Skip to content

Commit 35adbd5

Browse files
authored
Merge pull request from GHSA-hpv8-9rq5-hq7w
security: fix CWE-378 CWE-200 CWE-732 - use java.nio.files
2 parents 987ea7a + 33a1ef4 commit 35adbd5

File tree

159 files changed

+178
-12652
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

159 files changed

+178
-12652
lines changed

Diff for: bin/java-petstore-all.sh

-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@
1212
./bin/java-petstore-retrofit2rx2.sh
1313
./bin/java8-petstore-jersey2.sh
1414
./bin/java-petstore-retrofit2-play24.sh
15-
./bin/java-petstore-jersey2-java6.sh
1615
./bin/java-petstore-resttemplate.sh
1716
./bin/java-petstore-resttemplate-withxml.sh
1817
./bin/java-petstore-resteasy.sh

Diff for: bin/java-petstore-jersey2-java6.sh

-34
This file was deleted.

Diff for: modules/swagger-codegen/src/main/java/io/swagger/codegen/languages/AbstractJavaCodegen.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,7 @@ public void processOpts() {
198198
super.processOpts();
199199

200200
if (additionalProperties.containsKey(SUPPORT_JAVA6)) {
201-
this.setSupportJava6(Boolean.valueOf(additionalProperties.get(SUPPORT_JAVA6).toString()));
201+
this.setSupportJava6(false); // JAVA 6 not supported
202202
}
203203
additionalProperties.put(SUPPORT_JAVA6, supportJava6);
204204

Diff for: modules/swagger-codegen/src/main/java/io/swagger/codegen/languages/JavaClientCodegen.java

-1
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,6 @@ public JavaClientCodegen() {
6969
cliOptions.add(CliOption.newBoolean(PARCELABLE_MODEL, "Whether to generate models for Android that implement Parcelable with the okhttp-gson library."));
7070
cliOptions.add(CliOption.newBoolean(USE_PLAY_WS, "Use Play! Async HTTP client (Play WS API)"));
7171
cliOptions.add(CliOption.newString(PLAY_VERSION, "Version of Play! Framework (possible values \"play24\", \"play25\")"));
72-
cliOptions.add(CliOption.newBoolean(SUPPORT_JAVA6, "Whether to support Java6 with the Jersey1 library."));
7372
cliOptions.add(CliOption.newBoolean(USE_BEANVALIDATION, "Use BeanValidation API annotations"));
7473
cliOptions.add(CliOption.newBoolean(PERFORM_BEANVALIDATION, "Perform BeanValidation"));
7574
cliOptions.add(CliOption.newBoolean(USE_GZIP_FEATURE, "Send gzip-encoded requests"));

Diff for: modules/swagger-codegen/src/main/java/io/swagger/codegen/languages/JavaJerseyServerCodegen.java

+3-4
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ public class JavaJerseyServerCodegen extends AbstractJavaJAXRSServerCodegen {
1313

1414
protected static final String LIBRARY_JERSEY1 = "jersey1";
1515
protected static final String LIBRARY_JERSEY2 = "jersey2";
16-
16+
1717
/**
1818
* Default library template to use. (Default:{@value #DEFAULT_LIBRARY})
1919
*/
@@ -48,7 +48,6 @@ public JavaJerseyServerCodegen() {
4848
library.setDefault(DEFAULT_LIBRARY);
4949

5050
cliOptions.add(library);
51-
cliOptions.add(CliOption.newBoolean(SUPPORT_JAVA6, "Whether to support Java6 with the Jersey1/2 library."));
5251
cliOptions.add(CliOption.newBoolean(USE_TAGS, "use tags for creating interface and controller classnames"));
5352
}
5453

@@ -89,11 +88,11 @@ public void processOpts() {
8988
if (StringUtils.isEmpty(library)) {
9089
setLibrary(DEFAULT_LIBRARY);
9190
}
92-
91+
9392
if ( additionalProperties.containsKey(CodegenConstants.IMPL_FOLDER)) {
9493
implFolder = (String) additionalProperties.get(CodegenConstants.IMPL_FOLDER);
9594
}
96-
95+
9796
if (additionalProperties.containsKey(USE_TAGS)) {
9897
this.setUseTags(Boolean.valueOf(additionalProperties.get(USE_TAGS).toString()));
9998
}

Diff for: modules/swagger-codegen/src/main/resources/Java/libraries/jersey2/ApiClient.mustache

+4-3
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import java.io.InputStream;
2525

2626
{{^supportJava6}}
2727
import java.nio.file.Files;
28+
import java.nio.file.Paths;
2829
import java.nio.file.StandardCopyOption;
2930
import org.glassfish.jersey.logging.LoggingFeature;
3031
{{/supportJava6}}
@@ -296,7 +297,7 @@ public class ApiClient {
296297
public int getReadTimeout() {
297298
return readTimeout;
298299
}
299-
300+
300301
/**
301302
* Set the read timeout (in milliseconds).
302303
* A value of 0 means no timeout, otherwise values must be between 1 and
@@ -628,9 +629,9 @@ public class ApiClient {
628629
}
629630

630631
if (tempFolderPath == null)
631-
return File.createTempFile(prefix, suffix);
632+
return Files.createTempFile(prefix, suffix).toFile();
632633
else
633-
return File.createTempFile(prefix, suffix, new File(tempFolderPath));
634+
return Files.createTempFile(Paths.get(tempFolderPath), prefix, suffix).toFile();
634635
}
635636

636637
/**

Diff for: modules/swagger-codegen/src/main/resources/Java/libraries/okhttp-gson/ApiClient.mustache

+5-3
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ import java.io.File;
2424
import java.io.IOException;
2525
import java.io.InputStream;
2626
import java.io.UnsupportedEncodingException;
27+
import java.nio.file.Files;
28+
import java.nio.file.Paths;
2729
import java.lang.reflect.Type;
2830
import java.net.URLConnection;
2931
import java.net.URLEncoder;
@@ -829,9 +831,9 @@ public class ApiClient {
829831
}
830832

831833
if (tempFolderPath == null)
832-
return File.createTempFile(prefix, suffix);
834+
return Files.createTempFile(prefix, suffix).toFile();
833835
else
834-
return File.createTempFile(prefix, suffix, new File(tempFolderPath));
836+
return Files.createTempFile(Paths.get(tempFolderPath), prefix, suffix).toFile();
835837
}
836838

837839
/**
@@ -981,7 +983,7 @@ public class ApiClient {
981983
* @param formParams The form parameters
982984
* @param authNames The authentications to apply
983985
* @param progressRequestListener Progress request listener
984-
* @return The HTTP request
986+
* @return The HTTP request
985987
* @throws ApiException If fail to serialize the request body object
986988
*/
987989
public Request buildRequest(String path, String method, List<Pair> queryParams, List<Pair> collectionQueryParams, Object body, Map<String, String> headerParams, Map<String, Object> formParams, String[] authNames, ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {

Diff for: modules/swagger-codegen/src/main/resources/Java/libraries/resteasy/ApiClient.mustache

+4-3
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import java.io.InputStream;
88
import java.io.UnsupportedEncodingException;
99
import java.net.URLEncoder;
1010
import java.nio.file.Files;
11+
import java.nio.file.Paths;
1112
import java.text.DateFormat;
1213
import java.text.SimpleDateFormat;
1314
import java.util.ArrayList;
@@ -446,7 +447,7 @@ public class ApiClient {
446447
public Entity<?> serialize(Object obj, Map<String, Object> formParams, String contentType) throws ApiException {
447448
Entity<?> entity = null;
448449
if (contentType.startsWith("multipart/form-data")) {
449-
MultipartFormDataOutput multipart = new MultipartFormDataOutput();
450+
MultipartFormDataOutput multipart = new MultipartFormDataOutput();
450451
//MultiPart multiPart = new MultiPart();
451452
for (Entry<String, Object> param: formParams.entrySet()) {
452453
if (param.getValue() instanceof File) {
@@ -552,9 +553,9 @@ public class ApiClient {
552553
}
553554

554555
if (tempFolderPath == null)
555-
return File.createTempFile(prefix, suffix);
556+
return Files.createTempFile(prefix, suffix).toFile();
556557
else
557-
return File.createTempFile(prefix, suffix, new File(tempFolderPath));
558+
return Files.createTempFile(Paths.get(tempFolderPath), prefix, suffix).toFile();
558559
}
559560

560561
/**

Diff for: modules/swagger-codegen/src/main/resources/finch/api.mustache

+3-1
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ import com.twitter.util.Future
1616
import com.twitter.io.Buf
1717
import io.finch._, items._
1818
import java.io.File
19+
import java.nio.file.Files
20+
import java.nio.file.Paths
1921
import java.time._
2022

2123
object {{classname}} {
@@ -81,7 +83,7 @@ object {{classname}} {
8183
}
8284

8385
private def bytesToFile(input: Array[Byte]): java.io.File = {
84-
val file = File.createTempFile("tmp{{classname}}", null)
86+
val file = Files.createTempFile("tmp{{classname}}", null).toFile()
8587
val output = new FileOutputStream(file)
8688
output.write(input)
8789
file

Diff for: modules/swagger-codegen/src/main/resources/kotlin-client/infrastructure/ApiClient.kt.mustache

+8-7
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package {{packageName}}.infrastructure
33
import okhttp3.*
44
import java.io.File
55
import java.io.IOException
6+
import java.nio.file.Files;
67
import java.util.regex.Pattern
78

89
open class ApiClient(val baseUrl: String) {
@@ -64,15 +65,15 @@ open class ApiClient(val baseUrl: String) {
6465
6566
inline protected fun <reified T: Any?> responseBody(response: Response, mediaType: String = JsonMediaType): T? {
6667
if(response.body() == null) return null
67-
68+
6869
if(T::class.java == java.io.File::class.java){
6970
return downloadFileFromResponse(response) as T
7071
} else if(T::class == kotlin.Unit::class) {
7172
return kotlin.Unit as T
7273
}
73-
74+
7475
var contentType = response.headers().get("Content-Type")
75-
76+
7677
if(contentType == null) {
7778
contentType = JsonMediaType
7879
}
@@ -85,7 +86,7 @@ open class ApiClient(val baseUrl: String) {
8586
TODO("Fill in more types!")
8687
}
8788
}
88-
89+
8990
fun isJsonMime(mime: String?): Boolean {
9091
val jsonMime = "(?i)^(application/json|[^;/ \t]+/[^;/ \t]+[+]json)[ \t]*(;.*)?$"
9192
return mime != null && (mime.matches(jsonMime.toRegex()) || mime == "*/*")
@@ -162,7 +163,7 @@ open class ApiClient(val baseUrl: String) {
162163
)
163164
}
164165
}
165-
166+
166167
@Throws(IOException::class)
167168
fun downloadFileFromResponse(response: Response): File {
168169
val file = prepareDownloadFile(response)
@@ -206,6 +207,6 @@ open class ApiClient(val baseUrl: String) {
206207
prefix = "download-"
207208
}
208209

209-
return File.createTempFile(prefix, suffix);
210+
return Files.createTempFile(prefix, suffix).toFile();
210211
}
211-
}
212+
}

Diff for: modules/swagger-codegen/src/test/java/io/swagger/codegen/config/CodegenConfiguratorTest.java

-4
Original file line numberDiff line numberDiff line change
@@ -162,14 +162,12 @@ public void testAdditionalProperties() throws Exception {
162162

163163
configurator.addAdditionalProperty("foo", "bar")
164164
.addAdditionalProperty("hello", "world")
165-
.addAdditionalProperty("supportJava6", false)
166165
.addAdditionalProperty("useRxJava", true);
167166

168167
final ClientOptInput clientOptInput = setupAndRunGenericTest(configurator);
169168

170169
assertValueInMap(clientOptInput.getConfig().additionalProperties(), "foo", "bar");
171170
assertValueInMap(clientOptInput.getConfig().additionalProperties(), "hello", "world");
172-
assertValueInMap(clientOptInput.getConfig().additionalProperties(), "supportJava6", false);
173171
assertValueInMap(clientOptInput.getConfig().additionalProperties(), "useRxJava", true);
174172
}
175173

@@ -250,13 +248,11 @@ public void testLibrary() throws Exception {
250248
@Test
251249
public void testDynamicProperties() throws Exception {
252250
configurator.addDynamicProperty(CodegenConstants.LOCAL_VARIABLE_PREFIX, "_");
253-
configurator.addDynamicProperty("supportJava6", false);
254251
configurator.addDynamicProperty("useRxJava", true);
255252

256253
final ClientOptInput clientOptInput = setupAndRunGenericTest(configurator);
257254

258255
assertValueInMap(clientOptInput.getConfig().additionalProperties(), CodegenConstants.LOCAL_VARIABLE_PREFIX, "_");
259-
assertValueInMap(clientOptInput.getConfig().additionalProperties(), "supportJava6", false);
260256
assertValueInMap(clientOptInput.getConfig().additionalProperties(), "useRxJava", true);
261257
}
262258

Diff for: modules/swagger-codegen/src/test/java/io/swagger/codegen/jaxrs/JaxRSServerOptionsTest.java

+1-3
Original file line numberDiff line numberDiff line change
@@ -72,10 +72,8 @@ protected void setExpectations() {
7272
times = 1;
7373
clientCodegen.setDateLibrary("joda");
7474
times = 1;
75-
clientCodegen.setSupportJava6(false);
76-
times = 1;
7775
clientCodegen.setUseBeanValidation(Boolean.valueOf(JaxRSServerOptionsProvider.USE_BEANVALIDATION));
78-
times = 1;
76+
times = 1;
7977
clientCodegen.setUseTags(Boolean.valueOf(JaxRSServerOptionsProvider.USE_TAGS));
8078
times = 1;
8179
}};

Diff for: modules/swagger-codegen/src/test/java/io/swagger/codegen/options/JavaClientOptionsProvider.java

-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ public Map<String, String> createOptions() {
2121
options.put(JavaClientCodegen.USE_PLAY_WS, "false");
2222
options.put(JavaClientCodegen.PLAY_VERSION, JavaClientCodegen.PLAY_25);
2323
options.put(JavaClientCodegen.PARCELABLE_MODEL, "false");
24-
options.put(JavaClientCodegen.SUPPORT_JAVA6, "false");
2524
options.put(JavaClientCodegen.USE_BEANVALIDATION, "false");
2625
options.put(JavaClientCodegen.PERFORM_BEANVALIDATION, PERFORM_BEANVALIDATION);
2726
options.put(JavaClientCodegen.USE_GZIP_FEATURE, "false");

Diff for: modules/swagger-codegen/src/test/java/io/swagger/codegen/options/JaxRSServerOptionsProvider.java

-1
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,6 @@ public Map<String, String> createOptions() {
5858
ImmutableMap.Builder<String, String> builder = new ImmutableMap.Builder<String, String>();
5959
builder.put(CodegenConstants.IMPL_FOLDER, IMPL_FOLDER_VALUE)
6060
.put(JavaClientCodegen.DATE_LIBRARY, "joda") //java.lang.IllegalArgumentException: Multiple entries with same key: dateLibrary=joda and dateLibrary=joda
61-
.put(JavaClientCodegen.SUPPORT_JAVA6, "false")
6261
.put("title", "Test title")
6362
.put(CodegenConstants.MODEL_PACKAGE, MODEL_PACKAGE_VALUE)
6463
.put(CodegenConstants.API_PACKAGE, API_PACKAGE_VALUE)

Diff for: modules/swagger-codegen/src/test/resources/2_0/templates/Java/libraries/jersey2/ApiClient.mustache

+3-2
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ import java.io.InputStream;
2727

2828
{{^supportJava6}}
2929
import java.nio.file.Files;
30+
import java.nio.file.Paths;
3031
import java.nio.file.StandardCopyOption;
3132
{{/supportJava6}}
3233
{{#supportJava6}}
@@ -624,9 +625,9 @@ public class ApiClient {
624625
}
625626

626627
if (tempFolderPath == null)
627-
return File.createTempFile(prefix, suffix);
628+
return Files.createTempFile(prefix, suffix).toFile();
628629
else
629-
return File.createTempFile(prefix, suffix, new File(tempFolderPath));
630+
return Files.createTempFile(Paths.get(tempFolderPath), prefix, suffix).toFile();
630631
}
631632

632633
/**

Diff for: pom.xml

-12
Original file line numberDiff line numberDiff line change
@@ -408,18 +408,6 @@
408408
<module>samples/client/petstore/java/jersey2</module>
409409
</modules>
410410
</profile>
411-
<profile>
412-
<id>java-client-jersey2-java6</id>
413-
<activation>
414-
<property>
415-
<name>env</name>
416-
<value>java</value>
417-
</property>
418-
</activation>
419-
<modules>
420-
<module>samples/client/petstore/java/jersey2-java6</module>
421-
</modules>
422-
</profile>
423411
<profile>
424412
<id>java-client-okhttp-gson</id>
425413
<activation>

Diff for: pom.xml.bash

-12
Original file line numberDiff line numberDiff line change
@@ -408,18 +408,6 @@
408408
<module>samples/client/petstore/java/jersey2</module>
409409
</modules>
410410
</profile>
411-
<profile>
412-
<id>java-client-jersey2-java6</id>
413-
<activation>
414-
<property>
415-
<name>env</name>
416-
<value>java</value>
417-
</property>
418-
</activation>
419-
<modules>
420-
<module>samples/client/petstore/java/jersey2-java6</module>
421-
</modules>
422-
</profile>
423411
<profile>
424412
<id>java-client-okhttp-gson</id>
425413
<activation>

Diff for: pom.xml.circleci

-12
Original file line numberDiff line numberDiff line change
@@ -368,18 +368,6 @@
368368
<module>samples/client/petstore/java/jersey2</module>
369369
</modules>
370370
</profile>
371-
<profile>
372-
<id>java-client-jersey2-java6</id>
373-
<activation>
374-
<property>
375-
<name>env</name>
376-
<value>java</value>
377-
</property>
378-
</activation>
379-
<modules>
380-
<module>samples/client/petstore/java/jersey2-java6</module>
381-
</modules>
382-
</profile>
383371
<profile>
384372
<id>java-client-okhttp-gson</id>
385373
<activation>

0 commit comments

Comments
 (0)