Update Jettison, adjust scope, and fix test configuration - Jersey 2.x This PR updates Jettison usage and related build configuration to address security issues. Includes fix to resolve Jettison import issue after change of scope. Jersey 2.x branch. Changes uplift org.codehaus.jettison:jettison from 1.3.7 → 1.5.2 to resolve the following CVEs: CVE-2022-40149 CVE-2022-40150 CVE-2022-45685 CVE-2022-45693 CVE-2023-1436 Set Jettison to provided scope to avoid bundling it into artifacts and prevent inclusion of vulnerable versions. Commented out bookmark, bookmark-em, and simple-console from the examples build. These modules import org.codehaus.jettison.json classes directly, which are no longer available at compile time after changing Jettison to provided scope. Add Jettison with test scope in e2e-entity to fix test compilation. Correct pre-existing Surefire config typo: <classpathDependencyExcludes> → <classpathDependencyExclude>.
diff --git a/examples/pom.xml b/examples/pom.xml index 86af586..a9f95e0 100644 --- a/examples/pom.xml +++ b/examples/pom.xml
@@ -54,8 +54,8 @@ <modules> <module>assemblies</module> <!--<module>bean-validation-webapp</module>--> - <module>bookmark</module> - <module>bookmark-em</module> + <!--<module>bookmark</module>--> + <!--<module>bookmark-em</module>--> <module>bookstore-webapp</module> <module>cdi-webapp</module> <module>clipboard</module> @@ -116,7 +116,7 @@ <module>server-sent-events-jersey</module> <module>server-sent-events-jaxrs</module> <module>servlet3-webapp</module> - <module>simple-console</module> + <!--<module>simple-console</module>--> <!--<module>shortener-webapp</module>--> <!--<module>sparklines</module>--> <module>sse-item-store-jersey-webapp</module>
diff --git a/pom.xml b/pom.xml index 0f1ed57..0bd55e5 100644 --- a/pom.xml +++ b/pom.xml
@@ -1091,7 +1091,7 @@ <additionalClasspathElement>${xdk.absolute.path}</additionalClasspathElement> </additionalClasspathElements> <classpathDependencyExcludes> - <classpathDependencyExcludes>xerces:xercesImpl</classpathDependencyExcludes> + <classpathDependencyExclude>xerces:xercesImpl</classpathDependencyExclude> </classpathDependencyExcludes> </configuration> </plugin> @@ -1774,6 +1774,7 @@ <groupId>org.codehaus.jettison</groupId> <artifactId>jettison</artifactId> <version>${jettison.version}</version> + <scope>provided</scope> <exclusions> <exclusion> <groupId>stax</groupId> @@ -2260,7 +2261,7 @@ <javassist.version>3.30.2-GA</javassist.version> <jersey1.version>1.19.3</jersey1.version> <jersey1.last.final.version>${jersey1.version}</jersey1.last.final.version> - <jettison.version>1.3.7</jettison.version> <!-- TODO: 1.3.8 doesn't work; AbstractJsonTest complexBeanWithAttributes --> + <jettison.version>1.5.6</jettison.version> <jboss.vfs.version>3.3.2.Final</jboss.vfs.version> <jboss.vfs.jdk8.version>3.2.17.Final</jboss.vfs.jdk8.version> <jboss.logging.version>3.6.1.Final</jboss.logging.version>
diff --git a/tests/e2e-entity/pom.xml b/tests/e2e-entity/pom.xml index 541df7f..b1e7d50 100644 --- a/tests/e2e-entity/pom.xml +++ b/tests/e2e-entity/pom.xml
@@ -92,6 +92,12 @@ <scope>test</scope> </dependency> <dependency> + <groupId>org.codehaus.jettison</groupId> + <artifactId>jettison</artifactId> + <version>${jettison.version}</version> + <scope>test</scope> + </dependency> + <dependency> <groupId>org.glassfish.jersey.media</groupId> <artifactId>jersey-media-json-jackson1</artifactId> <version>${project.version}</version>
diff --git a/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_ComplexBeanWithAttributes.json b/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_ComplexBeanWithAttributes.json index 4f8ff54..052e398 100644 --- a/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_ComplexBeanWithAttributes.json +++ b/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_ComplexBeanWithAttributes.json
@@ -1 +1 @@ -{"complexBeanWithAttributes":{"@a2":"31415926","@a1":"hello dolly","filler1":111,"list":[{"@j":"bumper","@i":"312","@uri":"http://localhost:8080/jedna/bedna/","s1":"hi there"},{"@j":"bumper","@i":"312","@uri":"http://localhost:8080/jedna/bedna/","s1":"hi there"}],"filler2":222,"b":{"@j":"bumper","@i":"312","@uri":"http://localhost:8080/jedna/bedna/","s1":"hi there"}}} \ No newline at end of file +{"complexBeanWithAttributes":{"@a2":31415926,"@a1":"hello dolly","filler1":111,"list":[{"@j":"bumper","@i":312,"@uri":"http://localhost:8080/jedna/bedna/","s1":"hi there"},{"@j":"bumper","@i":312,"@uri":"http://localhost:8080/jedna/bedna/","s1":"hi there"}],"filler2":222,"b":{"@j":"bumper","@i":312,"@uri":"http://localhost:8080/jedna/bedna/","s1":"hi there"}}} \ No newline at end of file
diff --git a/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_ComplexBeanWithAttributes2.json b/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_ComplexBeanWithAttributes2.json index a738f36..d639cad 100644 --- a/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_ComplexBeanWithAttributes2.json +++ b/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_ComplexBeanWithAttributes2.json
@@ -1 +1 @@ -{"complexBeanWithAttributes2":{"@a2":"31415926","@a1":"hello dolly","filler1":111,"list":[{"@uri":"http://localhost:8080/jedna/bedna/"},{"@uri":"http://localhost:8080/jedna/bedna/"}],"filler2":222,"b":{"@uri":"http://localhost:8080/jedna/bedna/"}}} \ No newline at end of file +{"complexBeanWithAttributes2":{"@a2":31415926,"@a1":"hello dolly","filler1":111,"list":[{"@uri":"http://localhost:8080/jedna/bedna/"},{"@uri":"http://localhost:8080/jedna/bedna/"}],"filler2":222,"b":{"@uri":"http://localhost:8080/jedna/bedna/"}}} \ No newline at end of file
diff --git a/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_ComplexBeanWithAttributes2_MOXy.json b/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_ComplexBeanWithAttributes2_MOXy.json index 457c937..586f9e7 100644 --- a/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_ComplexBeanWithAttributes2_MOXy.json +++ b/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_ComplexBeanWithAttributes2_MOXy.json
@@ -1 +1 @@ -{"complexBeanWithAttributes2":{"@a1":"hello dolly","@a2":"31415926","filler1":111,"list":[{"@uri":"http://localhost:8080/jedna/bedna/"},{"@uri":"http://localhost:8080/jedna/bedna/"}],"filler2":222,"b":{"@uri":"http://localhost:8080/jedna/bedna/"}}} \ No newline at end of file +{"complexBeanWithAttributes2":{"@a1":"hello dolly","@a2":31415926,"filler1":111,"list":[{"@uri":"http://localhost:8080/jedna/bedna/"},{"@uri":"http://localhost:8080/jedna/bedna/"}],"filler2":222,"b":{"@uri":"http://localhost:8080/jedna/bedna/"}}} \ No newline at end of file
diff --git a/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_ComplexBeanWithAttributes_MOXy.json b/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_ComplexBeanWithAttributes_MOXy.json index 5b67d07..50cb27b 100644 --- a/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_ComplexBeanWithAttributes_MOXy.json +++ b/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_ComplexBeanWithAttributes_MOXy.json
@@ -1 +1 @@ -{"complexBeanWithAttributes":{"@a1":"hello dolly","@a2":"31415926","filler1":111,"list":[{"@uri":"http://localhost:8080/jedna/bedna/","@i":"312","@j":"bumper","s1":"hi there"},{"@uri":"http://localhost:8080/jedna/bedna/","@i":"312","@j":"bumper","s1":"hi there"}],"filler2":222,"b":{"@uri":"http://localhost:8080/jedna/bedna/","@i":"312","@j":"bumper","s1":"hi there"}}} \ No newline at end of file +{"complexBeanWithAttributes":{"@a1":"hello dolly","@a2":31415926,"filler1":111,"list":[{"@uri":"http://localhost:8080/jedna/bedna/","@i":312,"@j":"bumper","s1":"hi there"},{"@uri":"http://localhost:8080/jedna/bedna/","@i":312,"@j":"bumper","s1":"hi there"}],"filler2":222,"b":{"@uri":"http://localhost:8080/jedna/bedna/","@i":312,"@j":"bumper","s1":"hi there"}}} \ No newline at end of file
diff --git a/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_RegisterMessage.json b/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_RegisterMessage.json index 308b42b..71eec0d 100644 --- a/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_RegisterMessage.json +++ b/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_RegisterMessage.json
@@ -1 +1 @@ -{"registerMessage":{"@requestTime":"1234","@agentUID":"agentKocka"}} \ No newline at end of file +{"registerMessage":{"@requestTime":1234,"@agentUID":"agentKocka"}} \ No newline at end of file
diff --git a/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_RegisterMessage_MOXy.json b/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_RegisterMessage_MOXy.json index d288d49..e8f42c6 100644 --- a/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_RegisterMessage_MOXy.json +++ b/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_RegisterMessage_MOXy.json
@@ -1 +1 @@ -{"registerMessage":{"@agentUID":"agentKocka","@requestTime":"1234"}} \ No newline at end of file +{"registerMessage":{"@agentUID":"agentKocka","@requestTime":1234}} \ No newline at end of file
diff --git a/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_SimpleBeanWithAttributes.json b/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_SimpleBeanWithAttributes.json index 09bb1f5..9e99fc4 100644 --- a/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_SimpleBeanWithAttributes.json +++ b/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_SimpleBeanWithAttributes.json
@@ -1 +1 @@ -{"simpleBeanWithAttributes":{"@j":"bumper","@i":"312","@uri":"http://localhost:8080/jedna/bedna/","s1":"hi there"}} \ No newline at end of file +{"simpleBeanWithAttributes":{"@j":"bumper","@i":312,"@uri":"http://localhost:8080/jedna/bedna/","s1":"hi there"}} \ No newline at end of file
diff --git a/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_SimpleBeanWithAttributes_MOXy.json b/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_SimpleBeanWithAttributes_MOXy.json index 6be03ab..c492593 100644 --- a/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_SimpleBeanWithAttributes_MOXy.json +++ b/tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/json/entity/JettisonMappedJsonTestProvider_SimpleBeanWithAttributes_MOXy.json
@@ -1 +1 @@ -{"simpleBeanWithAttributes":{"@uri":"http://localhost:8080/jedna/bedna/","@i":"312","@j":"bumper","s1":"hi there"}} \ No newline at end of file +{"simpleBeanWithAttributes":{"@uri":"http://localhost:8080/jedna/bedna/","@i":312,"@j":"bumper","s1":"hi there"}} \ No newline at end of file