Upgrade org.apache.commons.fileupload to latest version (1.4.0)

[mknauer]

Migration of Bugzilla bug 542478

The original bug reporter reported on 2018-12-06 10:49:46 EST ...

The result of a dependency check of our application (which is based on Eclipse RAP) showed a vulnerability in org.apache.commons.fileupload_1.3.2 with high severity and high confidence (CVE-2016-1000031). Therefore, I would like to request an upgrade of org.apache.commons.fileupload to the latest version (1.3.3) in RAP 3.7.

A detailed analysis (2018-12-11 06:29:59 EST) of the security issue in the mentioned library revealed that ...

RAP (org.eclipse.rap.fileupload bundle) is not using DiskFileItem. We are processing the input stream directly using FileItemStream (see FileUploadProcessor#handleFileUpload). That's why (...) we are not affected by the above vulnerability.

While the above ("RAP fileupload implementation is not affected by this vulnerability") is still true, we believe that an upgrade of org.apache.commons.fileupload is required in order to avoid false positives in security checks.

[mknauer]

Reading the 1.4 release notes I don't see any reason or incompatibility that would require to keep the older 1.3.3 version that was mentioned in the original bug report. Instead I would suggest to start upgrading to 1.4.

Additionally I believe there is no further IP check required for the library dependency upgrade in RAP Runtime. First, there is an already approved CQ 21543 available for another project in the files, second (and more important) according to the project handbook, ClearlyDefined is a trusted source of license information. By using the Eclipse Dash License Tool I get the following positive result for maven/mavencentral/commons-fileupload/commons-fileupload/1.4 from ClearlyDefined:

$ echo "maven/mavencentral/commons-fileupload/commons-fileupload/1.4" | java -jar org.eclipse.dash.licenses-0.0.1-20220803.055044-505.jar -
[main] INFO Querying Eclipse Foundation for license data for 1 items.
[main] INFO Found 0 items.
[main] INFO Querying ClearlyDefined for license data for 1 items.
[main] INFO Found 1 items.
[main] INFO Vetted license information was found for all content. No further investigation is required.

Unfortunately none of the clean versions are available for consumption from Eclipse Orbit, i.e. we need to find a good way to integrate this library in the RAP build process.

[mknauer]

The fix includes...

• the update of org.apache.commons.fileupload 1.3.2 to org.apache.commons.commons-fileupload 1.4.0 and
• the update of org.apache.commons.io 2.2 to org.apache.commons.commons-io 2.11.0.

Please note that the bundle symbolic name has changed because the new bundles are now consumed from Eclipse Platform which itself started to consume them directly from Maven Central.

[bwolff]

Hi,

I run into a Maven dependency resolution issue related to the version bump of commons-fileupload to 1.4.0 in my project. It seems the resulting POM dependency entry of org.apache.commons.fileupload looks like this:

<dependency>
  <groupId>commons-fileupload</groupId>
  <artifactId>commons-fileupload</artifactId>
  <version>1.4.0</version>
</dependency>

It refers to version 1.4.0, but the actual version of the commons-fileupload artefact is 1.4 (d'oh!). See: https://search.maven.org/artifact/commons-fileupload/commons-fileupload/1.4/jar

Maven treats versions 1.4 and 1.4.0 differently and fails to resolve the correct artefact from Maven central. The workaround is to declare a direct dependency to commons-fileupload in version 1.4.

I'm not sure how the pom.xml is generated, but it probably takes the information from the bundle dependencies, which afaik requires the use of the 3 part semvers, so there might be a version incompatibility between the bundle and Maven dependency worlds.

NB: I should mention that I'm experiencing this problem in a Gradle build and haven't tested it with a Maven build. However, since the version in the pom does not correspond to the artefact version in Maven central, other Maven builds might run into this issue as well.