Skip to content

Commit 7794262

Browse files
fpanizzafpanizza
authored
Update Commons IO to 2.11 in Java, keeps 2.2 in Android (#511)
https://issues.genexus.com/viewissue.aspx?88708 Java - Dependencias con vulnerabilidades conocidas - commons-io
1 parent 0aa1eae commit 7794262

File tree

9 files changed

+103
-51
lines changed

9 files changed

+103
-51
lines changed

‎android/pom.xml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,23 @@
1818
<groupId>${project.groupId}</groupId>
1919
<artifactId>gxcryptocommon</artifactId>
2020
<version>${project.version}</version>
21+
<exclusions>
22+
<exclusion> <!-- exclude common io from android -->
23+
<groupId>commons-io</groupId>
24+
<artifactId>commons-io</artifactId>
25+
</exclusion>
26+
</exclusions>
2127
</dependency>
2228
<dependency>
2329
<groupId>${project.groupId}</groupId>
2430
<artifactId>gxcommon</artifactId>
2531
<version>${project.version}</version>
32+
<exclusions>
33+
<exclusion> <!-- exclude common io from android -->
34+
<groupId>commons-io</groupId>
35+
<artifactId>commons-io</artifactId>
36+
</exclusion>
37+
</exclusions>
2638
</dependency>
2739
<dependency>
2840
<groupId>org.locationtech.spatial4j</groupId>
@@ -39,6 +51,14 @@
3951
<artifactId>commons-collections4</artifactId>
4052
<version>4.1</version>
4153
</dependency>
54+
<!-- add explicit common io in Android -->
55+
<!-- Android need version 2.2 until api 26, where java.nio is added -->
56+
<dependency>
57+
<groupId>commons-io</groupId>
58+
<artifactId>commons-io</artifactId>
59+
<version>2.2</version>
60+
</dependency>
61+
4262
</dependencies>
4363

4464
<build>

‎androidreports/pom.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,12 @@
1818
<groupId>${project.groupId}</groupId>
1919
<artifactId>gxcommon</artifactId>
2020
<version>${project.version}</version>
21+
<exclusions>
22+
<exclusion> <!-- exclude common io from android -->
23+
<groupId>commons-io</groupId>
24+
<artifactId>commons-io</artifactId>
25+
</exclusion>
26+
</exclusions>
2127
</dependency>
2228
<dependency>
2329
<groupId>${project.groupId}</groupId>

‎common/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@
3232
<dependency>
3333
<groupId>commons-io</groupId>
3434
<artifactId>commons-io</artifactId>
35-
<version>2.2</version>
35+
<version>2.11.0</version>
3636
</dependency>
3737
<dependency>
3838
<groupId>org.simpleframework</groupId>

‎java/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@
6868
<dependency>
6969
<groupId>commons-io</groupId>
7070
<artifactId>commons-io</artifactId>
71-
<version>2.2</version>
71+
<version>2.11.0</version>
7272
</dependency>
7373
<dependency>
7474
<groupId>joda-time</groupId>

‎java/src/main/java/com/genexus/PrivateUtilities.java‎

Lines changed: 55 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
import java.util.zip.InflaterInputStream;
2626

2727
import com.genexus.common.interfaces.SpecificImplementation;
28+
import com.genexus.internet.GXInternetConstants;
2829
import com.genexus.platform.NativeFunctions;
2930
import com.genexus.util.Codecs;
3031
import com.genexus.util.IniFile;
@@ -767,38 +768,64 @@ public static void copyFileRetry(String src, String dest)
767768
try { destination.close(); } catch (IOException e) { ; }
768769
}
769770
}
770-
771-
772-
public static void InputStreamToFile(InputStream source, String fileName)
773-
{
774-
if (source == null)
775-
{
776-
throw new IllegalArgumentException("InputStreamToFile -> Input stream can't be null");
771+
public static String BOMInputStreamToStringUTF8(InputStream istream) {
772+
if (istream == null) {
773+
throw new IllegalArgumentException("BOMInputStreamToStringUTF8 -> Input stream can't be null");
777774
}
778-
779-
byte[] buffer;
780-
int bytes_read;
781-
OutputStream destination = null;
782-
try
783-
{
784-
destination = new BufferedOutputStream(new FileOutputStream(fileName));
785-
buffer = new byte[1024];
786-
787-
while (true)
788-
{
789-
bytes_read = source.read(buffer);
790-
if (bytes_read == -1) break;
791-
destination.write(buffer, 0, bytes_read);
775+
boolean firstLine = true;
776+
StringBuilder stringBuilder = new StringBuilder();
777+
try (BufferedReader r = new BufferedReader(new InputStreamReader(istream, "UTF8"))) {
778+
for (String s = ""; (s = r.readLine()) != null; ) {
779+
if (firstLine) {
780+
s = removeUTF8BOM(s);
781+
firstLine = false;
782+
}
783+
stringBuilder.append(s + GXInternetConstants.CRLFString);
792784
}
785+
return stringBuilder.toString();
786+
} catch (Exception e) {
787+
System.err.println("Error reading stream:" + e.getMessage());
788+
return "";
793789
}
794-
catch (IOException e)
795-
{
796-
System.err.println("Error writing file " + fileName + ":" + e.getMessage());
790+
}
791+
static final String UTF8_BOM = "\uFEFF";
792+
private static String removeUTF8BOM(String s) {
793+
if (s.startsWith(UTF8_BOM)) {
794+
s = s.substring(1);
797795
}
798-
finally
799-
{
800-
if (source != null)
801-
try { source.close(); } catch (IOException e) { ; }
796+
return s;
797+
}
798+
799+
public static void InputStreamToFile(InputStream source, String fileName)
800+
{
801+
if (source == null)
802+
{
803+
throw new IllegalArgumentException("InputStreamToFile -> Input stream can't be null");
804+
}
805+
806+
byte[] buffer;
807+
int bytes_read;
808+
OutputStream destination = null;
809+
try
810+
{
811+
destination = new BufferedOutputStream(new FileOutputStream(fileName));
812+
buffer = new byte[1024];
813+
814+
while (true)
815+
{
816+
bytes_read = source.read(buffer);
817+
if (bytes_read == -1) break;
818+
destination.write(buffer, 0, bytes_read);
819+
}
820+
}
821+
catch (IOException e)
822+
{
823+
System.err.println("Error writing file " + fileName + ":" + e.getMessage());
824+
}
825+
finally
826+
{
827+
if (source != null)
828+
try { source.close(); } catch (IOException e) { ; }
802829
if (destination != null)
803830
try {destination.close(); } catch (IOException e) { ; }
804831
}

‎java/src/main/java/com/genexus/internet/HttpContext.java‎

Lines changed: 8 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,8 @@
11
package com.genexus.internet;
22

3-
import java.io.IOException;
4-
import java.io.InputStream;
5-
import java.io.OutputStream;
6-
import java.io.PrintWriter;
3+
import java.io.*;
74
import java.util.Date;
85
import java.util.Enumeration;
9-
import java.io.File;
106
import java.util.HashMap;
117
import java.util.HashSet;
128
import java.util.Hashtable;
@@ -17,8 +13,6 @@
1713
import com.genexus.servlet.http.IHttpServletResponse;
1814

1915
import com.genexus.*;
20-
import org.apache.commons.io.IOUtils;
21-
import org.apache.commons.io.input.BOMInputStream;
2216

2317
import com.genexus.usercontrols.UserControlFactoryImpl;
2418
import com.genexus.util.Codecs;
@@ -442,21 +436,20 @@ private String FetchCustomCSS()
442436
if (cssContent == null)
443437
{
444438
String path = getRequest().getServletPath().replaceAll(".*/", "") + ".css";
445-
try
439+
try(InputStream istream = context.packageClass.getResourceAsStream(path))
446440
{
447-
InputStream istream = context.packageClass.getResourceAsStream(path);
441+
448442
if (istream == null)
449443
{
450444
cssContent = "";
451445
}
452-
else
453-
{
454-
BOMInputStream bomInputStream = new BOMInputStream(istream);
455-
cssContent = IOUtils.toString(bomInputStream, "UTF-8");
446+
else {
447+
//BOMInputStream bomInputStream = new BOMInputStream(istream);// Avoid using BOMInputStream because of runtime error (java.lang.NoSuchMethodError: org.apache.commons.io.IOUtils.length([Ljava/lang/Object;)I) issue 94611
448+
//cssContent = IOUtils.toString(bomInputStream, "UTF-8");
449+
cssContent = PrivateUtilities.BOMInputStreamToStringUTF8(istream);
456450
}
457451
}
458-
catch ( Exception e)
459-
{
452+
catch ( Exception e) {
460453
cssContent = "";
461454
}
462455
ApplicationContext.getcustomCSSContent().put(getRequest().getServletPath(), cssContent);

‎java/src/main/java/com/genexus/util/GXFile.java‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -763,8 +763,14 @@ public void close() {
763763
}
764764
}
765765
if (lineIterator != null) {
766-
lineIterator.close();
767-
lineIterator = null;
766+
try {
767+
lineIterator.close();
768+
lineIterator = null;
769+
}
770+
catch (java.io.IOException e) {
771+
setUnknownError();
772+
e.printStackTrace();
773+
}
768774
}
769775
}
770776
}

‎java/src/main/java/com/genexus/webpanels/WebUtils.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@
1010
import com.genexus.*;
1111
import com.genexus.internet.HttpContext;
1212
import org.apache.commons.io.IOUtils;
13-
import org.apache.commons.io.input.BOMInputStream;
1413

1514
import com.genexus.diagnostics.core.ILogger;
1615
import com.genexus.diagnostics.core.LogManager;
@@ -521,8 +520,9 @@ public static void AddExternalServicesFile(Class<?> gxAppClass, Set<Class<?>> rr
521520
InputStream is = getInputStreamFile(gxAppClass, servicesClassesFileName);
522521
if (is != null)
523522
{
524-
BOMInputStream bomInputStream = new BOMInputStream(is);
525-
String xmlstring = IOUtils.toString(bomInputStream, "UTF-8");
523+
//BOMInputStream bomInputStream = new BOMInputStream(is);// Avoid using BOMInputStream because of runtime error (java.lang.NoSuchMethodError: org.apache.commons.io.IOUtils.length([Ljava/lang/Object;)I) issue 94611
524+
//IOUtils.toString(bomInputStream, "UTF-8");
525+
String xmlstring = PrivateUtilities.BOMInputStreamToStringUTF8(is);
526526

527527
XMLReader reader = new XMLReader();
528528
reader.openFromString(xmlstring);

‎wrappercommon/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@
3232
<dependency>
3333
<groupId>commons-io</groupId>
3434
<artifactId>commons-io</artifactId>
35-
<version>2.2</version>
35+
<version>2.11.0</version>
3636
</dependency>
3737
</dependencies>
3838

0 commit comments

Comments
 (0)