip.docker.push>
                <nexusproxy>https://nexus.onap.org</nexusproxy>
                <docker.push.registry>nexus3.onap.org:10003</docker.push.registry>
                <spring.version>3.2.18.RELEASE</spring.version>
                <log4j.version>2.13.3</log4j.version>
                <maven.compiler.target>8</maven.compiler.target>
                <maven.compiler.source>8</maven.compiler.source>
+               <skip.deploy>false</skip.deploy>
        </properties>
 
        <build>
                        <plugin>
                                <groupId>org.apache.maven.plugins</groupId>
                                <artifactId>maven-site-plugin</artifactId>
-                               <version>3.6</version>
-                               <dependencies>
-                                       <dependency>
-                                               <groupId>org.apache.maven.wagon</groupId>
-                                               <artifactId>wagon-webdav-jackrabbit</artifactId>
-                                               <version>2.10</version>
-                                       </dependency>
-                               </dependencies>
                        </plugin>
-
                        <plugin>
                                <groupId>org.apache.maven.plugins</groupId>
                                <artifactId>maven-jar-plugin</artifactId>
                                        </dependency>
                                </dependencies>
                        </plugin>
-
-
                        <plugin>
                                <groupId>com.blackducksoftware.integration</groupId>
                                <artifactId>hub-maven-plugin</artifactId>
                                <version>2.8.0-01</version>
                                <extensions>true</extensions>
                        </plugin>
-
+                       <plugin>
+                               <artifactId>maven-deploy-plugin</artifactId>
+                               <version>3.0.0-M1</version>
+                               <configuration>
+                                       <skip>${skip.deploy}</skip>
+                               </configuration>
+                       </plugin>
                </plugins>
        </build>
 
                                </exclusion>
                        </exclusions>
                </dependency>
-
                <dependency>
                        <groupId>org.apache.cxf</groupId>
                        <artifactId>cxf-rt-transports-http</artifactId>
                <dependency>
                        <groupId>org.apache.zookeeper</groupId>
                        <artifactId>zookeeper</artifactId>
-                       <version>3.4.14</version>
+                       <version>3.7.0</version>
+               </dependency>
+               <dependency>
+                       <groupId>com.101tec</groupId>
+                       <artifactId>zkclient</artifactId>
+                       <version>0.2</version>
                </dependency>
                <dependency>
                        <groupId>org.slf4j</groupId>
                </dependency>
                <dependency>
                        <groupId>org.apache.kafka</groupId>
-                       <artifactId>kafka_2.11</artifactId>
-                       <version>0.11.0.3</version>
+                       <artifactId>kafka_2.13</artifactId>
+                       <version>2.8.0</version>
                </dependency>
                <dependency>
                        <groupId>commons-codec</groupId>
                <dependency>
                        <groupId>org.springframework</groupId>
                        <artifactId>spring-webmvc</artifactId>
-                       <version>4.3.18.RELEASE</version>
+                       <version>5.3.3</version>
                </dependency>
                <dependency>
                        <groupId>org.springframework</groupId>
                        <artifactId>spring-beans</artifactId>
                        <version>4.3.18.RELEASE</version>
                </dependency>
-
-
                <dependency>
-                       <groupId>org.apache.commons</groupId>
+                       <groupId>commons-io</groupId>
                        <artifactId>commons-io</artifactId>
-                       <version>1.3.2</version>
+                       <version>2.11.0</version>
                </dependency>
                <dependency>
                        <groupId>com.att.eelf</groupId>
                                </exclusion>
                        </exclusions>
                </dependency>
-
                <!-- our NSA server library -->
                <dependency>
                        <groupId>com.att.nsa</groupId>
                        <artifactId>curator-recipes</artifactId>
                        <version>4.0.1</version>
                </dependency>
-
                <dependency>
                        <groupId>org.apache.curator</groupId>
                        <artifactId>curator-test</artifactId>
                        <artifactId>jackson-jaxrs-json-provider</artifactId>
                        <version>2.2.3</version>
                </dependency>
-
                <dependency>
                        <groupId>com.fasterxml.jackson.core</groupId>
                        <artifactId>jackson-core</artifactId>
-                       <version>2.11.2</version>
                </dependency>
-
                <dependency>
                        <groupId>com.fasterxml.jackson.core</groupId>
                        <artifactId>jackson-databind</artifactId>
-                       <version>2.11.2</version>
                </dependency>
                <dependency>
                        <groupId>org.grails</groupId>
                <dependency>
                        <groupId>org.codehaus.groovy</groupId>
                        <artifactId>groovy-all</artifactId>
-                       <version>2.4.8</version>
-                       <scope>compile</scope>
+                       <version>3.0.8</version>
+                       <type>pom</type>
                        <exclusions>
                                <exclusion>
                                        <artifactId>jline</artifactId>
                                </exclusion>
                        </exclusions>
                </dependency>
-
                <dependency>
                        <groupId>junit</groupId>
                        <artifactId>junit</artifactId>
-                       <version>4.11</version>
+                       <version>4.13.2</version>
                        <scope>test</scope>
                </dependency>
-
                <dependency>
                        <groupId>org.json</groupId>
                        <artifactId>json</artifactId>
                        <version>20131018</version>
                </dependency>
-
                <!-- CXF JAX-RS extension -->
                <dependency>
                        <groupId>org.apache.cxf</groupId>
                        <version>3.0.11-oss</version>
                        <type>pom</type>
                </dependency>
-
                <dependency>
                        <groupId>org.onap.aaf.authz</groupId>
                        <artifactId>aaf-cadi-aaf</artifactId>
                        <version>2.7.4</version>
+                       <exclusions>
+                               <exclusion>
+                                       <artifactId>log4j</artifactId>
+                                       <groupId>log4j</groupId>
+                               </exclusion>
+                       </exclusions>
                </dependency>
                <dependency>
                        <groupId>backport-util-concurrent</groupId>
                <dependency>
                        <groupId>org.igniterealtime.smack</groupId>
                        <artifactId>smack-tcp</artifactId>
-                       <version>4.1.0-rc1</version>
+                       <version>4.4.2</version>
                </dependency>
                <dependency>
                        <groupId>org.apache.camel</groupId>
                        <version>3.0.11-oss</version>
                        <scope>provided</scope>
                </dependency>
-
-    </dependencies>
+               <dependency>
+                       <groupId>org.apache.kafka</groupId>
+                       <artifactId>kafka_2.12</artifactId>
+                       <version>2.7.0</version>
+                       <scope>test</scope>
+               </dependency>
+       </dependencies>
        <profiles>
                <!-- Use this profile to run the AJSC locally. This profile can be successfully
                        shutdown WITHIN eclipse even in a Windows environment. Debugging is also
                <profile>
                        <id>docker</id>
                        <properties>
-                               <skip.docker.build>false</skip.docker.build>
-                               <skip.docker.tag>false</skip.docker.tag>
-                               <skip.docker.push>false</skip.docker.push>
+
                        </properties>
                        <build>
                                <plugins>
                                                <artifactId>docker-maven-plugin</artifactId>
                                                <version>0.28.0</version>
                                                <configuration>
-                                                       <verbose>${docker.verbose}</verbose>
-                                                       <apiVersion>${docker.apiVersion}</apiVersion>
+                                                       <skipBuild>${skip.docker.build}</skipBuild>
+                                                       <skipPush>${skip.docker.push}</skipPush>
                                                        <pullRegistry>${docker.pull.registry}</pullRegistry>
                                                        <pushRegistry>${docker.push.registry}</pushRegistry>
                                                        <images>
                                                        </dependency>
                                                </dependencies>
                                        </plugin>
-
                                </plugins>
                        </build>
                </profile>
                                                <version>2.8.0-01</version>
                                                <extensions>true</extensions>
                                        </plugin>
-
                                        <plugin>
                                                <groupId>org.codehaus.mojo</groupId>
                                                <artifactId>exec-maven-plugin</artifactId>
                                                                        </resources>
                                                                </configuration>
                                                        </execution>
-
                                                </executions>
                                        </plugin>
-
                                        <plugin>
                                                <groupId>com.google.code.maven-replacer-plugin</groupId>
                                                <artifactId>replacer</artifactId>
                        </build>
                </profile>
        </profiles>
-
 </project>
index b019fbc..326b448 100644 (file)
@@ -7,7 +7,7 @@
        userService(org.onap.dmaap.JaxrsUserService)
        topicService(org.onap.dmaap.service.TopicRestService)
        eventService(org.onap.dmaap.service.EventsRestService)
-       adminServiceorg.onap.dmaap.service.AdminRestService)
+       adminServiceorg.(org.onap.dmaap.service.AdminRestService)
        apiKeyService(org.onap.dmaap.service.ApiKeysRestService)
        metricsService(org.onap.dmaap.service.MetricsRestService)
        transactionService(org.onap.dmaap.service.TransactionRestService)
index c5874ae..685dc8a 100644 (file)
@@ -288,12 +288,7 @@ public class MMRestService {
                                        InputStream inStream = null;
                                        MirrorMaker mirrormaker = gson.fromJson(input, MirrorMaker.class);
 
-                                       try {
-                                               inStream = IOUtils.toInputStream(jsonOb.toString(), "UTF-8");
-
-                                       } catch (IOException ioe) {
-                                               throw ioe;
-                                       }
+                                       inStream = IOUtils.toInputStream(jsonOb.toString(), "UTF-8");
 
                                        JSONObject responseJson = callPubSub(jsonOb.getString("messageID"), ctx, inStream, mirrormaker.name,
                                                        true);
@@ -490,12 +485,8 @@ public class MMRestService {
 
                                        InputStream inStream = null;
 
-                                       try {
-                                               inStream = IOUtils.toInputStream(jsonOb.toString(), "UTF-8");
+                                       inStream = IOUtils.toInputStream(jsonOb.toString(), "UTF-8");
 
-                                       } catch (IOException ioe) {
-                                               LOGGER.error("Error while converting string to an input stream:", ioe);
-                                       }
                                        JSONObject deleteMM = jsonOb.getJSONObject("deleteMirrorMaker");
 
                                        JSONObject existMirrorMaker = validateMMExists(ctx, deleteMM.getString("name"));
@@ -760,12 +751,8 @@ public class MMRestService {
                                                InputStream inStream = null;
 
                                                // convert listAll Json object to InputStream object
-                                               try {
-                                                       inStream = IOUtils.toInputStream(listAll.toString(), "UTF-8");
+                                               inStream = IOUtils.toInputStream(listAll.toString(), "UTF-8");
 
-                                               } catch (IOException ioe) {
-                                                       LOGGER.error("Error while converting string to an input stream:", ioe);
-                                               }
                                                JSONObject listMirrorMaker = new JSONObject();
                                                listMirrorMaker = callPubSub(randomStr, ctx, inStream, null, true);
 
@@ -922,12 +909,8 @@ public class MMRestService {
                                                InputStream inStream = null;
 
                                                // convert listAll Json object to InputStream object
-                                               try {
-                                                       inStream = IOUtils.toInputStream(listAll.toString(), "UTF-8");
+                                               inStream = IOUtils.toInputStream(listAll.toString(), "UTF-8");
 
-                                               } catch (IOException ioe) {
-                                                       LOGGER.error("Error while converting string to an input stream:", ioe);
-                                               }
                                                String msgFrmSubscribe = mirrorService.subscribe(ctx, topic, consumergroup, consumerid);
                                                // call listAllMirrorMaker
                                                mirrorService.pushEvents(ctx, topic, inStream, null, null);
@@ -1133,12 +1116,8 @@ public class MMRestService {
                                                InputStream inStream = null;
 
                                                // convert listAll Json object to InputStream object
-                                               try {
-                                                       inStream = IOUtils.toInputStream(listAll.toString(), "UTF-8");
+                                               inStream = IOUtils.toInputStream(listAll.toString(), "UTF-8");
 
-                                               } catch (IOException ioe) {
-                                                       LOGGER.error("Error while converting string to an input stream:", ioe);
-                                               }
                                                // call listAllMirrorMaker
                                                mirrorService.pushEvents(ctx, topic, inStream, null, null);
 
@@ -1401,12 +1380,8 @@ public class MMRestService {
                InputStream inStream = null;
 
                // convert listAll Json object to InputStream object
-               try {
-                       inStream = IOUtils.toInputStream(listAll.toString(), "UTF-8");
+               inStream = IOUtils.toInputStream(listAll.toString(), "UTF-8");
 
-               } catch (IOException ioe) {
-                       LOGGER.error("Error while converting string to an input stream:", ioe);
-               }
                JSONObject listMirrorMaker = new JSONObject();
                listMirrorMaker = callPubSub(randomStr, ctx, inStream, name, false);
                if (null != listMirrorMaker && listMirrorMaker.length() > 0) {
index 6b41996..9cba0a2 100644 (file)
@@ -13,7 +13,7 @@ services:
      ZOOKEEPER_AUTOPURGE_SNAP_RETAIN_COUNT: 3
      ZOOKEEPER_AUTOPURGE_PURGE_INTERVAL: 24
      ZOOKEEPER_CLIENT_PORT: 2181
-     KAFKA_OPTS: -Djava.security.auth.login.config=/etc/zookeeper/secrets/jaas/zk_server_jaas.conf -Dzookeeper.kerberos.removeHostFromPrincipal=true -Dzookeeper.kerberos.removeRealmFromPrincipal=true -Dzookeeper.authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider -Dzookeeper.requireClientAuthScheme=sasl
+     KAFKA_OPTS: -Djava.security.auth.login.config=/etc/zookeeper/secrets/jaas/zk_server_jaas.conf -Dzookeeper.kerberos.removeHostFromPrincipal=true -Dzookeeper.kerberos.removeRealmFromPrincipal=true -Dzookeeper.authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider -Dzookeeper.requireClientAuthScheme=sasl -Dzookeeper.4lw.commands.whitelist=*
      ZOOKEEPER_SERVER_ID: 1
     volumes:
       -  ./zk/zk_server_jaas.conf:/etc/zookeeper/secrets/jaas/zk_server_jaas.conf
index d4ef1eb..79a7601 100644 (file)
@@ -1,5 +1,5 @@
 Client {
-   org.apache.zookeeper.server.auth.DigestLoginModule required
-   username="kafka"
-   password="kafka_secret";
+  org.apache.zookeeper.server.auth.DigestLoginModule required
+  username="kafka"
+  password="kafka_secret";
  };
\ No newline at end of file
index 26bf460..3d2767f 100644 (file)
@@ -1,4 +1,4 @@
 Server {
        org.apache.zookeeper.server.auth.DigestLoginModule required
-       user_kafka=kafka_secret;
+       user_kafka="kafka_secret";
 };
\ No newline at end of file
index d20d0d6..b555b57 100644 (file)
@@ -25,13 +25,15 @@ import junit.framework.TestSuite;
 import org.junit.runner.RunWith;
 import org.junit.runners.Suite;
 import org.junit.runners.Suite.SuiteClasses;
-import org.apache.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
 
 @RunWith(Suite.class)
 @SuiteClasses({ DMaaPCambriaExceptionMapperTest.class, DMaaPWebExceptionMapper.class, 
        JaxrsEchoServiceTest.class, HelloWorldTest.class, JaxrsUserServiceTest.class })
 public class JUnitTestSuite {
-       private static final Logger LOGGER = Logger.getLogger(JUnitTestSuite.class);
+       private static final Logger LOGGER = LogManager.getLogger(JUnitTestSuite.class);
 
        public static void main(String[] args) {
                LOGGER.info("Running the test suite");
index 4542566..a8d1ddc 100644 (file)
 import org.junit.runner.JUnitCore;
 import org.junit.runner.Result;
 import org.junit.runner.notification.Failure;
-import org.apache.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
 
 public class TestRunner {
-       private static final Logger LOGGER = Logger.getLogger(TestRunner.class);
+       private static final Logger LOGGER = LogManager.getLogger(TestRunner.class);
 
        public static void main(String[] args) {
                // TODO Auto-generated method stub
index 3e4ece3..9bf4839 100644 (file)
 import org.junit.runner.JUnitCore;
 import org.junit.runner.Result;
 import org.junit.runner.notification.Failure;
-import org.apache.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
 
 public class TestRunner {
-       private static final Logger LOGGER = Logger.getLogger(TestRunner.class);
+       private static final Logger LOGGER = LogManager.getLogger(TestRunner.class);
 
        public static void main(String[] args) {
                // TODO Auto-generated method stub
index 3209845..97447a8 100644 (file)
@@ -22,6 +22,7 @@
 
 import org.apache.zookeeper.server.ServerConfig;
 import org.apache.zookeeper.server.ZooKeeperServerMain;
+import org.apache.zookeeper.server.admin.AdminServer.AdminServerException;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
 
 import java.io.FileNotFoundException;
@@ -49,7 +50,7 @@ public class ZooKeeperLocal {
                    public void run() {
                        try {
                            zooKeeperServer.runFromConfig(configuration);
-                       } catch (IOException e) {
+                       } catch (IOException | AdminServerException e) {
                            System.out.println("ZooKeeper Failed");
                            e.printStackTrace(System.err);
                        }
index ddfc435..1be8920 100644 (file)
@@ -54,9 +54,6 @@ public class CambriaJsonStreamReaderTest {
                        stream = IOUtils.toInputStream(source, "UTF-8");
                        test = new CambriaJsonStreamReader(stream,"hello");
                        test.next();
-               } catch (IOException e1) {
-                       // TODO Auto-generated catch block
-                       e1.printStackTrace();
                } catch (CambriaApiException e1) {
                        e1.printStackTrace();
                }
index ab58082..887e7c9 100644 (file)
@@ -55,9 +55,6 @@ public class CambriaRawStreamReaderTest {
                        stream = IOUtils.toInputStream(source, "UTF-8");
                        test = new CambriaRawStreamReader(stream,"hello");
                        msg = test.next();
-               } catch (IOException e1) {
-                       // TODO Auto-generated catch block
-                       e1.printStackTrace();
                } catch (CambriaApiException e1) {
                        e1.printStackTrace();
                }
index 9de79ab..7a05d9d 100644 (file)
@@ -25,12 +25,13 @@ import junit.framework.TestSuite;
 import org.junit.runner.RunWith;
 import org.junit.runners.Suite;
 import org.junit.runners.Suite.SuiteClasses;
-import org.apache.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
 
 @RunWith(Suite.class)
 @SuiteClasses({ ContentLengthInterceptorTest.class, DMaaPAuthFilterTest.class, ServicePropertiesMapBeanTest.class})
 public class JUnitTestSuite {
-       private static final Logger LOGGER = Logger.getLogger(JUnitTestSuite.class);
+       private static final Logger LOGGER = LogManager.getLogger(JUnitTestSuite.class);
 
        public static void main(String[] args) {
                LOGGER.info("Running the test suite");