Merge pull request #544 from skjolber/reuseJsonFactory

Reuse Jackson JsonFactory, as it is thread safe
zalando · Jul 5, 2019 · 259dbbd · 259dbbd
2 parents 87af1c8 + b6fe9bd
commit 259dbbd
Show file tree

Hide file tree

Showing 5 changed files with 21 additions and 16 deletions.
diff --git a/cve-suppressions.xml b/cve-suppressions.xml
@@ -2,6 +2,7 @@
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.1.xsd">
     <suppress>
         <cve>CVE-2018-1258</cve>
+        <cve>CVE-2019-12814</cve>
     </suppress>
     <suppress>
         <cve>CVE-2019-12814</cve>

diff --git a/logbook-json/src/main/java/org/zalando/logbook/json/CompactingJsonBodyFilter.java b/logbook-json/src/main/java/org/zalando/logbook/json/CompactingJsonBodyFilter.java
@@ -1,5 +1,6 @@
 package org.zalando.logbook.json;
 
+import com.fasterxml.jackson.core.JsonFactory;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import lombok.extern.slf4j.Slf4j;
 import org.apiguardian.api.API;
@@ -23,8 +24,12 @@ public CompactingJsonBodyFilter() {
         this(new ObjectMapper());
     }
 
+    public CompactingJsonBodyFilter(final JsonFactory factory) {
+        this.compactor = new ParsingJsonCompactor(factory);
+    }
+
     public CompactingJsonBodyFilter(final ObjectMapper mapper) {
-        this.compactor = new ParsingJsonCompactor(mapper);
+        this(mapper.getFactory());
     }
 
     @Override

diff --git a/logbook-json/src/main/java/org/zalando/logbook/json/JacksonJsonFieldBodyFilter.java b/logbook-json/src/main/java/org/zalando/logbook/json/JacksonJsonFieldBodyFilter.java
@@ -30,12 +30,12 @@ public class JacksonJsonFieldBodyFilter implements BodyFilter {
 
     private final String replacement;
     private final Set<String> fields;
-    private final ObjectMapper objectMapper;
-    
+    private final JsonFactory factory;
+
     public JacksonJsonFieldBodyFilter(Collection<String> fieldNames, String replacement, ObjectMapper objectMapper) {
         this.fields = new HashSet<>(fieldNames); // thread safe for reading
         this.replacement = replacement;
-        this.objectMapper = objectMapper;
+        this.factory = objectMapper.getFactory();
     }
 
     public JacksonJsonFieldBodyFilter(Collection<String> fieldNames, String replacement) {
@@ -49,7 +49,6 @@ public String filter(String contentType, String body) {
 
     public String filter(final String body) {
         try {
-            JsonFactory factory = objectMapper.getFactory();
             final JsonParser parser = factory.createParser(body);
 
             StringWriter writer = new StringWriter(body.length() * 2); // rough estimate of final size

diff --git a/logbook-json/src/main/java/org/zalando/logbook/json/ParsingJsonCompactor.java b/logbook-json/src/main/java/org/zalando/logbook/json/ParsingJsonCompactor.java
@@ -12,12 +12,11 @@
 @AllArgsConstructor
 final class ParsingJsonCompactor implements JsonCompactor {
 
-    private final ObjectMapper mapper;
+    private final JsonFactory factory;
 
     @Override
     public String compact(final String json) throws IOException {
         final StringWriter output = new StringWriter(json.length());
-        final JsonFactory factory = mapper.getFactory();
         final JsonParser parser = factory.createParser(json);
 
         final JsonGenerator generator = factory.createGenerator(output);

diff --git a/pom.xml b/pom.xml
@@ -244,22 +244,23 @@
                     </exclusion>
                 </exclusions>
             </dependency>
-            <!-- spring boot -->
-            <dependency>
-                <groupId>org.springframework.boot</groupId>
-                <artifactId>spring-boot-dependencies</artifactId>
-                <version>${spring-boot.version}</version>
-                <type>pom</type>
-                <scope>import</scope>
-            </dependency>
             <!-- spring security -->
+            <!-- note: BOM order matters -->
             <dependency>
                 <groupId>org.springframework.security</groupId>
                 <artifactId>spring-security-bom</artifactId>
                 <version>${spring-security.version}</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <!-- spring boot -->
+            <dependency>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-dependencies</artifactId>
+                <version>${spring-boot.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
             <!-- testing: common -->
             <dependency>
                 <groupId>org.junit.platform</groupId>
@@ -652,7 +653,7 @@
             <properties>
                 <spring.version>4.3.24.RELEASE</spring.version>
                 <spring-boot.version>1.5.21.RELEASE</spring-boot.version>
-                <spring-security.version>4.2.12.RELEASE</spring-security.version>
+                <spring-security.version>4.2.13.RELEASE</spring-security.version>
             </properties>
         </profile>
         <profile>