SLCORE-1545 Update dependencies to fix CVEs (#1434)

Author: nquinquenel

backend/commons/src/test/java/org/sonarsource/sonarlint/core/commons/testutils/MockWebServerExtension.java

@@ -55,7 +55,7 @@ public MockResponse dispatch(RecordedRequest request) {
         if (responsesByPath.containsKey(request.getPath())) {
           return responsesByPath.get(request.getPath());
         }
-        return new MockResponse().setResponseCode(404);
+        return new MockResponse.Builder().code(404).build();
       }
     };
     server.setDispatcher(dispatcher);
@@ -80,7 +80,7 @@ public void shutdown() {
   }
 
   public void addStringResponse(String path, String body) {
-    responsesByPath.put(path, new MockResponse().setBody(body));
+    responsesByPath.put(path, new MockResponse.Builder().body(body).build());
   }
 
   public void removeResponse(String path) {
@@ -110,7 +110,7 @@ public String url(String path) {
 
   public void addResponseFromResource(String path, String responseResourcePath) {
     try (var b = new Buffer()) {
-      responsesByPath.put(path, new MockResponse().setBody(b.readFrom(requireNonNull(MockWebServerExtension.class.getResourceAsStream(responseResourcePath)))));
+      responsesByPath.put(path, new MockResponse.Builder().body(b.readFrom(requireNonNull(MockWebServerExtension.class.getResourceAsStream(responseResourcePath)))).build());
     } catch (IOException e) {
       fail(e);
     }

backend/core/pom.xml

@@ -82,6 +82,10 @@
       <groupId>org.apache.commons</groupId>
       <artifactId>commons-lang3</artifactId>
     </dependency>
+    <dependency>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-text</artifactId>
+    </dependency>
     <dependency>
       <groupId>commons-codec</groupId>
       <artifactId>commons-codec</artifactId>

backend/core/src/main/java/org/sonarsource/sonarlint/core/BindingClueProvider.java

@@ -42,8 +42,8 @@
 import org.sonarsource.sonarlint.core.rpc.protocol.common.SonarCloudRegion;
 
 import static java.util.stream.Collectors.toSet;
-import static org.apache.commons.lang.StringUtils.isBlank;
-import static org.apache.commons.lang.StringUtils.trimToNull;
+import static org.apache.commons.lang3.StringUtils.isBlank;
+import static org.apache.commons.lang3.StringUtils.trimToNull;
 import static org.sonarsource.sonarlint.core.commons.log.SonarLintLogger.singlePlural;
 
 public class BindingClueProvider {

backend/core/src/main/java/org/sonarsource/sonarlint/core/ConnectionSuggestionProvider.java

@@ -28,6 +28,7 @@
 import java.util.Optional;
 import java.util.Set;
 import java.util.stream.Collectors;
+import org.apache.commons.lang3.Strings;
 import org.jetbrains.annotations.NotNull;
 import org.sonarsource.sonarlint.core.commons.log.SonarLintLogger;
 import org.sonarsource.sonarlint.core.commons.progress.ExecutorServiceShutdownWatchable;
@@ -47,7 +48,6 @@
 import org.sonarsource.sonarlint.core.rpc.protocol.common.Either;
 import org.springframework.context.event.EventListener;
 
-import static org.apache.commons.lang.StringUtils.removeEnd;
 import static org.sonarsource.sonarlint.core.BindingClueProvider.ALL_BINDING_CLUE_FILENAMES;
 
 public class ConnectionSuggestionProvider {
@@ -159,7 +159,7 @@ private Optional<Either<String, String>> handleBindingClue(BindingClueProvider.B
       var serverUrl = sonarQubeBindingClue.getServerUrl();
       var connection = connectionRepository.findByUrl(serverUrl);
       if (connection.isEmpty()) {
-        return Optional.of(Either.forLeft(removeEnd(serverUrl, "/")));
+        return Optional.of(Either.forLeft(Strings.CS.removeEnd(serverUrl, "/")));
       }
     } else {
       LOG.debug("Found an invalid binding clue for connection suggestion");

backend/core/src/main/java/org/sonarsource/sonarlint/core/SonarCloudActiveEnvironment.java

@@ -23,9 +23,9 @@
 import java.util.Map;
 import java.util.Optional;
 import java.util.stream.Collectors;
+import org.apache.commons.lang3.Strings;
 import org.sonarsource.sonarlint.core.rpc.protocol.backend.initialize.SonarQubeCloudRegionDto;
 
-import static org.apache.commons.lang.StringUtils.removeEnd;
 
 public class SonarCloudActiveEnvironment {
   private final Map<SonarCloudRegion, SonarQubeCloudRegionDto> alternativeRegionUris;
@@ -75,18 +75,18 @@ public SonarCloudRegion getRegionOrThrow(String uri) {
 
     throw new IllegalArgumentException("URI should be a known SonarCloud URI");
   }
-  
+
   private Optional<SonarCloudRegion> getRegionByUri(String uri) {
-    var cleanedUri = removeEnd(uri, "/");
+    var cleanedUri = Strings.CS.removeEnd(uri, "/");
     for (var entry : alternativeRegionUris.entrySet()) {
-      var regionDto = entry.getValue();
-      if (regionDto.getUri() != null && removeEnd(regionDto.getUri().toString(), "/").equals(cleanedUri)) {
+      var regionUri = entry.getValue().getUri();
+      if (regionUri != null && Strings.CS.removeEnd(regionUri.toString(), "/").equals(cleanedUri)) {
         return Optional.of(entry.getKey());
       }
     }
 
     for (var region : SonarCloudRegion.values()) {
-      if (removeEnd(region.getProductionUri().toString(), "/").equals(cleanedUri)) {
+      if (Strings.CS.removeEnd(region.getProductionUri().toString(), "/").equals(cleanedUri)) {
         return Optional.of(region);
       }
     }

backend/core/src/main/java/org/sonarsource/sonarlint/core/embedded/server/RequestHandlerBindingAssistant.java

@@ -29,7 +29,6 @@
 import java.util.stream.Collectors;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.StringEscapeUtils;
 import org.sonarsource.sonarlint.core.BindingCandidatesFinder;
 import org.sonarsource.sonarlint.core.BindingSuggestionProvider;
 import org.sonarsource.sonarlint.core.SonarQubeClientManager;
@@ -50,6 +49,8 @@
 import org.sonarsource.sonarlint.core.rpc.protocol.client.message.MessageType;
 import org.sonarsource.sonarlint.core.rpc.protocol.client.message.ShowMessageParams;
 
+import static org.apache.commons.text.StringEscapeUtils.escapeHtml4;
+
 public class RequestHandlerBindingAssistant {
 
   private static final SonarLintLogger LOG = SonarLintLogger.get();
@@ -220,7 +221,7 @@ NewBinding assistBinding(String connectionId, boolean isSonarCloud, String proje
     var configScopeCandidates = bindingCandidatesFinder.findConfigScopesToBind(connectionId, projectKey, cancelMonitor);
     // For now, we decided to only support automatic binding if there is only one clear candidate
     if (configScopeCandidates.size() != 1) {
-      client.noBindingSuggestionFound(new NoBindingSuggestionFoundParams(StringEscapeUtils.escapeHtml(projectKey), isSonarCloud));
+      client.noBindingSuggestionFound(new NoBindingSuggestionFoundParams(escapeHtml4(projectKey), isSonarCloud));
       return new NewBinding(connectionId, null);
     }
     var bindableConfig = configScopeCandidates.iterator().next();

backend/core/src/main/java/org/sonarsource/sonarlint/core/embedded/server/RequestHandlerUtils.java

@@ -19,11 +19,10 @@
  */
 package org.sonarsource.sonarlint.core.embedded.server;
 
+import org.apache.commons.lang3.Strings;
 import org.apache.hc.core5.http.ClassicHttpRequest;
 import org.apache.hc.core5.http.ProtocolException;
 
-import static org.apache.commons.lang3.StringUtils.removeEnd;
-
 public class RequestHandlerUtils {
 
   private RequestHandlerUtils() {
@@ -33,6 +32,6 @@ private RequestHandlerUtils() {
   public static String getServerUrlForSonarCloud(ClassicHttpRequest request) throws ProtocolException {
     var originUrl = request.getHeader("Origin").getValue();
     // Since the 'isSonarCloud' check passed, we are sure that the region will be there
-    return removeEnd(originUrl, "/");
+    return Strings.CS.removeEnd(originUrl, "/");
   }
 }

backend/core/src/main/java/org/sonarsource/sonarlint/core/embedded/server/ShowFixSuggestionRequestHandler.java

@@ -31,7 +31,6 @@
 import java.util.List;
 import java.util.Optional;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.StringEscapeUtils;
 import org.apache.hc.core5.http.ClassicHttpRequest;
 import org.apache.hc.core5.http.ClassicHttpResponse;
 import org.apache.hc.core5.http.HttpException;
@@ -65,6 +64,7 @@
 
 import static org.apache.commons.lang3.StringUtils.isNotBlank;
 import static org.apache.commons.lang3.StringUtils.isNotEmpty;
+import static org.apache.commons.text.StringEscapeUtils.escapeHtml4;
 import static org.sonarsource.sonarlint.core.commons.util.StringUtils.sanitizeAgainstRTLO;
 import static org.sonarsource.sonarlint.core.embedded.server.RequestHandlerUtils.getServerUrlForSonarCloud;
 
@@ -303,7 +303,7 @@ public record FixSuggestionPayload(FileEditPayload fileEdit, String suggestionId
     public FixSuggestionPayload(FileEditPayload fileEdit, String suggestionId, String explanation) {
       this.fileEdit = fileEdit;
       this.suggestionId = suggestionId;
-      this.explanation = StringEscapeUtils.escapeHtml(explanation);
+      this.explanation = escapeHtml4(explanation);
     }
 
     public boolean isValid() {

backend/core/src/main/java/org/sonarsource/sonarlint/core/file/WindowsShortcutUtils.java

@@ -24,9 +24,10 @@
 import java.io.IOException;
 import java.net.URI;
 import java.util.Arrays;
-import org.apache.commons.lang.ArrayUtils;
 import org.sonarsource.sonarlint.core.commons.log.SonarLintLogger;
 
+import static org.apache.commons.lang3.ArrayUtils.reverse;
+
 public class WindowsShortcutUtils {
   // Based on Windows specification the magic number is 0x0000004C that must be tested with both big and little endian
   // as it might differ based on the architecture / OS.
@@ -66,7 +67,7 @@ public static boolean isWindowsShortcut(URI uri) {
       }
 
       // Check little endian
-      ArrayUtils.reverse(magicNumber);
+      reverse(magicNumber);
       return Arrays.equals(WINDOWS_SHORTCUT_MAGIC_NUMBER, magicNumber);
     } catch (IOException err) {
       SonarLintLogger.get().debug("Cannot check whether '" + uri + "' is a Windows shortcut, assuming it is not.");

backend/core/src/main/java/org/sonarsource/sonarlint/core/repository/connection/AbstractConnectionConfiguration.java

@@ -22,11 +22,10 @@
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Objects;
+import org.apache.commons.lang3.Strings;
 import org.sonarsource.sonarlint.core.commons.ConnectionKind;
 import org.sonarsource.sonarlint.core.serverapi.EndpointParams;
 
-import static org.apache.commons.lang.StringUtils.removeEnd;
-
 public abstract class AbstractConnectionConfiguration {
 
   /**
@@ -42,7 +41,7 @@ protected AbstractConnectionConfiguration(String connectionId, ConnectionKind ki
     this.connectionId = connectionId;
     this.kind = kind;
     this.disableNotifications = disableNotifications;
-    this.url = removeEnd(url, "/");
+    this.url = Strings.CS.removeEnd(url, "/");
   }
 
   public String getConnectionId() {
@@ -67,8 +66,8 @@ public boolean isSameServerUrl(String otherUrl) {
     URI myUri;
     URI otherUri;
     try {
-      myUri = new URI(removeEnd(url, "/"));
-      otherUri = new URI(removeEnd(otherUrl, "/"));
+      myUri = new URI(Strings.CS.removeEnd(url, "/"));
+      otherUri = new URI(Strings.CS.removeEnd(otherUrl, "/"));
     } catch (URISyntaxException e) {
       return false;
     }