fix: make JCS logging adapter configuration self-contained with DataCacheFactory

- allows us to workaround #8108
- makes API for `core` consistently SLF4J based
- debug logging derived from logger configuration for the DataCacheFactory itself

Signed-off-by: Chad Wilson <29788154+chadlwilson@users.noreply.github.com>

Author: chadlwilson

ant/pom.xml

@@ -222,10 +222,6 @@ Copyright (c) 2013 - Jeremy Long. All Rights Reserved.
             <groupId>org.slf4j</groupId>
             <artifactId>slf4j-api</artifactId>
         </dependency>
-        <dependency>
-            <groupId>io.github.jeremylong</groupId>
-            <artifactId>jcs3-slf4j</artifactId>
-        </dependency>
         <dependency>
             <groupId>org.owasp</groupId>
             <artifactId>dependency-check-core</artifactId>

ant/src/main/java/org/owasp/dependencycheck/taskdefs/Purge.java

@@ -17,7 +17,6 @@
  */
 package org.owasp.dependencycheck.taskdefs;
 
-import io.github.jeremylong.jcs3.slf4j.Slf4jAdapter;
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
@@ -128,9 +127,6 @@ public final void execute() throws BuildException {
      * Hacky method of muting the noisy logging from JCS.
      */
     private void muteNoisyLoggers() {
-        System.setProperty("jcs.logSystem", "slf4j");
-        Slf4jAdapter.muteLogging(true);
-
         final String[] noisyLoggers = {
             "org.apache.hc"
         };

cli/pom.xml

@@ -179,10 +179,6 @@ Copyright (c) 2012 - Jeremy Long. All Rights Reserved.
             <groupId>org.slf4j</groupId>
             <artifactId>slf4j-api</artifactId>
         </dependency>
-        <dependency>
-            <groupId>io.github.jeremylong</groupId>
-            <artifactId>jcs3-slf4j</artifactId>
-        </dependency>
         <dependency>
             <!-- not visible in imports due to method chaining, but App code uses classes from this library -->
             <groupId>io.github.jeremylong</groupId>

cli/src/main/java/org/owasp/dependencycheck/App.java

@@ -48,7 +48,6 @@
 import ch.qos.logback.classic.spi.ILoggingEvent;
 import ch.qos.logback.classic.Level;
 import ch.qos.logback.classic.LoggerContext;
-import io.github.jeremylong.jcs3.slf4j.Slf4jAdapter;
 import java.util.TreeSet;
 import org.owasp.dependencycheck.utils.SeverityUtil;
 
@@ -84,10 +83,6 @@ public class App {
      */
     @SuppressWarnings("squid:S4823")
     public static void main(String[] args) {
-        System.setProperty("jcs.logSystem", "slf4j");
-        if (!LOGGER.isDebugEnabled()) {
-            Slf4jAdapter.muteLogging(true);
-        }
         final int exitCode;
         final App app = new App();
         exitCode = app.run(args);

cli/src/main/resources/logback.xml

@@ -11,7 +11,7 @@
     </appender>
 
     <logger name="org.apache.lucene" level="ERROR" />
-    <logger name="org.apache.commons.jcs" level="ERROR" />
+    <logger name="org.apache.commons.jcs3" level="FATAL" />
     <logger name="org.apache.hc" level="ERROR" />
 
     <root level="INFO">

core/pom.xml

@@ -197,14 +197,14 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
             <groupId>org.whitesource</groupId>
             <artifactId>pecoff4j</artifactId>
         </dependency>
-        <dependency>
-            <groupId>org.apache.commons</groupId>
-            <artifactId>commons-jcs3-core</artifactId>
-        </dependency>
+        <!-- JCS 3 logging adapter; intentionally higher on classpath than JCS itself -->
         <dependency>
             <groupId>io.github.jeremylong</groupId>
             <artifactId>jcs3-slf4j</artifactId>
-            <scope>runtime</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-jcs3-core</artifactId>
         </dependency>
         <dependency>
             <groupId>com.github.package-url</groupId>

core/src/main/java/org/owasp/dependencycheck/data/cache/DataCache.java

@@ -38,7 +38,7 @@ public class DataCache<T> {
      *
      * @param cache a reference to the underlying cache implementation.
      */
-    public DataCache(CacheAccess<String, T> cache) {
+    DataCache(CacheAccess<String, T> cache) {
         this.cache = cache;
     }
 

core/src/main/java/org/owasp/dependencycheck/data/cache/DataCacheFactory.java

@@ -22,6 +22,8 @@
 import java.io.InputStream;
 import java.util.List;
 import java.util.Properties;
+
+import io.github.jeremylong.jcs3.slf4j.Slf4jAdapter;
 import org.apache.commons.jcs3.JCS;
 import org.apache.commons.jcs3.access.CacheAccess;
 import org.apache.commons.jcs3.access.exception.CacheException;
@@ -77,6 +79,13 @@ private enum CacheType {
         POM
     }
 
+    static {
+        System.setProperty("jcs.logSystem", "slf4j");
+        if (!LOGGER.isTraceEnabled()) {
+            Slf4jAdapter.muteLogging(true);
+        }
+    }
+
     /**
      * Creates the data cache factory.
      *

maven/pom.xml

@@ -124,10 +124,6 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved.
             <artifactId>mockito-junit-jupiter</artifactId>
             <scope>test</scope>
         </dependency>
-        <dependency>
-            <groupId>io.github.jeremylong</groupId>
-            <artifactId>jcs3-slf4j</artifactId>
-        </dependency>
         <dependency>
             <groupId>org.apache.maven</groupId>
             <artifactId>maven-plugin-api</artifactId>

maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java

@@ -20,7 +20,6 @@
 import com.github.packageurl.MalformedPackageURLException;
 import com.github.packageurl.PackageURL.StandardTypes;
 import com.github.packageurl.PackageURL;
-import io.github.jeremylong.jcs3.slf4j.Slf4jAdapter;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
@@ -2731,11 +2730,6 @@ private String[] determineSuppressions() {
      * Hacky method of muting the noisy logging from JCS
      */
     protected void muteNoisyLoggers() {
-        System.setProperty("jcs.logSystem", "slf4j");
-        if (!getLog().isDebugEnabled()) {
-            Slf4jAdapter.muteLogging(true);
-        }
-
         final String[] noisyLoggers = {
             "org.apache.hc"
         };