Skip to content

Commit 9eb1deb

Browse files
davewichersdavewichers
committed
Upgrade a bunch of dependencies and plugins and prepare a bit for the use of
AntiSamy 1.6.6.1.
1 parent 0f9ab8a commit 9eb1deb

File tree

2 files changed

+103
-38
lines changed

2 files changed

+103
-38
lines changed

‎pom.xml‎

Lines changed: 78 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -132,11 +132,13 @@
132132

133133
<properties>
134134
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
135-
<version.jmh>1.28</version.jmh>
135+
<project.java.target>1.7</project.java.target>
136+
<version.findsecbugs>1.11.0</version.findsecbugs>
137+
<version.jmh>1.35</version.jmh>
136138
<!-- Note: powermock v2.0.8 doesn't exist. v2.0.9+ requires mockito-core v3+, which requires Java 8 -->
137139
<version.powermock>2.0.7</version.powermock>
138-
<version.spotbugs>4.5.3</version.spotbugs>
139-
<version.spotbugs.maven>4.2.2</version.spotbugs.maven>
140+
<version.spotbugs>4.6.0</version.spotbugs>
141+
<version.spotbugs.maven>4.6.0.0</version.spotbugs.maven>
140142
<version.surefire>3.0.0-M5</version.surefire>
141143
</properties>
142144

@@ -198,6 +200,10 @@
198200
<groupId>commons-logging</groupId>
199201
<artifactId>commons-logging</artifactId>
200202
</exclusion>
203+
<exclusion>
204+
<groupId>xml-apis</groupId>
205+
<artifactId>xml-apis</artifactId>
206+
</exclusion>
201207
</exclusions>
202208
</dependency>
203209
<dependency>
@@ -237,23 +243,44 @@
237243
<dependency>
238244
<groupId>org.owasp.antisamy</groupId>
239245
<artifactId>antisamy</artifactId>
246+
<!-- TODO: needs to be 1.6.6.1 before release -->
240247
<version>1.6.5</version>
241248
<exclusions>
242-
<!-- excluded because we pick up much newer version -->
249+
<!-- excluded because version from AntiSamy is too new (Requires Java 8) -->
243250
<exclusion>
244251
<groupId>commons-io</groupId>
245252
<artifactId>commons-io</artifactId>
246253
</exclusion>
254+
<!-- TODO: This is only needed for AntiSamy 1.6.5, not 1.6.6.1.
255+
Remove this exclusion when AntiSamy 1.6.6.1 is included. -->
247256
<exclusion>
248257
<groupId>org.slf4j</groupId>
249258
<artifactId>slf4j-api</artifactId>
250259
</exclusion>
260+
<!-- TODO: The neko-htmlunit exclusion here and inclusion next, is needed for AntiSamy 1.6.6.1.
261+
Remove this comment when AntiSamy 1.6.6.1 is included. -->
262+
<exclusion>
263+
<groupId>net.sourceforge.htmlunit</groupId>
264+
<artifactId>neko-htmlunit</artifactId>
265+
</exclusion>
266+
</exclusions>
267+
</dependency>
268+
<dependency>
269+
<groupId>net.sourceforge.htmlunit</groupId>
270+
<artifactId>neko-htmlunit</artifactId>
271+
<version>2.24</version>
272+
<exclusions>
273+
<!-- excluded because this conflicts with the version imported by AntiSamy -->
274+
<exclusion>
275+
<groupId>xerces</groupId>
276+
<artifactId>xercesImpl</artifactId>
277+
</exclusion>
251278
</exclusions>
252279
</dependency>
253280
<dependency>
254281
<groupId>org.slf4j</groupId>
255282
<artifactId>slf4j-api</artifactId>
256-
<version>1.7.35</version>
283+
<version>1.7.36</version>
257284
</dependency>
258285
<dependency>
259286
<groupId>xml-apis</groupId>
@@ -273,7 +300,6 @@
273300
<version>2.6</version>
274301
</dependency>
275302

276-
277303
<!-- SpotBugs dependencies -->
278304
<dependency>
279305
<groupId>com.github.spotbugs</groupId>
@@ -298,7 +324,7 @@
298324
<dependency>
299325
<groupId>org.bouncycastle</groupId>
300326
<artifactId>bcprov-jdk15on</artifactId>
301-
<version>1.68</version>
327+
<version>1.70</version>
302328
<scope>test</scope>
303329
</dependency>
304330
<dependency>
@@ -404,12 +430,12 @@
404430
<plugin>
405431
<groupId>org.apache.maven.plugins</groupId>
406432
<artifactId>maven-dependency-plugin</artifactId>
407-
<version>3.1.2</version>
433+
<version>3.3.0</version>
408434
</plugin>
409435
<plugin>
410436
<groupId>org.apache.maven.plugins</groupId>
411437
<artifactId>maven-release-plugin</artifactId>
412-
<version>3.0.0-M1</version>
438+
<version>3.0.0-M5</version>
413439
</plugin>
414440
</plugins>
415441
</pluginManagement>
@@ -430,6 +456,12 @@
430456
</dependencies>
431457
</plugin>
432458

459+
<plugin>
460+
<groupId>com.h3xstream.findsecbugs</groupId>
461+
<artifactId>findsecbugs-plugin</artifactId>
462+
<version>${version.findsecbugs}</version>
463+
</plugin>
464+
433465
<plugin>
434466
<groupId>net.sourceforge.maven-taglib</groupId>
435467
<artifactId>maven-taglib-plugin</artifactId>
@@ -451,12 +483,12 @@
451483
<plugin>
452484
<groupId>org.apache.maven.plugins</groupId>
453485
<artifactId>maven-compiler-plugin</artifactId>
454-
<version>3.8.1</version>
486+
<version>3.10.1</version>
455487
<configuration>
456-
<source>1.7</source>
457-
<target>1.7</target>
458-
<testSource>1.7</testSource>
459-
<testTarget>1.7</testTarget>
488+
<source>${project.java.target}</source>
489+
<target>${project.java.target}</target>
490+
<testSource>${project.java.target}</testSource>
491+
<testTarget>${project.java.target}</testTarget>
460492
<debug>true</debug>
461493
<showWarnings>true</showWarnings>
462494
<showDeprecation>false</showDeprecation>
@@ -485,7 +517,7 @@
485517
<plugin>
486518
<groupId>org.apache.maven.plugins</groupId>
487519
<artifactId>maven-deploy-plugin</artifactId>
488-
<version>3.0.0-M1</version>
520+
<version>3.0.0-M2</version>
489521
</plugin>
490522

491523
<plugin>
@@ -500,18 +532,17 @@
500532
<plugin>
501533
<groupId>org.apache.maven.plugins</groupId>
502534
<artifactId>maven-enforcer-plugin</artifactId>
503-
<version>3.0.0-M3</version>
535+
<version>3.0.0</version>
504536
<dependencies>
505537
<dependency>
506538
<groupId>org.codehaus.mojo</groupId>
507539
<artifactId>extra-enforcer-rules</artifactId>
508-
<version>1.3</version>
540+
<version>1.5.1</version>
509541
</dependency>
510542
<dependency>
511543
<groupId>org.codehaus.mojo</groupId>
512544
<artifactId>animal-sniffer-enforcer-rule</artifactId>
513-
<!-- Updating to 1.19 causes LOTS of errors in 'mvn site' and 1.18 requires Java 8 so leaving it at 1.17. -->
514-
<version>1.17</version>
545+
<version>1.21</version>
515546
</dependency>
516547
</dependencies>
517548
<executions>
@@ -537,7 +568,7 @@
537568
<rules>
538569
<dependencyConvergence/>
539570
<requireJavaVersion>
540-
<version>1.7</version>
571+
<version>${project.java.target}</version>
541572
<message>
542573
ESAPI 2.x now uses the JDK1.7 for its baseline. Please make sure that your
543574
JAVA_HOME environment variable is pointed to a JDK1.7 or later distribution.
@@ -576,7 +607,7 @@
576607
<plugin>
577608
<groupId>org.apache.maven.plugins</groupId>
578609
<artifactId>maven-gpg-plugin</artifactId>
579-
<version>1.6</version>
610+
<version>3.0.1</version>
580611
<executions>
581612
<execution>
582613
<id>sign-artifacts</id>
@@ -595,7 +626,7 @@
595626
<plugin>
596627
<groupId>org.apache.maven.plugins</groupId>
597628
<artifactId>maven-jar-plugin</artifactId>
598-
<version>3.2.0</version>
629+
<version>3.2.2</version>
599630
<configuration>
600631
<archive>
601632
<manifest>
@@ -609,7 +640,7 @@
609640
<plugin>
610641
<groupId>org.apache.maven.plugins</groupId>
611642
<artifactId>maven-javadoc-plugin</artifactId>
612-
<version>3.2.0</version>
643+
<version>3.3.2</version>
613644
<configuration>
614645
<source>7</source>
615646
<doclint>none</doclint>
@@ -625,21 +656,32 @@
625656
</plugin>
626657

627658
<plugin>
628-
<groupId>org.apache.maven.plugins</groupId>
629-
<artifactId>maven-jxr-plugin</artifactId>
630-
<version>3.0.0</version>
659+
<groupId>org.apache.maven.plugins</groupId>
660+
<artifactId>maven-jxr-plugin</artifactId>
661+
<version>3.1.1</version>
631662
</plugin>
632663

633664
<plugin>
634-
<groupId>org.apache.maven.plugins</groupId>
635-
<artifactId>maven-pmd-plugin</artifactId>
636-
<version>3.14.0</version>
665+
<groupId>org.apache.maven.plugins</groupId>
666+
<artifactId>maven-pmd-plugin</artifactId>
667+
<version>3.16.0</version>
668+
<dependencies>
669+
<!-- Without this, 3.15.0+ causes lots of warning like: [WARNING] Could not find class org.owasp.validator.html.util.ErrorMessageUtil,
670+
due to: java.lang.IncompatibleClassChangeError: class net.sourceforge.pmd.lang.java.typeresolution.visitors.PMDASMVisitor
671+
has interface org.objectweb.asm.ClassVisitor as super class.
672+
However, these warnings don't adversely affect the PMD results, so we are keeping this upgrade. -->
673+
<dependency>
674+
<groupId>org.ow2.asm</groupId>
675+
<artifactId>asm</artifactId>
676+
<version>9.2</version>
677+
</dependency>
678+
</dependencies>
637679
</plugin>
638680

639681
<plugin>
640682
<groupId>org.apache.maven.plugins</groupId>
641683
<artifactId>maven-project-info-reports-plugin</artifactId>
642-
<version>3.1.1</version>
684+
<version>3.1.2</version>
643685
</plugin>
644686

645687
<plugin>
@@ -651,7 +693,7 @@
651693
<plugin>
652694
<groupId>org.apache.maven.plugins</groupId>
653695
<artifactId>maven-site-plugin</artifactId>
654-
<version>3.9.1</version>
696+
<version>3.11.0</version>
655697
</plugin>
656698

657699
<plugin>
@@ -700,7 +742,7 @@
700742
<plugin>
701743
<groupId>org.codehaus.mojo</groupId>
702744
<artifactId>versions-maven-plugin</artifactId>
703-
<version>2.8.1</version>
745+
<version>2.10.0</version>
704746
</plugin>
705747

706748
<plugin>
@@ -712,7 +754,7 @@
712754
<plugin>
713755
<groupId>org.owasp</groupId>
714756
<artifactId>dependency-check-maven</artifactId>
715-
<version>6.1.6</version>
757+
<version>7.0.4</version>
716758
<configuration>
717759
<failBuildOnCVSS>1.0</failBuildOnCVSS>
718760
<suppressionFiles>./suppressions.xml</suppressionFiles>
@@ -781,6 +823,7 @@
781823
<reportSets>
782824
<reportSet>
783825
<reports>
826+
<report>index</report>
784827
<report>dependency-convergence</report>
785828
</reports>
786829
</reportSet>
@@ -845,7 +888,7 @@
845888
<plugin>
846889
<groupId>com.h3xstream.findsecbugs</groupId>
847890
<artifactId>findsecbugs-plugin</artifactId>
848-
<version>1.10.1</version>
891+
<version>${version.findsecbugs}</version>
849892
</plugin>
850893
</plugins>
851894
<effort>Max</effort>
@@ -877,7 +920,6 @@
877920

878921
<plugin>
879922
<artifactId>maven-jar-plugin</artifactId>
880-
881923
<!--
882924
<executions>
883925
<execution>
@@ -891,7 +933,7 @@
891933
<configuration>
892934
<!--
893935
<keystore>codesign.keystore</keystore>
894-
<alias>owasp foundation, inc.'s godaddy.com, inc. id</alias>
936+
<alias>OWASP Foundation, Inc.'s GoDaddy.com ID</alias>
895937
<verify>true</verify>
896938
-->
897939
<archive>
@@ -934,7 +976,6 @@
934976
<plugin>
935977
<groupId>org.apache.maven.plugins</groupId>
936978
<artifactId>maven-release-plugin</artifactId>
937-
<version>2.5.3</version>
938979
<configuration>
939980
<tagBase>https://github.com/ESAPI/esapi-java-legacy/tags</tagBase>
940981
</configuration>

‎suppressions.xml‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!-- OWASP Dependency Check suppression file for ESAPI. -->
3-
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd">
3+
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
44
<suppress>
55
<notes><![CDATA[
66
This suppresses CVE-2019-17571 for the log4j-1.2.17.jar dependency. ESAPI does
@@ -37,4 +37,28 @@
3737
<cpe>cpe:/a:apache:log4j</cpe>
3838
<cve>CVE-2020-9488</cve>
3939
</suppress>
40+
<suppress>
41+
<notes><![CDATA[file name: log4j-1.2.17.jar]]></notes>
42+
<packageUrl regex="true">^pkg:maven/log4j/log4j@.*$</packageUrl>
43+
<vulnerabilityName>CVE-2021-4104</vulnerabilityName>
44+
</suppress>
45+
<suppress>
46+
<notes><![CDATA[
47+
file name: neko-htmlunit-2.24.jar
48+
49+
CVE-2020-5529 is for net.sourceforge.htmlunit:htmlunit, not net.sourceforge.htmlunit:neko-htmlunit.
50+
As such, this is a false positive.
51+
]]></notes>
52+
<packageUrl regex="true">^pkg:maven/net\.sourceforge\.htmlunit/neko\-htmlunit@.*$</packageUrl>
53+
<cve>CVE-2020-5529</cve>
54+
</suppress>
55+
<suppress>
56+
<notes><![CDATA[
57+
file name: commons-io-2.6.jar
58+
59+
TODO:FIXME: Not sure if you want this suppressed or not, but suppressing for now so mvn site can finish successfully.
60+
]]></notes>
61+
<packageUrl regex="true">^pkg:maven/commons\-io/commons\-io@.*$</packageUrl>
62+
<cve>CVE-2021-29425</cve>
63+
</suppress>
4064
</suppressions>

0 commit comments

Comments
 (0)