Security Vulnerability in pom.xml fix
[portal.git] / ecomp-portal-BE-common / pom.xml
index 894bb7f..1a04c40 100644 (file)
@@ -1,13 +1,14 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
        <modelVersion>4.0.0</modelVersion>
+
        <parent>
                <groupId>org.onap.portal</groupId>
                <artifactId>onap-portal-parent</artifactId>
-               <version>1.3.0</version>
+               <version>2.6.0</version>
        </parent>
 
-       <artifactId>ecompportal-be-common</artifactId>
+       <artifactId>portal-be-common</artifactId>
        <packaging>war</packaging>
 
        <properties>
                                        </execution>
                                </executions>
                        </plugin>
+                       
+                       <plugin>
+                       <groupId>org.apache.maven.plugins</groupId>
+                       <artifactId>maven-jar-plugin</artifactId>
+                       <version>3.0.0</version>
+                       <executions>
+                         <execution>
+                           <goals>
+                             <goal>test-jar</goal>
+                           </goals>
+                         </execution>
+                       </executions>
+               </plugin>
 
                        <plugin>
                                <groupId>org.apache.maven.plugins</groupId>
@@ -72,7 +86,7 @@
                        </plugin>
 
                </plugins>
-
+       
                <testResources>
                        <testResource>
                                <directory>src/test/java</directory>
        </build>
 
        <dependencies>
+       <dependency>
+               <groupId>org.onap.aaf.authz</groupId>
+               <artifactId>aaf-cadi-aaf</artifactId>
+               <version>2.1.7</version>
+               <exclusions>
+                       <exclusion>
+                               <groupId>gso</groupId>
+                               <artifactId>GLCookieDecryption</artifactId>
+                       </exclusion>
+               </exclusions>
+       </dependency>
+       <dependency>
+               <groupId>org.onap.aaf.authz</groupId>
+               <artifactId>aaf-cadi-core</artifactId>
+               <version>2.1.7</version>
+       </dependency>
                <dependency>
                        <groupId>com.att.eelf</groupId>
                        <artifactId>eelf-core</artifactId>
-                       <version>${eelf.version}</version>
+                       <version>1.0.0-oss</version>
                </dependency>
                <dependency>
                        <groupId>com.google.code.gson</groupId>
                        <artifactId>gson</artifactId>
                        <version>2.5</version>
                </dependency>
-
                <!-- Spring -->
                <dependency>
                        <groupId>org.springframework</groupId>
                        <artifactId>spring-test</artifactId>
                        <version>${springframework.version}</version>
                </dependency>
+               <dependency>
+                       <groupId>javax.xml.bind</groupId>
+                       <artifactId>jaxb-api</artifactId>
+                       <version>2.4.0-b180830.0359</version>
+               </dependency>
                <dependency>
                        <groupId>org.springframework.boot</groupId>
                        <artifactId>spring-boot-starter</artifactId>
-                       <version>1.3.0.RELEASE</version>
+                       <version>1.3.1.RELEASE</version>
                        <exclusions>
                                <exclusion>
                                        <groupId>org.slf4j</groupId>
                                        <artifactId>log4j-over-slf4j</artifactId>
                                </exclusion>
-                               <exclusion>
-                                       <groupId>ch.qos.logback</groupId>
-                                       <artifactId>logback-classic</artifactId>
-                               </exclusion>
                        </exclusions>
                </dependency>
-
                <!-- Hibernate -->
                <dependency>
                        <groupId>org.hibernate</groupId>
                <dependency>
                        <groupId>org.hibernate</groupId>
                        <artifactId>hibernate-validator</artifactId>
-                       <version>5.1.3.Final</version>
+                       <version>5.2.5.Final</version>
                </dependency>
-
                <!-- hibernate-core depends on dom4j, which has optional dependencies. 
                        On jenkins, contrary to doc, mvn 3.0.5 packages the optional dependencies 
                        in the war. Workaround: exclude them explicitly. -->
                                </exclusion>
                        </exclusions>
                </dependency>
-
                <!-- Servlet+JSP+JSTL -->
                <dependency>
                        <groupId>javax.servlet</groupId>
                        <version>2.3.1</version>
                </dependency>
                <dependency>
-                       <groupId>javax.servlet</groupId>
-                       <artifactId>jstl</artifactId>
-                       <version>1.2</version>
+               <groupId>org.apache.taglibs</groupId>
+               <artifactId>taglibs-standard-spec</artifactId>
+               <version>1.2.5</version>
+               </dependency>
+               <dependency>
+               <groupId>org.apache.taglibs</groupId>
+               <artifactId>taglibs-standard-impl</artifactId>
+               <version>1.2.5</version>
+               </dependency>
+               <dependency>
+               <groupId>org.apache.taglibs</groupId>
+                       <artifactId>taglibs-standard-jstlel</artifactId>
+               <version>1.2.5</version>
                </dependency>
-
-               <!-- Oracle JDBC driver -->
-               <!-- <dependency> <groupId>com.oracle</groupId> <artifactId>ojdbc6</artifactId> 
-                       <version>11.2.0.4</version> </dependency> -->
                <!-- Apache Tiles -->
                <dependency>
                        <groupId>org.apache.tiles</groupId>
                <dependency>
                        <groupId>org.apache.cxf</groupId>
                        <artifactId>cxf-rt-rs-client</artifactId>
-                       <version>3.0.0-milestone1</version>
+                       <version>3.1.16</version>
                </dependency>
-
                <!-- Mapper -->
                <dependency>
                        <groupId>com.fasterxml.jackson.core</groupId>
                        <artifactId>jackson-databind</artifactId>
                        <version>${fasterxml.version}</version>
                </dependency>
-
                <dependency>
                        <groupId>postgresql</groupId>
                        <artifactId>postgresql</artifactId>
                        <version>9.1-901-1.jdbc4</version>
                </dependency>
-
                <!-- Elastic Search -->
                <dependency>
                        <groupId>org.elasticsearch</groupId>
                        <artifactId>elasticsearch</artifactId>
-                       <version>2.2.0</version>
+                       <version>6.8.2</version>
+                       <exclusions>
+                               <exclusion>
+                                       <groupId>org.apache.lucene</groupId>
+                                       <artifactId>lucene-queryparser</artifactId>
+                               </exclusion>
+                       </exclusions>
                </dependency>
                <dependency>
                        <groupId>io.searchbox</groupId>
                        <artifactId>jest</artifactId>
-                       <version>2.0.0</version>
+                       <version>5.3.2</version>
                </dependency>
-
                <dependency>
                        <groupId>org.apache.jcs</groupId>
                        <artifactId>jcs</artifactId>
                                        <artifactId>*</artifactId>
                                </exclusion>
                        </exclusions>
-                       <!-- -->
                </dependency>
-
                <dependency>
                        <groupId>org.apache.tomcat</groupId>
                        <artifactId>tomcat-websocket</artifactId>
-                       <version>8.0.28</version>
+                       <version>8.0.52</version>
                        <scope>provided</scope>
                </dependency>
-
                <dependency>
                        <groupId>concurrent</groupId>
                        <artifactId>concurrent</artifactId>
                                </exclusion>
                        </exclusions>
                </dependency>
-
-
                <dependency>
                        <groupId>commons-lang</groupId>
                        <artifactId>commons-lang</artifactId>
                <dependency>
                        <groupId>org.apache.poi</groupId>
                        <artifactId>poi</artifactId>
-                       <version>3.5-FINAL</version>
+                       <version>3.17</version>
                        <exclusions>
                                <exclusion>
                                        <groupId>commons-logging</groupId>
                <dependency>
                        <groupId>org.apache.poi</groupId>
                        <artifactId>poi-ooxml</artifactId>
-                       <version>3.5-FINAL</version>
+                       <version>3.17</version>
                        <exclusions>
                                <exclusion>
                                        <groupId>commons-logging</groupId>
                <dependency>
                        <groupId>org.apache.poi</groupId>
                        <artifactId>poi-scratchpad</artifactId>
-                       <version>3.5-FINAL</version>
+                       <version>3.17</version>
                        <exclusions>
                                <exclusion>
                                        <groupId>commons-logging</groupId>
                                </exclusion>
                        </exclusions>
                </dependency>
-
-               <!-- for generating PDF -->
-               <dependency>
-                       <groupId>com.lowagie</groupId>
-                       <artifactId>itext</artifactId>
-                       <version>2.0.8</version>
-               </dependency>
                <!-- Quartz -->
                <dependency>
                        <groupId>org.quartz-scheduler</groupId>
                                </exclusion>
                        </exclusions>
                </dependency>
-
                <dependency>
                        <groupId>org.bouncycastle</groupId>
-                       <artifactId>bcprov-jdk16</artifactId>
-                       <version>1.45</version>
+                       <artifactId>bcprov-jdk15on</artifactId>
+                       <version>1.60</version>
                </dependency>
-
                <dependency>
                        <groupId>commons-codec</groupId>
                        <artifactId>commons-codec</artifactId>
                        <version>1.9</version>
                </dependency>
-
                <dependency>
                        <groupId>com.att.nsa</groupId>
                        <artifactId>cambriaClient</artifactId>
                                        <groupId>org.slf4j</groupId>
                                        <artifactId>slf4j-log4j12</artifactId>
                                </exclusion>
+                               <exclusion>
+                                       <groupId>org.apache.httpcomponents</groupId>
+                                       <artifactId>httpclient</artifactId>
+                               </exclusion>    
                        </exclusions>
                </dependency>
-
                <dependency>
                        <groupId>org.onap.portal.sdk</groupId>
                        <artifactId>epsdk-fw</artifactId>
                        <groupId>org.onap.portal.sdk</groupId>
                        <artifactId>epsdk-app-common</artifactId>
                        <version>${epsdk.version}</version>
+                        <exclusions>
+                               <exclusion>
+                       <groupId>commons-beanutils</groupId>
+                       <artifactId>commons-beanutils-core</artifactId>
+                </exclusion>
+              </exclusions>
                </dependency>
                <dependency>
                        <groupId>org.onap.portal.sdk</groupId>
                        <artifactId>epsdk-workflow</artifactId>
                        <version>${epsdk.version}</version>
                </dependency>
-
                <!-- Raptor required Libraries -->
                <!-- for static charts -->
                <dependency>
                        <artifactId>epsdk-analytics</artifactId>
                        <version>${epsdk.version}</version>
                </dependency>
-
                <!-- Referenced by some poms and needed for testing; do NOT use "test" 
                        scope here. -->
                <dependency>
                        <groupId>org.apache.httpcomponents</groupId>
                        <artifactId>httpclient</artifactId>
-                       <version>4.5.2</version>
+                       <version>4.5.3</version>
                </dependency>
-
                <!-- for testing -->
                <dependency>
                        <groupId>junit</groupId>
                        <artifactId>mockito-core</artifactId>
                        <version>1.8.5</version>
                </dependency>
-
                <dependency>
                        <groupId>commons-beanutils</groupId>
                        <artifactId>commons-beanutils</artifactId>
-                       <version>1.9.2</version>
+                       <version>1.9.4</version>
                </dependency>
-
                <dependency>
                        <groupId>com.ecwid.consul</groupId>
                        <artifactId>consul-api</artifactId>
-                       <version>1.2.1</version>
+                       <version>1.3.0</version>
                </dependency>
-
                <dependency>
                        <groupId>com.orbitz.consul</groupId>
                        <artifactId>consul-client</artifactId>
-                       <version>0.13.8</version>
+                       <version>1.3.6</version>
                </dependency>
-
                <dependency>
                        <groupId>commons-fileupload</groupId>
                        <artifactId>commons-fileupload</artifactId>
-                       <version>1.3</version>
+                       <version>1.3.3</version>
                </dependency>
-
                <dependency>
                        <groupId>io.springfox</groupId>
                        <artifactId>springfox-swagger2</artifactId>
                        <artifactId>springfox-swagger-ui</artifactId>
                        <version>2.7.0</version>
                </dependency>
-
                <!-- Schedulers required Libraries -->
-
                <dependency>
                        <groupId>com.googlecode.json-simple</groupId>
                        <artifactId>json-simple</artifactId>
                <dependency>
                        <groupId>com.fasterxml.jackson.jaxrs</groupId>
                        <artifactId>jackson-jaxrs-json-provider</artifactId>
-                       <version>2.6.3</version>
+                       <version>2.10.0</version>
+               </dependency>
+               <!-- https://mvnrepository.com/artifact/org.glassfish.web/javax.el -->
+               <dependency>
+                       <groupId>org.glassfish.web</groupId>
+                       <artifactId>javax.el</artifactId>
+                       <version>2.2.6</version>
+               </dependency>
+               <!-- https://mvnrepository.com/artifact/javax.el/el-api -->
+               <dependency>
+                       <groupId>javax.el</groupId>
+                       <artifactId>el-api</artifactId>
+                       <version>2.2.1-b04</version>
+               </dependency>
+               <!-- https://mvnrepository.com/artifact/org.jsoup/jsoup -->
+               <dependency>
+                       <groupId>org.jsoup</groupId>
+                       <artifactId>jsoup</artifactId>
+                       <version>1.12.1</version>
                </dependency>
                <dependency>
                        <groupId>org.glassfish.jersey.connectors</groupId>
                        <artifactId>jersey-jetty-connector</artifactId>
-                       <version>2.23.1</version>
+                       <version>2.28</version>
+               </dependency>
+               <!-- Jacoco for offline instrumentation -->
+               <dependency>
+                       <groupId>org.jacoco</groupId>
+                       <artifactId>org.jacoco.agent</artifactId>
+                       <version>${jacocoVersion}</version>
+                       <classifier>runtime</classifier>
+               </dependency>
+               <dependency>
+             <groupId>org.owasp.esapi</groupId>
+             <artifactId>esapi</artifactId>
+             <version>2.2.0.0</version>
+             <exclusions>
+                               <exclusion>
+                       <groupId>commons-beanutils</groupId>
+                       <artifactId>commons-beanutils-core</artifactId>
+                </exclusion>
+                <exclusion>
+                       <groupId>commons-httpclient</groupId>
+                       <artifactId>commons-httpclient</artifactId>
+                </exclusion>
+                                <exclusion>
+                               <groupId>org.beanshell</groupId>
+                       <artifactId>bsh-core</artifactId>
+                                </exclusion>
+              </exclusions>
+        </dependency>
+        <dependency>
+                   <groupId>org.springframework.security</groupId>
+                   <artifactId>spring-security-core</artifactId>
+                   <version>${springframework.security.version}</version>
+           </dependency>
+           <dependency>
+               <groupId>org.springframework.security</groupId>
+               <artifactId>spring-security-web</artifactId>
+               <version>${springframework.security.version}</version>
+        </dependency>
+           <dependency>
+                   <groupId>org.springframework.security</groupId>
+                   <artifactId>spring-security-config</artifactId>
+                   <version>${springframework.security.version}</version>
+           </dependency>
+               <dependency>
+               <groupId>com.thoughtworks.xstream</groupId>
+               <artifactId>xstream</artifactId>
+               <version>1.4.11</version>
+               </dependency>
+               <dependency>
+                       <groupId>ch.qos.logback</groupId>
+                       <artifactId>logback-core</artifactId>
+                       <version>1.2.3</version>
+               </dependency>
+               <dependency>
+                       <groupId>ch.qos.logback</groupId>
+                       <artifactId>logback-classic</artifactId>
+                       <version>1.2.3</version>
+               </dependency>
+               <dependency>
+               <groupId>commons-collections</groupId>
+               <artifactId>commons-collections</artifactId>
+               <version>3.2.2</version>
+               </dependency>
+               <dependency>
+               <groupId>xalan</groupId>
+               <artifactId>xalan</artifactId>
+               <version>2.7.2</version>
+               </dependency>
+                       <!-- Music -->
+           <dependency>
+                   <groupId>org.onap.music</groupId>
+                   <artifactId>MUSIC</artifactId>
+                   <version>2.5.10</version>
+                   <exclusions> 
+                               <exclusion> 
+                                         <groupId>com.sun.jersey</groupId> 
+                                 <artifactId>jersey-client</artifactId> 
+                               </exclusion> 
+                               <exclusion> 
+                                        <groupId>com.sun.jersey</groupId> 
+                                <artifactId>jersey-server</artifactId> 
+                               </exclusion> 
+                               <exclusion> 
+                                        <groupId>com.sun.jersey</groupId> 
+                                <artifactId>jersey-json</artifactId> 
+                               </exclusion><exclusion> 
+                                       <groupId>com.sun.jersey</groupId> 
+                               <artifactId>jersey-servlet</artifactId> 
+                               </exclusion> 
+                       </exclusions> 
+           </dependency>
+           
+               <dependency>
+                       <groupId>org.onap.portal.sdk</groupId>
+                       <artifactId>epsdk-music</artifactId>
+                       <version>${epsdk.version}</version>
+                               
+               <exclusions> 
+                               <exclusion> 
+                                         <groupId>com.sun.jersey</groupId> 
+                                 <artifactId>jersey-client</artifactId> 
+                               </exclusion> 
+                               <exclusion> 
+                                        <groupId>com.sun.jersey</groupId> 
+                                <artifactId>jersey-server</artifactId> 
+                               </exclusion> 
+                               <exclusion> 
+                                        <groupId>com.sun.jersey</groupId> 
+                                <artifactId>jersey-json</artifactId> 
+                               </exclusion><exclusion> 
+                                       <groupId>com.sun.jersey</groupId> 
+                               <artifactId>jersey-servlet</artifactId> 
+                               </exclusion> 
+                       </exclusions> 
+       
+                       
+               </dependency>
+               <dependency>
+                       <groupId>org.projectlombok</groupId>
+                       <artifactId>lombok</artifactId>
+                       <version>1.18.4</version>
+               </dependency>
+
+               <dependency>
+                       <groupId>com.alibaba</groupId>
+                       <artifactId>fastjson</artifactId>
+                       <version>1.2.25</version>
                </dependency>
        </dependencies>
 
-       <!-- No deployment descriptor. -->
-
 </project>