Skip to content

Commit 267e5d0

Browse files
CharlesDuboisSAPJonas-Isrrpanackalnewtork
authored
chore: Remove vulnerable commons-configuration (#808)
Co-authored-by: Jonas Israel <[email protected]> Co-authored-by: Roshin Rajan Panackal <[email protected]> Co-authored-by: Alexander Dümont <[email protected]> Co-authored-by: Alexander Dümont <[email protected]>
1 parent b02997a commit 267e5d0

File tree

10 files changed

+166
-159
lines changed

10 files changed

+166
-159
lines changed

‎datamodel/odata-generator-utility/src/main/java/com/sap/cloud/sdk/datamodel/odata/utility/ServiceNameMappings.java‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
package com.sap.cloud.sdk.datamodel.odata.utility;
2+
3+
import static java.nio.charset.StandardCharsets.UTF_8;
4+
import static java.nio.file.StandardOpenOption.CREATE;
5+
import static java.nio.file.StandardOpenOption.TRUNCATE_EXISTING;
6+
7+
import java.io.IOException;
8+
import java.nio.file.Files;
9+
import java.nio.file.Path;
10+
import java.util.ArrayList;
11+
import java.util.LinkedHashMap;
12+
import java.util.List;
13+
import java.util.Map;
14+
import java.util.Optional;
15+
16+
import javax.annotation.Nonnull;
17+
18+
import com.google.common.base.Joiner;
19+
20+
import lombok.extern.slf4j.Slf4j;
21+
22+
/**
23+
* This class is used to read and write service name mappings from a file.
24+
*/
25+
@Slf4j
26+
public class ServiceNameMappings
27+
{
28+
private static final String DELIMITER_SHORT = "=";
29+
private static final String DELIMITER_LONG = " = ";
30+
private final Path file;
31+
private final Map<Key, Value> mappings = new LinkedHashMap<>();
32+
33+
private record Key( @Nonnull String key )
34+
{
35+
}
36+
37+
private record Value( @Nonnull String value, @Nonnull String comment )
38+
{
39+
}
40+
41+
/**
42+
* Creates a new instance of {@link ServiceNameMappings} with the specified file.
43+
*
44+
* @param file
45+
* the file to read and write mappings from/to
46+
*/
47+
public ServiceNameMappings( @Nonnull final Path file )
48+
{
49+
this.file = file;
50+
if( Files.exists(file) ) {
51+
populateMappings();
52+
}
53+
}
54+
55+
/**
56+
* Saves the mappings to the file.
57+
*
58+
* @throws IOException
59+
* if an error occurs while writing to the file
60+
*/
61+
public void save()
62+
throws IOException
63+
{
64+
final StringBuilder text = new StringBuilder();
65+
for( final Map.Entry<Key, Value> entry : mappings.entrySet() ) {
66+
if( !entry.getValue().comment().isBlank() ) {
67+
text.append(System.lineSeparator()).append("# ").append(entry.getValue().comment());
68+
text.append(System.lineSeparator());
69+
}
70+
text.append(entry.getKey().key()).append(DELIMITER_LONG).append(entry.getValue().value());
71+
text.append(System.lineSeparator());
72+
}
73+
Files.writeString(file, text, UTF_8, CREATE, TRUNCATE_EXISTING);
74+
}
75+
76+
/**
77+
* Gets the value of the specified key.
78+
*
79+
* @param key
80+
* the key to get the value for
81+
* @return the optional value of the key.
82+
*/
83+
@Nonnull
84+
public Optional<String> getString( @Nonnull final String key )
85+
{
86+
return Optional.ofNullable(mappings.get(new Key(key))).map(Value::value);
87+
}
88+
89+
/**
90+
* Adds a new mapping to the file.
91+
*
92+
* @param key
93+
* the key to add
94+
* @param value
95+
* the value to add
96+
* @param comments
97+
* the comments to add, optional
98+
*/
99+
public void putString( @Nonnull final String key, @Nonnull final String value, @Nonnull final String... comments )
100+
{
101+
mappings.put(new Key(key), new Value(value, Joiner.on(" ").join(comments)));
102+
}
103+
104+
private void populateMappings()
105+
{
106+
try {
107+
final List<String> lines = Files.readAllLines(file, UTF_8);
108+
final List<String> comment = new ArrayList<>();
109+
for( final String line : lines ) {
110+
if( line.startsWith("#") ) {
111+
comment.add(line.substring(1).trim());
112+
} else if( line.contains(DELIMITER_SHORT) ) {
113+
final String[] parts = line.split("=", 2);
114+
putString(parts[0].trim(), parts[1].trim(), comment.toArray(new String[0]));
115+
comment.clear();
116+
} else if( !line.isBlank() ) {
117+
log.debug("Skipping line: {}", line);
118+
}
119+
}
120+
}
121+
catch( final IOException e ) {
122+
throw new IllegalArgumentException("Invalid mapping file: " + file, e);
123+
}
124+
}
125+
}

‎datamodel/odata-v4/odata-v4-generator/pom.xml‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -118,16 +118,6 @@
118118
<groupId>org.apache.commons</groupId>
119119
<artifactId>commons-lang3</artifactId>
120120
</dependency>
121-
<dependency>
122-
<groupId>commons-configuration</groupId>
123-
<artifactId>commons-configuration</artifactId>
124-
<exclusions>
125-
<exclusion>
126-
<artifactId>commons-logging</artifactId>
127-
<groupId>commons-logging</groupId>
128-
</exclusion>
129-
</exclusions>
130-
</dependency>
131121
<dependency>
132122
<groupId>commons-io</groupId>
133123
<artifactId>commons-io</artifactId>

‎datamodel/odata-v4/odata-v4-generator/src/main/java/com/sap/cloud/sdk/datamodel/odatav4/generator/EdmService.java‎

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@
1515
import javax.annotation.Nonnull;
1616
import javax.annotation.Nullable;
1717

18-
import org.apache.commons.configuration.PropertiesConfiguration;
1918
import org.apache.olingo.commons.api.edm.Edm;
2019
import org.apache.olingo.commons.api.edm.EdmAction;
2120
import org.apache.olingo.commons.api.edm.EdmActionImport;
@@ -49,6 +48,7 @@
4948
import com.google.common.collect.Multimap;
5049
import com.google.common.collect.MultimapBuilder;
5150
import com.sap.cloud.sdk.datamodel.odata.utility.NamingUtils;
51+
import com.sap.cloud.sdk.datamodel.odata.utility.ServiceNameMappings;
5252

5353
import io.vavr.control.Option;
5454
import lombok.AccessLevel;
@@ -66,7 +66,7 @@ class EdmService implements Service
6666
private static final String[] TERMS_LONG_DESCRIPTION = { "Core.LongDescription", "SAP__core.LongDescription" };
6767

6868
private final String name;
69-
private final PropertiesConfiguration serviceNameMappings;
69+
private final ServiceNameMappings serviceNameMappings;
7070
private final Edm metadata;
7171
private final ServiceDetails details;
7272
private final Function<String, Collection<ApiFunction>> allowedFunctionsByEntity;
@@ -86,7 +86,7 @@ class EdmService implements Service
8686

8787
EdmService(
8888
final String name,
89-
final PropertiesConfiguration serviceNameMappings,
89+
final ServiceNameMappings serviceNameMappings,
9090
final Edm metadata,
9191
final ServiceDetails details,
9292
final Multimap<String, ApiFunction> allowedFunctionsByEntity,
@@ -247,12 +247,8 @@ public Collection<ServiceAction> getAllServiceActions()
247247
public String getJavaPackageName()
248248
{
249249
final String javaPackageNameKey = name + SERVICE_MAPPINGS_PACKAGE_SUFFIX;
250-
String javaPackageName = serviceNameMappings.getString(javaPackageNameKey);
251-
252-
if( javaPackageName == null ) {
253-
javaPackageName = NamingUtils.serviceNameToJavaPackageName(getTitle());
254-
}
255-
return javaPackageName;
250+
final String javaPackageName = serviceNameMappings.getString(javaPackageNameKey).orElseGet(this::getTitle);
251+
return NamingUtils.serviceNameToJavaPackageName(javaPackageName);
256252
}
257253

258254
@Override
@@ -265,12 +261,8 @@ public String getName()
265261
public String getJavaClassName()
266262
{
267263
final String javaClassNameKey = name + SERVICE_MAPPINGS_CLASS_SUFFIX;
268-
String javaClassName = serviceNameMappings.getString(javaClassNameKey);
269-
270-
if( javaClassName == null ) {
271-
javaClassName = NamingUtils.serviceNameToBaseJavaClassName(getTitle());
272-
}
273-
return javaClassName;
264+
final String javaClassName = serviceNameMappings.getString(javaClassNameKey).orElseGet(this::getTitle);
265+
return NamingUtils.serviceNameToBaseJavaClassName(javaClassName);
274266
}
275267

276268
@Override

‎datamodel/odata-v4/odata-v4-generator/src/main/java/com/sap/cloud/sdk/datamodel/odatav4/generator/ODataToVdmGenerator.java‎

Lines changed: 10 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@
1111
import java.util.ArrayList;
1212
import java.util.Arrays;
1313
import java.util.Collection;
14-
import java.util.Iterator;
1514
import java.util.LinkedList;
1615
import java.util.List;
1716
import java.util.Map;
@@ -24,9 +23,6 @@
2423
import javax.annotation.Nonnull;
2524
import javax.annotation.Nullable;
2625

27-
import org.apache.commons.configuration.Configuration;
28-
import org.apache.commons.configuration.ConfigurationException;
29-
import org.apache.commons.configuration.PropertiesConfiguration;
3026
import org.apache.commons.io.FileUtils;
3127
import org.apache.commons.io.FilenameUtils;
3228
import org.apache.commons.lang3.StringUtils;
@@ -42,7 +38,7 @@
4238

4339
import com.google.common.collect.Multimap;
4440
import com.sap.cloud.sdk.datamodel.odata.utility.EdmxValidator;
45-
import com.sap.cloud.sdk.datamodel.odata.utility.NamingUtils;
41+
import com.sap.cloud.sdk.datamodel.odata.utility.ServiceNameMappings;
4642

4743
import io.vavr.control.Try;
4844

@@ -148,8 +144,7 @@ private Collection<EdmxFile> loadServicesFromInput(
148144
@Nonnull final Collection<File> inputFiles )
149145
{
150146
final Collection<EdmxFile> allEdmxFiles = new LinkedList<>();
151-
final PropertiesConfiguration serviceNameMappings =
152-
loadPropertiesConfiguration(config.getServiceNameMappings());
147+
final ServiceNameMappings serviceNameMappings = loadPropertiesConfiguration(config.getServiceNameMappings());
153148
final List<CsdlSchema> edmxTerms = loadEdmxSchemas();
154149

155150
for( final File inputFile : inputFiles ) {
@@ -226,7 +221,7 @@ private Collection<File> getInputFiles( @Nonnull final File inputDir )
226221

227222
private Service buildService(
228223
final String serviceName,
229-
final PropertiesConfiguration serviceNameMappings,
224+
final ServiceNameMappings serviceNameMappings,
230225
final List<CsdlSchema> edmxTerms,
231226
@Nullable final String defaultBasePath,
232227
final File serviceMetadataFile,
@@ -296,23 +291,9 @@ private void cleanDirectory( final File outputDir )
296291
}
297292
}
298293

299-
private PropertiesConfiguration loadPropertiesConfiguration( final File serviceMappingsFile )
294+
private ServiceNameMappings loadPropertiesConfiguration( final File serviceMappingsFile )
300295
{
301-
final PropertiesConfiguration serviceNameMappings;
302-
try {
303-
if( serviceMappingsFile.exists() ) {
304-
serviceNameMappings = new PropertiesConfiguration(serviceMappingsFile);
305-
} else {
306-
serviceNameMappings = new PropertiesConfiguration();
307-
}
308-
}
309-
catch( final ConfigurationException e ) {
310-
throw new ODataGeneratorReadException(e);
311-
}
312-
313-
sanitizeConfiguration(serviceNameMappings);
314-
315-
return serviceNameMappings;
296+
return new ServiceNameMappings(serviceMappingsFile.toPath());
316297
}
317298

318299
// Schema definitions are necessary to make the EDMX properties explorable through Olingo API at runtime, example:
@@ -350,43 +331,23 @@ static List<CsdlSchema> loadEdmxSchemas()
350331
return termSchemas;
351332
}
352333

353-
private void sanitizeConfiguration( final Configuration configuration )
354-
{
355-
for( final Iterator<String> it = configuration.getKeys(); it.hasNext(); ) {
356-
final String key = it.next();
357-
358-
if( key.endsWith(Service.SERVICE_MAPPINGS_CLASS_SUFFIX) ) {
359-
final String javaClassName = configuration.getString(key);
360-
final String sanitizedJavaClassName = NamingUtils.serviceNameToBaseJavaClassName(javaClassName);
361-
configuration.setProperty(key, sanitizedJavaClassName);
362-
}
363-
if( key.endsWith(Service.SERVICE_MAPPINGS_PACKAGE_SUFFIX) ) {
364-
final String javaPackageName = configuration.getString(key);
365-
final String sanitizedJavaPackageName = NamingUtils.serviceNameToJavaPackageName(javaPackageName);
366-
configuration.setProperty(key, sanitizedJavaPackageName);
367-
}
368-
}
369-
}
370-
371334
private void storeConfiguration( final File serviceMappingsFile, final Iterable<Service> allODataServices )
372335
{
373336
ensureFileExists(serviceMappingsFile);
374-
final PropertiesConfiguration serviceNameMappings = loadPropertiesConfiguration(serviceMappingsFile);
337+
final ServiceNameMappings mappings = new ServiceNameMappings(serviceMappingsFile.toPath());
375338

376339
for( final Service oDataService : allODataServices ) {
377340
final String javaClassNameKey = oDataService.getName() + Service.SERVICE_MAPPINGS_CLASS_SUFFIX;
378-
serviceNameMappings.setProperty(javaClassNameKey, oDataService.getJavaClassName());
379-
serviceNameMappings.getLayout().setComment(javaClassNameKey, oDataService.getTitle());
380-
serviceNameMappings.getLayout().setBlancLinesBefore(javaClassNameKey, 1);
341+
mappings.putString(javaClassNameKey, oDataService.getJavaClassName(), oDataService.getTitle());
381342

382343
final String javaPackageNameKey = oDataService.getName() + Service.SERVICE_MAPPINGS_PACKAGE_SUFFIX;
383-
serviceNameMappings.setProperty(javaPackageNameKey, oDataService.getJavaPackageName());
344+
mappings.putString(javaPackageNameKey, oDataService.getJavaPackageName());
384345
}
385346

386347
try {
387-
serviceNameMappings.save();
348+
mappings.save();
388349
}
389-
catch( final ConfigurationException e ) {
350+
catch( final IOException e ) {
390351
throw new ODataGeneratorWriteException(e);
391352
}
392353
}

‎datamodel/odata-v4/odata-v4-generator/src/test/resources/oDataGeneratorIntegrationTest/multipleEntitySets/input/serviceNameMappings.properties‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
12
# minimal metadata
23
minimal_metadata.className = MinimalMetadata
34
minimal_metadata.packageName = minimalmetadata

‎datamodel/odata/odata-generator/pom.xml‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -109,16 +109,6 @@
109109
<groupId>org.apache.commons</groupId>
110110
<artifactId>commons-lang3</artifactId>
111111
</dependency>
112-
<dependency>
113-
<groupId>commons-configuration</groupId>
114-
<artifactId>commons-configuration</artifactId>
115-
<exclusions>
116-
<exclusion>
117-
<artifactId>commons-logging</artifactId>
118-
<groupId>commons-logging</groupId>
119-
</exclusion>
120-
</exclusions>
121-
</dependency>
122112
<dependency>
123113
<groupId>commons-io</groupId>
124114
<artifactId>commons-io</artifactId>

0 commit comments

Comments
 (0)