Upgrade xstream java library

[rlouapre]

xstream-1.4.2.jar was released in Nov 2011 and a customer has reported the following public venurabilities:

Summary

* CVE-2016-3674

Descriptions

* CVE-2016-3674

Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.

Would it be possible to upgrade this library (./deploy/lib/java/xstream-1.4.2.jar)?

BTW - when does Roxy use java libraries in ./deploy/lib/java?

[dmcassel]

Roxy has features for MLCP, RecordLoader, and Corb. Upgrading would be fine, but should be tested. Actually, I wouldn't have a problem dropping RecordLoader support, which would eliminate the need for a couple of those JARs. In the meantime, if you're not using those features, deleting those JARs from your local repo would be fine.

[heelix]

We are using RecordLoader -- please leave it in for us still using it with roxy.

[dmcassel]

@heelix, thanks, good to know someone is using it.

[grtjn]

Just ran a test with xstream-1.4.10.jar, which worked just fine for me. Note that we improved the code a while ago. It looks for xstream*.jar, so you can just trade out the jar with a newer version and try.

I'll also upgrade xcc to latest..

Small note though: xstream 1.4.10 seems to require Java 1.8. There is a separate xstream-1.4.10-java7.jar for download, but that will not run with Java 1.8, as it expects some Lambda classes that are not included in the java7 jar.

[grtjn]

Also, xstream is used by XQSync only, not RecordLoader. Both use xpp3 though..

[grtjn]

Fixed in dev