updated few jars for security fix
[portal.git] / ecomp-portal-BE-os / pom.xml
index 0a45000..5372e0a 100644 (file)
@@ -1,70 +1,28 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
        <modelVersion>4.0.0</modelVersion>
-       <groupId>org.onap.portal</groupId>
-       <artifactId>ecompportal-be-os</artifactId>
+
+       <parent>
+               <groupId>org.onap.portal</groupId>
+               <artifactId>onap-portal-parent</artifactId>
+               <version>3.4.0</version>
+       </parent>
+
+       <artifactId>portal-be-os</artifactId>
        <packaging>war</packaging>
-       <version>1.1</version>
 
        <properties>
-               <portal.version>1.3.0-SNAPSHOT</portal.version>
-               <epsdk.version>1.3.0</epsdk.version>
-               <!-- Jenkins SHOULD invoke mvn with argument -Dbuild.number=${BUILD_NUMBER} -->
-               <build.number>0</build.number>
-               <springframework.version>4.2.0.RELEASE</springframework.version>
-               <hibernate.version>4.3.11.Final</hibernate.version>
-               <eelf.version>1.0.0</eelf.version>
-               <encoding>UTF-8</encoding>
-               <!-- If skipTests is false use this command to generate the report:
-                       mvn clean jacoco:prepare-agent install jacoco:report  -->
+               <!-- If skipTests is false use this command to generate the report: mvn 
+                       clean jacoco:prepare-agent install jacoco:report -->
                <skipTests>false</skipTests>
-               <skipCoverage>false</skipCoverage>              
-               <jacoco.data.file>${project.build.directory}/coverage-reports/jacoco-ut.exec</jacoco.data.file>
-               <sonar-jacoco-listeners.version>3.8</sonar-jacoco-listeners.version>
-               <sonar.core.codeCoveragePlugin>jacoco</sonar.core.codeCoveragePlugin>
-        <sonar.jacoco.reportPath>${project.build.directory}/code-coverage/jacoco.exec</sonar.jacoco.reportPath>
-               <sonar.jacoco.itReportPath>${project.build.directory}/code-coverage/jacoco-it.exec</sonar.jacoco.itReportPath>
-               <!-- Note: This list should match jacoco-maven-plugin's exclusion list below -->
-               <sonar.exclusions>**.js</sonar.exclusions>
-               <nexusproxy>https://nexus.onap.org</nexusproxy>
-               <snapshotNexusPath>content/repositories/snapshots/</snapshotNexusPath>
-               <stagingNexusPath>content/repositories/staging/</stagingNexusPath>
-               <releaseNexusPath>content/repositories/releases/</releaseNexusPath>
        </properties>
 
-       <repositories>
-               <repository>
-                       <id>onap-releases</id>
-                       <name>ONAP - Release Repository</name>
-                       <url>${nexusproxy}/${releaseNexusPath}</url>
-               </repository>
-               <repository>
-                       <id>onap-staging</id>
-                       <name>ONAP - Staging Repository</name>
-                       <url>${nexusproxy}/${stagingNexusPath}</url>
-               </repository>
-               <repository>
-                       <id>onap-snapshots</id>
-                       <name>ONAP - Snapshot Repository</name>
-                       <url>${nexusproxy}/${snapshotNexusPath}</url>
-               </repository>
-               <repository>
-                       <id>onap-public</id>
-                       <url>${nexusproxy}/content/groups/public</url>
-               </repository>
-       </repositories>
-
        <build>
                <sourceDirectory>src/main/java</sourceDirectory>
                <!-- The war file name carries no version number -->
                <finalName>${project.artifactId}</finalName>
 
                <plugins>
-                       <plugin>
-                               <groupId>org.codehaus.mojo</groupId>
-                               <artifactId>sonar-maven-plugin</artifactId>
-                               <version>3.2</version>
-                       </plugin>
                        <plugin>
                                <groupId>org.apache.maven.plugins</groupId>
                                <artifactId>maven-site-plugin</artifactId>
                                        </dependency>
                                </dependencies>
                        </plugin>
-                       <plugin>
-                               <artifactId>maven-compiler-plugin</artifactId>
-                               <version>3.1</version>
-                               <configuration>
-                                       <source>1.8</source>
-                                       <target>1.8</target>
-                               </configuration>
-                       </plugin>
-                                               <plugin>
-                           <groupId>org.jacoco</groupId>
-                           <artifactId>jacoco-maven-plugin</artifactId>
-                           <version>0.7.6.201602180812</version>
-                           <executions>
-                               <execution>
-                                   <id>prepare-agent</id>
-                                   <goals>
-                                       <goal>prepare-agent</goal>
-                                   </goals>
-                                   <phase>test</phase>
-                                   <configuration>
-                                       <destFile>${sonar.jacoco.reportPath}</destFile>
-                                       <skip>${skipCoverage}</skip>
-                                   </configuration>
-                               </execution>
-                               <execution>
-                                   <id>report</id>
-                                   <goals>
-                                       <goal>report</goal>
-                                   </goals>
-                                   <phase>test</phase>
-                                   <configuration>
-                                       <dataFile>${sonar.jacoco.reportPath}</dataFile>
-                                       <outputDirectory>${project.basedir}/target/site/jacoco</outputDirectory>
-                                       <skip>${skipCoverage}</skip>
-                                   </configuration>
-                               </execution>
-                               <!-- Integration Tests (Only report goal) -->
-                               <execution>
-                                   <id>report-integration</id>
-                                   <goals>
-                                       <goal>report-integration</goal>
-                                   </goals>
-                                   <configuration>
-                                       <dataFile>${sonar.jacoco.itReportPath}</dataFile>
-                                       <outputDirectory>${project.basedir}/target/site/it-jacoco</outputDirectory>
-                                       <skip>${skipCoverage}</skip>
-                                   </configuration>
-                               </execution>
-                               <!-- Will see build errors while running the test cases because of dual 
-                                                                       instrumentation -->
-                               <execution>
-                                   <id>default-instrument</id>
-                                   <goals>
-                                       <goal>instrument</goal>
-                                   </goals>
-                                   <configuration>
-                                       <skip>${skipCoverage}</skip>
-                                   </configuration>
-                               </execution>
-                               <execution>
-                                   <id>default-restore-instrumented-classes</id>
-                                   <goals>
-                                       <goal>restore-instrumented-classes</goal>
-                                   </goals>
-                                   <configuration>
-                                       <skip>${skipCoverage}</skip>
-                                   </configuration>
-                               </execution>
-                           </executions>
-                       </plugin>
-                       
                        <plugin>
                                <groupId>org.apache.maven.plugins</groupId>
                                <artifactId>maven-surefire-plugin</artifactId>
                                                </manifestEntries>
                                        </archive>
                                        <overlays>
-                                               <!-- specify the order in which these should be applied -->                                             
+                                               <!-- specify the order in which these should be applied -->
                                                <overlay>
                                                        <groupId>org.onap.portal</groupId>
-                                                       <artifactId>ecompportal-be-common</artifactId>
+                                                       <artifactId>portal-be-common</artifactId>
                                                </overlay>
                                                <overlay>
                                                        <groupId>org.onap.portal.sdk</groupId>
                                                        <artifactId>epsdk-app-overlay</artifactId>
-                                               </overlay>                                              
+                                               </overlay>
                                        </overlays>
                                </configuration>
                        </plugin>
                                                        </resources>
                                                </configuration>
                                        </execution>
-<!--                                   <execution> -->
-<!--                                           <id>copy-src</id> -->
-<!--                                           <phase>generate-resources</phase> -->
-<!--                                           <goals> -->
-<!--                                                   <goal>copy-resources</goal> -->
-<!--                                           </goals> -->
-<!--                                           <configuration> -->
-<!--                                                   <outputDirectory>${basedir}/target/classes</outputDirectory> -->
-<!--                                                   <overwrite>false</overwrite> -->
-<!--                                                   <skip>${skipTests}</skip> -->
-<!--                                                   <resources> -->
-<!--                                                           <resource> -->
-<!--                                                                   <directory>${basedir}/../ecomp-portal-BE-common/target/classes</directory> -->
-<!--                                                           </resource> -->
-<!--                                                   </resources> -->
-<!--                                           </configuration> -->
-<!--                                   </execution> -->
                                </executions>
                        </plugin>
                </plugins>
        </build>
 
        <dependencies>
-       <!--  
-               <dependency>
-                       <groupId>com.att.eelf</groupId>
-                       <artifactId>eelf-core</artifactId>
-                       <version>${eelf.version}</version>
-                       <exclusions>
-                               <exclusion>
-                                       <groupId>org.mockito</groupId>
-                                       <artifactId>mockito-core</artifactId>
-                               </exclusion>
-                               <exclusion>
-                                       <groupId>org.powermock</groupId>
-                                       <artifactId>powermock-module-junit4</artifactId>
-                               </exclusion>
-                       </exclusions>
-               </dependency>
-       
-               <dependency>
-                       <groupId>com.google.code.gson</groupId>
-                       <artifactId>gson</artifactId>
-                       <version>2.5</version>
-               </dependency>
-       -->
+           <dependency>
+                       <groupId>com.fasterxml.jackson.core</groupId>
+                       <artifactId>jackson-core</artifactId>
+                       <version>2.11.0</version>
+                       </dependency>
                <!-- Spring -->
                <dependency>
                        <groupId>org.springframework</groupId>
                        <artifactId>spring-tx</artifactId>
                        <version>${springframework.version}</version>
                </dependency>
+               <dependency> 
+                       <groupId>org.springframework</groupId> 
+                       <artifactId>spring-expression</artifactId> 
+                       <version>${springframework.version}</version> 
+               </dependency>
                <dependency>
                        <groupId>org.springframework</groupId>
                        <artifactId>spring-context-support</artifactId>
                        <artifactId>spring-test</artifactId>
                        <version>${springframework.version}</version>
                </dependency>
-               <dependency>
-                       <groupId>org.springframework.boot</groupId>
-                       <artifactId>spring-boot-starter</artifactId>
-                       <version>1.3.0.RELEASE</version>
-                       <exclusions>
-                               <exclusion>
-                                       <groupId>org.slf4j</groupId>
-                                       <artifactId>log4j-over-slf4j</artifactId>
-                               </exclusion>
-                               <exclusion>
-                                       <groupId>ch.qos.logback</groupId>
-                                       <artifactId>logback-classic</artifactId>
-                               </exclusion>
-                       </exclusions>
-               </dependency>
-
+               
                <!-- Hibernate -->
                <dependency>
                        <groupId>org.hibernate</groupId>
                        <artifactId>hibernate-core</artifactId>
                        <version>${hibernate.version}</version>
                </dependency>
-
-               <!-- jsr303 validation -->
-               <!-- <dependency> <groupId>javax.validation</groupId> <artifactId>validation-api</artifactId> 
-                       <version>1.1.0.Final</version> </dependency> -->
-
                <dependency>
                        <groupId>org.hibernate</groupId>
                        <artifactId>hibernate-validator</artifactId>
-                       <version>5.1.3.Final</version>
+                       <version>5.4.3.Final</version>
                </dependency>
+               
                <!-- Servlet+JSP+JSTL -->
                <dependency>
                        <groupId>javax.servlet</groupId>
                        <version>2.3.1</version>
                </dependency>
                <dependency>
-                       <groupId>javax.servlet</groupId>
-                       <artifactId>jstl</artifactId>
-                       <version>1.2</version>
+               <groupId>org.apache.taglibs</groupId>
+               <artifactId>taglibs-standard-spec</artifactId>
+               <version>1.2.5</version>
+               </dependency>
+               <dependency>
+               <groupId>org.apache.taglibs</groupId>
+               <artifactId>taglibs-standard-impl</artifactId>
+               <version>1.2.5</version>
+               </dependency>
+               <dependency>
+               <groupId>org.apache.taglibs</groupId>
+                       <artifactId>taglibs-standard-jstlel</artifactId>
+               <version>1.2.5</version>
                </dependency>
-
                <!-- Apache Tiles -->
                <dependency>
                        <groupId>org.apache.tiles</groupId>
                        <artifactId>tiles-jsp</artifactId>
                        <version>3.0.5</version>
                </dependency>
-               <dependency>
-                       <groupId>org.apache.cxf</groupId>
-                       <artifactId>cxf-rt-rs-client</artifactId>
-                       <version>3.0.0-milestone1</version>
-               </dependency>
-
                <!-- Mapper -->
-               <dependency>
-                       <groupId>com.fasterxml.jackson.core</groupId>
-                       <artifactId>jackson-annotations</artifactId>
-                       <version>2.6.3</version>
-               </dependency>
-               <dependency>
-                       <groupId>com.fasterxml.jackson.core</groupId>
-                       <artifactId>jackson-core</artifactId>
-                       <version>2.6.3</version>
-               </dependency>
-               <dependency>
-                       <groupId>com.fasterxml.jackson.core</groupId>
-                       <artifactId>jackson-databind</artifactId>
-                       <version>2.6.3</version>
-               </dependency>
+               
                <dependency>
                        <groupId>com.fasterxml</groupId>
                        <artifactId>classmate</artifactId>
                        <version>1.3.1</version>
                </dependency>
-       
                <!-- Use Mariadb connector/j for failover -->
                <dependency>
                        <groupId>org.mariadb.jdbc</groupId>
                        <artifactId>mariadb-java-client</artifactId>
                        <version>1.5.8</version>
                </dependency>
-               
                <!-- Elastic Search -->
                <dependency>
                        <groupId>org.elasticsearch</groupId>
                        <artifactId>elasticsearch</artifactId>
-                       <version>2.2.0</version>
+                       <version>7.6.1</version>
+                       <exclusions>
+                               <exclusion>
+                                       <groupId>org.apache.lucene</groupId>
+                                       <artifactId>lucene-queryparser</artifactId>
+                               </exclusion>
+                               <exclusion>
+                                       <groupId>com.fasterxml.jackson.core</groupId>
+                                       <artifactId>jackson-core</artifactId>
+                               </exclusion>
+                       </exclusions>
                </dependency>
                <dependency>
                        <groupId>io.searchbox</groupId>
                        <artifactId>jest</artifactId>
                        <version>2.0.0</version>
                </dependency>
-
                <dependency>
                        <groupId>org.apache.jcs</groupId>
                        <artifactId>jcs</artifactId>
                                </exclusion>
                        </exclusions>
                </dependency>
-
                <dependency>
                        <groupId>org.apache.tomcat</groupId>
                        <artifactId>tomcat-websocket</artifactId>
                        <version>8.0.28</version>
                        <scope>provided</scope>
                </dependency>
-
                <!-- Raptor required Libraries -->
                <!-- for static charts -->
                <dependency>
                <dependency>
                        <groupId>org.apache.poi</groupId>
                        <artifactId>poi</artifactId>
-                       <version>3.5-FINAL</version>
+                       <version>4.1.2</version>
                        <exclusions>
                                <exclusion>
                                        <groupId>commons-logging</groupId>
                <dependency>
                        <groupId>org.apache.poi</groupId>
                        <artifactId>poi-ooxml</artifactId>
-                       <version>3.5-FINAL</version>
+                       <version>4.1.2</version>
                        <exclusions>
                                <exclusion>
                                        <groupId>commons-logging</groupId>
                <dependency>
                        <groupId>org.apache.poi</groupId>
                        <artifactId>poi-scratchpad</artifactId>
-                       <version>3.5-FINAL</version>
+                       <version>4.1.2</version>
                        <exclusions>
                                <exclusion>
                                        <groupId>commons-logging</groupId>
                                </exclusion>
                        </exclusions>
                </dependency>
-
-               <!-- <dependency> <groupId>com.lowagie</groupId> <artifactId>itext</artifactId> 
-                       <version>2.0.8</version> <exclusions> <exclusion> <groupId>org.bouncycastle</groupId> 
-                       <artifactId>bcprov-jdk14</artifactId> </exclusion> </exclusions> </dependency> -->
                <!-- Quartz -->
                <dependency>
                        <groupId>org.quartz-scheduler</groupId>
                        <artifactId>quartz</artifactId>
-                       <version>2.2.1</version>
+                       <version>2.3.2</version>
                        <exclusions>
                                <!-- SDK brings a new version of c3p0 -->
                                <exclusion>
                                </exclusion>
                        </exclusions>
                </dependency>
-
-               <dependency>
-                       <groupId>commons-codec</groupId>
-                       <artifactId>commons-codec</artifactId>
-                       <version>1.9</version>
-               </dependency>
-
                <dependency>
                        <groupId>com.att.nsa</groupId>
                        <artifactId>cambriaClient</artifactId>
                                </exclusion>
                        </exclusions>
                </dependency>
-
                <!-- SDK overlay war -->
                <dependency>
                        <groupId>org.onap.portal.sdk</groupId>
                        <version>${epsdk.version}</version>
                        <type>war</type>
                </dependency>
-
                <dependency>
                        <groupId>org.onap.portal.sdk</groupId>
                        <artifactId>epsdk-app-common</artifactId>
                        <version>${epsdk.version}</version>
                        <type>jar</type>
+                                <exclusions>
+                                       <exclusion>
+                       <groupId>commons-beanutils</groupId>
+                       <artifactId>commons-beanutils-core</artifactId>
+                                       </exclusion>
+                                       <exclusion>
+                       <groupId>org.owasp.esapi</groupId>
+                       <artifactId>esapi</artifactId>
+                                       </exclusion>
+                                       <exclusion>
+                       <groupId>com.mchange</groupId>
+                                       <artifactId>c3p0</artifactId>
+                                       </exclusion>
+                               </exclusions>
+                       
+               </dependency>
+               <dependency>
+                       <groupId>org.owasp.esapi</groupId>
+                       <artifactId>esapi</artifactId>
+                       <version>2.2.0.0</version>
+               </dependency>
+               <dependency>
+                       <groupId>com.mchange</groupId>
+                       <artifactId>c3p0</artifactId>
+                       <version>0.9.5.4</version>
                </dependency>
-
                <!-- EcompPortal common overlay -->
                <dependency>
                        <groupId>org.onap.portal</groupId>
-                       <artifactId>ecompportal-be-common</artifactId>
-                       <version>${portal.version}</version>
+                       <artifactId>portal-be-common</artifactId>
+                       <version>${project.version}</version>
                        <type>war</type>
                </dependency>
-
                <dependency>
                        <groupId>org.onap.portal</groupId>
-                       <artifactId>ecompportal-be-common</artifactId>
-                       <version>${portal.version}</version>
+                       <artifactId>portal-be-common</artifactId>
+                       <version>${project.version}</version>
                        <type>jar</type>
                        <classifier>classes</classifier>
                </dependency>
-
+               <dependency>
+                       <groupId>org.onap.portal</groupId>
+                       <artifactId>portal-be-common</artifactId>
+                       <version>${project.version}</version>
+                       <type>jar</type>
+                       <classifier>tests</classifier>
+                       <scope>test</scope>
+               </dependency>
                <dependency>
                        <groupId>org.onap.portal.sdk</groupId>
                        <artifactId>epsdk-fw</artifactId>
                                </exclusion>
                        </exclusions>
                </dependency>
-
                <dependency>
                        <groupId>org.onap.portal.sdk</groupId>
                        <artifactId>epsdk-core</artifactId>
                        <version>${epsdk.version}</version>
                </dependency>
-
                <dependency>
                        <groupId>org.onap.portal.sdk</groupId>
                        <artifactId>epsdk-workflow</artifactId>
                        <version>${epsdk.version}</version>
                </dependency>
-
                <!-- Raptor required Libraries -->
                <!-- for static charts -->
                <dependency>
                        <artifactId>epsdk-analytics</artifactId>
                        <version>${epsdk.version}</version>
                </dependency>
-
+               <dependency>
+                       <groupId>org.json</groupId>
+                       <artifactId>json</artifactId>
+                       <version>20171018</version>
+               </dependency>
                <!-- Referenced by some poms and needed for testing; do NOT use "test" 
                        scope here. -->
                <dependency>
                        <groupId>org.apache.httpcomponents</groupId>
                        <artifactId>httpclient</artifactId>
-                       <version>4.5.2</version>
+                       <version>4.5.3</version>
                </dependency>
-
                <!-- for testing -->
                <dependency>
                        <groupId>junit</groupId>
                        <version>1.8.5</version>
                        <scope>test</scope>
                </dependency>
-        <dependency>
-                       <groupId>commons-beanutils</groupId>
-                       <artifactId>commons-beanutils</artifactId>
-                       <version>1.9.2</version>
-               </dependency>
-         
-         
-               
                <!-- OpenID Connect Dependencies -->
                <dependency>
                        <groupId>org.mitre</groupId>
                        <artifactId>openid-connect-client</artifactId>
-                       <version>1.2.2</version>
+                       <version>1.3.1</version>
                        <exclusions>
                                <exclusion>
                                        <groupId>org.codehaus.jackson</groupId>
                                        <artifactId>jackson-mapper-asl</artifactId>
                                </exclusion>
+                               <exclusion>
+                                       <groupId>com.nimbusds</groupId>
+                                       <artifactId>nimbus-jose-jwt</artifactId>
+                               </exclusion>
                        </exclusions>
                </dependency>
-
-               <dependency>
+<!--           <dependency>
                        <groupId>org.springframework.security</groupId>
                        <artifactId>spring-security-taglibs</artifactId>
                        <version>3.2.8.RELEASE</version>
                                        <artifactId>*</artifactId>
                                </exclusion>
                        </exclusions>
-               </dependency>
-
+               </dependency> -->
                <dependency>
                        <groupId>org.aspectj</groupId>
                        <artifactId>aspectjrt</artifactId>
                        <artifactId>aspectjweaver</artifactId>
                        <version>1.8.9</version>
                </dependency>
-
+               <!-- Jacoco for offline instrumentation -->
+               <dependency>
+                       <groupId>org.jacoco</groupId>
+                       <artifactId>org.jacoco.agent</artifactId>
+                       <version>${jacocoVersion}</version>
+                       <classifier>runtime</classifier>
+               </dependency>
+               <!-- Music -->
+               <dependency>
+                       <groupId>org.onap.portal.sdk</groupId>
+                       <artifactId>epsdk-music</artifactId>
+                       <version>${epsdk.version}</version>
+                       
+                       <exclusions> 
+                               <exclusion> 
+                                         <groupId>com.sun.jersey</groupId> 
+                                 <artifactId>jersey-client</artifactId> 
+                               </exclusion> 
+                               <exclusion> 
+                                        <groupId>com.sun.jersey</groupId> 
+                                <artifactId>jersey-server</artifactId> 
+                               </exclusion> 
+                               <exclusion> 
+                                        <groupId>com.sun.jersey</groupId> 
+                                <artifactId>jersey-json</artifactId> 
+                               </exclusion><exclusion> 
+                                       <groupId>com.sun.jersey</groupId> 
+                               <artifactId>jersey-servlet</artifactId> 
+                               </exclusion> 
+                       </exclusions> 
+               </dependency> 
        </dependencies>
 
        <reporting>
                        <plugin>
                                <groupId>org.apache.maven.plugins</groupId>
                                <artifactId>maven-javadoc-plugin</artifactId>
-                               <version>2.10.4</version>
+                               <version>3.0.0-M1</version>
                                <configuration>
                                        <failOnError>false</failOnError>
                                        <doclet>org.umlgraph.doclet.UmlGraphDoc</doclet>
                                        <useStandardDocletOptions>true</useStandardDocletOptions>
                                </configuration>
                        </plugin>
-                       
+
                </plugins>
        </reporting>
-
-       <distributionManagement>
-               <site>
-                       <id>ecomp-site</id>
-                       <url>dav:${nexusproxy}/content/sites/site/org/onap/portal/${project.version}</url>
-               </site>
-       </distributionManagement>
-
 </project>