Skip to content

Commit 9c074a3

Browse files
sumadhavsumadhav
committed
CYBS-737: Reverse merge with release 6.2.12
2 parents 827c49e + 44a4c7f commit 9c074a3

File tree

20 files changed

+335
-155
lines changed

20 files changed

+335
-155
lines changed

‎README.md‎

Lines changed: 24 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# CyberSource Simple Order API for Java
22

3-
[![Build Status](https://travis-ci.org/CyberSource/cybersource-sdk-java.png?branch=future)](https://travis-ci.org/CyberSource/cybersource-sdk-java)
3+
[![Build Status](https://travis-ci.org/CyberSource/cybersource-sdk-java.png?branch=master)](https://travis-ci.org/CyberSource/cybersource-sdk-java)
44

55
## Package Managers
66

@@ -227,33 +227,44 @@ Retry Pattern allows to retry sending a failed request and it will only work wit
227227
- Config parameter for this property is 'retryInterval' in `cybs.property` file. The default value for 'retryInterval' parameter is 1000 which means a delay of 1000 milliSeconds.
228228

229229
## Third Party jars
230-
1. org.apache.ws.security.wss4j:1.6.19
231-
The Apache WSS4J project provides a Java implementation of the primary security standards for Web Services, namely the OASIS Web Services Security (WS-Security) specifications from the OASIS Web Services Security TC.
232-
2. org.bouncycastle:bcprov-jdk15on:1.61
230+
1. org.apache.wss4j:wss4j-ws-security-common:2.4.1
231+
The Apache WSS4J project provides a Java implementation of the common primary security standards for Web Services, namely the OASIS Web Services Security (WS-Security) specifications from the OASIS Web Services Security TC.
232+
2. org.apache.wss4j:wss4j-ws-security-dom:2.4.1
233+
WSS4J 2.0.0 introduces a streaming (StAX-based) WS-Security implementation to complement the existing DOM-based implementation. The DOM-based implementation is quite performant and flexible, but suffers from having to read the entire XML tree into memory. For large SOAP requests this can have a detrimental impact on performance. In addition, for web services stacks such as Apache CXF which are streaming-based, it carries an additional performance penalty of having to explicitly convert the request stream to a DOM Element.
234+
3. org.bouncycastle:bcprov-jdk15on:1.70
233235
This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
234-
3. org.apache.santuario:xmlsec:1.5.6
236+
4. org.apache.santuario:xmlsec:2.3.0
235237
The XML Security project is aimed at providing implementation of security standards for XML,supports XML-Signature Syntax and Processing,XML Encryption Syntax and Processing, and supports XML Digital Signature APIs.
236-
4. org.apache.commons:commons-lang3:3.4
238+
5. org.apache.commons:commons-lang3:3.4
237239
Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
238-
5. commons-logging:commons-logging:jar:1.1.1
240+
6. commons-logging:commons-logging:jar:1.1.1
239241
This is getting downloaded as compile time dependency of wss4j:1.6.19.Apache Commons Logging is a thin adapter allowing configurable bridging to other, well known logging systems.
240-
6. org.slf4j:slf4j-api:1.7.21 and org.slf4j:slf4j-jcl:1.7.21
242+
7. org.slf4j:slf4j-api:1.7.32 and org.slf4j:slf4j-jcl:1.7.32
241243
slf4j-api is getting used as a dependency for wss4j. Modified to latest version.
242-
7. junit:junit:4.13.1
244+
8. junit:junit:4.13.1
243245
JUnit is a unit testing framework for Java.
244-
8. org.mockito:mockito-all:1.10.19
246+
9. org.mockito:mockito-all:1.10.19
245247
Mock objects library for java
246-
9. org.apache.httpcomponents:httpclient:4.5.13
248+
10. org.apache.httpcomponents:httpclient:4.5.13
247249
Provides reusable components for client-side authentication, HTTP state management, and HTTP connection management. It is used for poolinghttpclientconnectionmanager feature.
248-
10. org.apache.httpcomponents:httpcore:4.4.13
250+
11. org.apache.httpcomponents:httpcore:4.4.13
249251
Provides low level HTTP transport components that can be used to build custom client and server side HTTP services with a minimal footprint.
250252

251253
## Changes
252254
_______________________________
253-
Version Cybersource-sdk-java 6.2.12 (MAY,2022)
255+
Version Cybersource-sdk-java 6.2.13 (AUGUST,2022)
254256
_______________________________
255257
1)Modified the CYBS P12 certificate's CN name verification to case insensitive.
256258
_______________________________
259+
260+
_______________________________
261+
Version Cybersource-sdk-java 6.2.12 (JULY,2022)
262+
_______________________________
263+
1) Mitigation of Apache WSS4j Security Vulnerability (CVE-2016-1000343, CVE-2018-1000180).
264+
i) Updated Apache wss4j version from 1.6.19 to 2.4.1
265+
ii) Updated dependent libraries version. (xmlsec from 1.5.6 to 2.3.0, bcprov-jdk15on from 1.61 to 1.70)
266+
_______________________________
267+
_______________________________
257268
Version Cybersource-sdk-java 6.2.11 (MAY,2020)
258269
_______________________________
259270
1)Exception handling improvement.

‎java/pom.xml‎

Lines changed: 79 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,20 @@
22
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
33

44
<modelVersion>4.0.0</modelVersion>
5+
56
<parent>
67
<groupId>org.sonatype.oss</groupId>
78
<artifactId>oss-parent</artifactId>
89
<version>7</version>
910
</parent>
11+
1012
<groupId>com.cybersource</groupId>
1113
<artifactId>cybersource-sdk-java</artifactId>
12-
<version>6.2.12-SNAPSHOT</version>
14+
<version>6.2.13-SNAPSHOT</version>
1315
<name>cybersource-sdk-java</name>
1416
<description>Simple Order API Client</description>
1517
<url>http://www.cybersource.com</url>
18+
1619
<licenses>
1720
<license>
1821
<name>CyberSource SDK License Agreement</name>
@@ -37,7 +40,17 @@
3740
<properties>
3841
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
3942
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
43+
<junit.version>4.13.1</junit.version>
44+
<xalan.version>2.7.2</xalan.version>
45+
<xmlsec.version>2.3.0</xmlsec.version>
46+
<httpclient.version>4.5.13</httpclient.version>
47+
<bouncycastle.version>1.70</bouncycastle.version>
48+
<wss4j.version>2.4.1</wss4j.version>
49+
<commonlang3.version>3.4</commonlang3.version>
50+
<mockito.version>1.10.19</mockito.version>
51+
<slf4j.version>1.7.32</slf4j.version>
4052
</properties>
53+
4154
<packaging>jar</packaging>
4255

4356
<profiles>
@@ -219,23 +232,29 @@
219232
<dependency>
220233
<groupId>junit</groupId>
221234
<artifactId>junit</artifactId>
222-
<version>4.13.1</version>
235+
<version>${junit.version}</version>
223236
<scope>test</scope>
224237
</dependency>
225238
<dependency>
226239
<groupId>xalan</groupId>
227240
<artifactId>xalan</artifactId>
228-
<version>2.7.2</version>
241+
<version>${xalan.version}</version>
229242
</dependency>
230243
<dependency>
231244
<groupId>org.apache.santuario</groupId>
232245
<artifactId>xmlsec</artifactId>
233-
<version>1.5.6</version>
246+
<version>${xmlsec.version}</version>
247+
<exclusions>
248+
<exclusion>
249+
<artifactId>woodstox-core</artifactId>
250+
<groupId>com.fasterxml.woodstox</groupId>
251+
</exclusion>
252+
</exclusions>
234253
</dependency>
235254
<dependency>
236255
<groupId>org.apache.httpcomponents</groupId>
237256
<artifactId>httpclient</artifactId>
238-
<version>4.5.13</version>
257+
<version>${httpclient.version}</version>
239258
<exclusions>
240259
<exclusion>
241260
<groupId>commons-logging</groupId>
@@ -246,28 +265,75 @@
246265
<dependency>
247266
<groupId>org.bouncycastle</groupId>
248267
<artifactId>bcprov-jdk15on</artifactId>
249-
<version>1.61</version>
268+
<version>${bouncycastle.version}</version>
250269
</dependency>
251270
<dependency>
252-
<groupId>org.apache.ws.security</groupId>
253-
<artifactId>wss4j</artifactId>
254-
<version>1.6.19</version>
255-
<exclusions>
271+
<groupId>org.apache.wss4j</groupId>
272+
<artifactId>wss4j-ws-security-common</artifactId>
273+
<version>${wss4j.version}</version>
274+
<exclusions>
275+
<exclusion>
276+
<groupId>com.google.guava</groupId>
277+
<artifactId>guava</artifactId>
278+
</exclusion>
279+
<exclusion>
280+
<artifactId>cryptacular</artifactId>
281+
<groupId>org.cryptacular</groupId>
282+
</exclusion>
283+
<exclusion>
284+
<artifactId>opensaml-saml-impl</artifactId>
285+
<groupId>org.opensaml</groupId>
286+
</exclusion>
287+
<exclusion>
288+
<artifactId>opensaml-xacml-impl</artifactId>
289+
<groupId>org.opensaml</groupId>
290+
</exclusion>
256291
<exclusion>
292+
<artifactId>opensaml-xacml-saml-impl</artifactId>
257293
<groupId>org.opensaml</groupId>
258-
<artifactId>opensaml</artifactId>
294+
</exclusion>
295+
<exclusion>
296+
<artifactId>slf4j-api</artifactId>
297+
<groupId>org.slf4j</groupId>
298+
</exclusion>
299+
<exclusion>
300+
<artifactId>joda-time</artifactId>
301+
<groupId>joda-time</groupId>
302+
</exclusion>
303+
<exclusion>
304+
<artifactId>jasypt</artifactId>
305+
<groupId>org.jasypt</groupId>
306+
</exclusion>
307+
<exclusion>
308+
<artifactId>geronimo-javamail_1.4_mail</artifactId>
309+
<groupId>org.apache.geronimo.javamail</groupId>
310+
</exclusion>
311+
<exclusion>
312+
<artifactId>xmlsec</artifactId>
313+
<groupId>org.apache.santuario</groupId>
314+
</exclusion>
315+
</exclusions>
316+
</dependency>
317+
<dependency>
318+
<groupId>org.apache.wss4j</groupId>
319+
<artifactId>wss4j-ws-security-dom</artifactId>
320+
<version>${wss4j.version}</version>
321+
<exclusions>
322+
<exclusion>
323+
<groupId>org.ehcache</groupId>
324+
<artifactId>ehcache</artifactId>
259325
</exclusion>
260326
</exclusions>
261327
</dependency>
262328
<dependency>
263329
<groupId>org.apache.commons</groupId>
264330
<artifactId>commons-lang3</artifactId>
265-
<version>3.4</version>
331+
<version>${commonlang3.version}</version>
266332
</dependency>
267333
<dependency>
268334
<groupId>org.mockito</groupId>
269335
<artifactId>mockito-all</artifactId>
270-
<version>1.10.19</version>
336+
<version>${mockito.version}</version>
271337
<scope>test</scope>
272338
</dependency>
273339
</dependencies>

‎java/src/main/java/com/cybersource/ws/client/MessageHandlerKeyStore.java‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package com.cybersource.ws.client;
22

3-
import org.apache.ws.security.components.crypto.CredentialException;
4-
import org.apache.ws.security.components.crypto.Merlin;
3+
import org.apache.wss4j.common.crypto.Merlin;
54

65
import java.io.IOException;
76
import java.security.KeyStoreException;
@@ -15,11 +14,10 @@
1514
public class MessageHandlerKeyStore extends Merlin {
1615

1716
/**
18-
* @throws CredentialException
1917
* @throws IOException
2018
*/
21-
public MessageHandlerKeyStore() throws CredentialException, IOException {
22-
super(null);
19+
public MessageHandlerKeyStore() {
20+
super();
2321
properties = new Properties();
2422
}
2523

0 commit comments

Comments
 (0)