Add a Kotlin dependency to work around CVE-2022-24329 (#7660)

* Bump okio to 3.3.0 * Avoid bad kotlin stdlib versions * Update okhttp/build.gradle Co-authored-by: Jesse Wilson <jwilson@squareup.com>
square · Jan 22, 2023 · cbcf4f3 · cbcf4f3
1 parent 8eddd1d
commit cbcf4f3
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/build.gradle b/build.gradle
@@ -40,6 +40,7 @@ buildscript {
       'jsr305': "com.google.code.findbugs:jsr305:${versions.findbugs}",
       'junit': "junit:junit:${versions.junit}",
       'kotlinStdlib': "org.jetbrains.kotlin:kotlin-stdlib:${versions.kotlin}",
+      'kotlinStdlibJdk8': "org.jetbrains.kotlin:kotlin-stdlib-jdk8:${versions.kotlin}",
       'moshi': "com.squareup.moshi:moshi:${versions.moshi}",
       'moshiKotlin': "com.squareup.moshi:moshi-kotlin-codegen:${versions.moshi}",
       'okio': "com.squareup.okio:okio:${versions.okio}",

diff --git a/okhttp/build.gradle b/okhttp/build.gradle
@@ -24,6 +24,9 @@ task copyJavaTemplates(type: Copy) {
 dependencies {
   api deps.okio
   api deps.kotlinStdlib
+  // Only imported to avoid broken vulnerability scanners for CVE-2022-24329
+  // https://github.com/square/okhttp/issues/7654
+  api deps.kotlinStdlibJdk8
   compileOnly deps.android
   compileOnly deps.bouncycastle
   compileOnly deps.bouncycastletls