Skip to content

Commit 2040dcf

Browse files
loong10kloong10k
committed
fix(deps): upgrade ognl 3.4.2 + jsoup 1.16.1 + velocity-tools-generic 3.1 (CVE fixes)
- ognl 3.2.13 -> 3.4.2 (CVE-2024-36247): MemberAccess adaptation - jsoup 1.15.1 -> 1.16.1 (CVE-2023-39721) - velocity-tools 2.0 -> velocity-tools-generic 3.1 (CVE-2020-13936) Full verify (JDK 17): BUILD SUCCESS, 543 tests.
1 parent 20004ad commit 2040dcf

3 files changed

Lines changed: 15 additions & 43 deletions

File tree

‎easydoc-core/src/main/java/io/github/easy4j/doc/ognl/DefaultMemberAccess.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,9 @@
77
import java.lang.reflect.AccessibleObject;
88
import java.lang.reflect.Member;
99
import java.lang.reflect.Modifier;
10-
import java.util.Map;
1110

1211
import ognl.MemberAccess;
12+
import ognl.OgnlContext;
1313

1414
/**
1515
* @author <a href="https://github.com/loong10k">Loong Wan</a>
@@ -34,7 +34,7 @@ public DefaultMemberAccess(boolean allowPrivateAccess, boolean allowProtectedAcc
3434
}
3535

3636
@Override
37-
public Object setup(Map context, Object target, Member member, String propertyName) {
37+
public Object setup(OgnlContext context, Object target, Member member, String propertyName) {
3838
Object result = null;
3939

4040
if (isAccessible(context, target, member, propertyName)) {
@@ -49,7 +49,7 @@ public Object setup(Map context, Object target, Member member, String propertyNa
4949
}
5050

5151
@Override
52-
public void restore(Map context, Object target, Member member, String propertyName, Object state) {
52+
public void restore(OgnlContext context, Object target, Member member, String propertyName, Object state) {
5353
if (state != null) {
5454
((AccessibleObject) member).setAccessible((Boolean) state);
5555
}
@@ -59,7 +59,7 @@ public void restore(Map context, Object target, Member member, String propertyNa
5959
* Returns true if the given member is accessible or can be made accessible by this object.
6060
*/
6161
@Override
62-
public boolean isAccessible(Map context, Object target, Member member, String propertyName) {
62+
public boolean isAccessible(OgnlContext context, Object target, Member member, String propertyName) {
6363
int modifiers = member.getModifiers();
6464
if (Modifier.isPublic(modifiers)) {
6565
return true;

‎easydoc-velocity/pom.xml‎

Lines changed: 4 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -39,25 +39,11 @@
3939
<artifactId>velocity-engine-scripting</artifactId>
4040
</dependency>
4141

42-
<!-- velocity-tools：Velocity 工具集（日期/数字/链接等辅助方法） -->
43-
<!-- 排除 struts-core/taglib/tiles：velocity-tools 传递依赖了过时的 Struts 1.x -->
42+
<!-- velocity-tools-generic：Velocity 工具集（日期/数字/链接等辅助方法） -->
43+
<!-- 3.x 拆分为 velocity-tools-generic/view/jsp；Struts 1.x 支持移入 velocity-tools-view，generic 不再传递，无需再排除 -->
4444
<dependency>
45-
<groupId>org.apache.velocity</groupId>
46-
<artifactId>velocity-tools</artifactId>
47-
<exclusions>
48-
<exclusion>
49-
<artifactId>struts-core</artifactId>
50-
<groupId>org.apache.struts</groupId>
51-
</exclusion>
52-
<exclusion>
53-
<artifactId>struts-taglib</artifactId>
54-
<groupId>org.apache.struts</groupId>
55-
</exclusion>
56-
<exclusion>
57-
<artifactId>struts-tiles</artifactId>
58-
<groupId>org.apache.struts</groupId>
59-
</exclusion>
60-
</exclusions>
45+
<groupId>org.apache.velocity.tools</groupId>
46+
<artifactId>velocity-tools-generic</artifactId>
6147
</dependency>
6248

6349
</dependencies>

‎pom.xml‎

Lines changed: 7 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@
6969
<rythm.version>1.3.0</rythm.version>
7070
<thymeleaf.version>3.0.14.RELEASE</thymeleaf.version>
7171
<velocity.version>2.4.1</velocity.version>
72-
<velocity-tools.version>2.0</velocity-tools.version>
72+
<velocity-tools.version>3.1</velocity-tools.version>
7373
<webit-script.version>1.5.2</webit-script.version>
7474

7575
<!-- ═══ Third-Party Dependencies（按字母序） ═══ -->
@@ -81,10 +81,10 @@
8181
<commons-logging.version>1.3.5</commons-logging.version>
8282
<jackson-bom.version>2.22.1</jackson-bom.version>
8383
<javax.mail-api.version>1.6.2</javax.mail-api.version>
84-
<jsoup.version>1.15.1</jsoup.version>
84+
<jsoup.version>1.16.1</jsoup.version>
8585
<junit.version>4.13.2</junit.version>
8686
<junit-jupiter.version>6.1.0</junit-jupiter.version>
87-
<ognl.version>3.2.13</ognl.version>
87+
<ognl.version>3.4.2</ognl.version>
8888
<persistence.version>2.7.6</persistence.version>
8989
<servlet-api.version>3.0.1</servlet-api.version>
9090
<slf4j.version>2.0.18</slf4j.version>
@@ -960,26 +960,12 @@
960960
<version>${velocity.version}</version>
961961
</dependency>
962962

963-
<!-- https://mvnrepository.com/artifact/org.apache.velocity/velocity-tools -->
964-
<!-- Velocity Tools：Velocity 的工具集（日期/数字/链接等） -->
963+
<!-- https://mvnrepository.com/artifact/org.apache.velocity.tools/velocity-tools-generic -->
964+
<!-- Velocity Tools Generic：Velocity 的工具集（日期/数字/链接等）；3.x 起拆分为 velocity-tools-generic/view/jsp，且不再传递 Struts 1.x -->
965965
<dependency>
966-
<groupId>org.apache.velocity</groupId>
967-
<artifactId>velocity-tools</artifactId>
966+
<groupId>org.apache.velocity.tools</groupId>
967+
<artifactId>velocity-tools-generic</artifactId>
968968
<version>${velocity-tools.version}</version>
969-
<exclusions>
970-
<exclusion>
971-
<artifactId>struts-core</artifactId>
972-
<groupId>org.apache.struts</groupId>
973-
</exclusion>
974-
<exclusion>
975-
<artifactId>struts-taglib</artifactId>
976-
<groupId>org.apache.struts</groupId>
977-
</exclusion>
978-
<exclusion>
979-
<artifactId>struts-tiles</artifactId>
980-
<groupId>org.apache.struts</groupId>
981-
</exclusion>
982-
</exclusions>
983969
</dependency>
984970
<!-- ======== Webit ======== -->
985971

0 commit comments

Comments
 (0)