From 259d5a234f5c858a57902ddd8bebcfaba7a5e4cd Mon Sep 17 00:00:00 2001
From: PJ Fanning <fanningpj@apache.org>
Date: Thu, 21 Mar 2019 13:43:19 +0000
Subject: [PATCH] upgrade xmlsec, slf4j, batik

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1855990 13f79535-47bb-0310-9956-ffa450edef68
---
 .classpath                                        |  4 ++--
 build.gradle                                      |  4 ++--
 build.xml                                         | 15 +++++++++------
 sonar/ooxml/pom.xml                               |  2 +-
 .../poi/poifs/crypt/dsig/SignatureInfo.java       |  4 ++--
 5 files changed, 16 insertions(+), 13 deletions(-)

diff --git a/.classpath b/.classpath
index 6c3084ee23..77baa579b1 100644
--- a/.classpath
+++ b/.classpath
@@ -27,13 +27,13 @@
 	<classpathentry kind="lib" path="lib/jmh-core-1.19.jar"/>
 	<classpathentry kind="lib" path="lib/jmh-generator-annprocess-1.19.jar"/>
 	<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/JavaSE-1.8"/>
-	<classpathentry exported="true" kind="lib" path="compile-lib/slf4j-api-1.7.25.jar"/>
+	<classpathentry exported="true" kind="lib" path="compile-lib/slf4j-api-1.7.26.jar"/>
 	<classpathentry kind="lib" path="compile-lib/bcpkix-jdk15on-1.61.jar"/>
 	<classpathentry kind="lib" path="compile-lib/bcprov-ext-jdk15on-1.61.jar"/>
 	<classpathentry kind="lib" path="ooxml-testlib/reflections.jar"/>
 	<classpathentry kind="lib" path="ooxml-testlib/guava.jar"/>
 	<classpathentry kind="lib" path="ooxml-testlib/javassist.jar"/>
-	<classpathentry exported="true" kind="lib" path="compile-lib/xmlsec-2.1.0.jar"/>
+	<classpathentry exported="true" kind="lib" path="compile-lib/xmlsec-2.1.2.jar"/>
 	<classpathentry exported="true" kind="lib" path="lib/commons-codec-1.12.jar"/>
 	<classpathentry exported="true" kind="lib" path="lib/commons-logging-1.2.jar"/>
 	<classpathentry exported="true" kind="lib" path="lib/commons-collections4-4.3.jar"/>
diff --git a/build.gradle b/build.gradle
index 2d574fed04..774073f2b3 100644
--- a/build.gradle
+++ b/build.gradle
@@ -234,12 +234,12 @@ project('ooxml') {
         compile 'org.apache.commons:commons-collections4:4.3'
         compile 'org.apache.commons:commons-math3:3.6.1'
         compile 'org.apache.commons:commons-compress:1.18'
-        compile 'org.apache.santuario:xmlsec:2.1.0'
+        compile 'org.apache.santuario:xmlsec:2.1.2'
         compile 'org.bouncycastle:bcpkix-jdk15on:1.61'
         compile 'com.github.virtuald:curvesapi:1.06'
 
         // compile only, don't add it to our dist as it blows up the size
-        compile 'org.apache.xmlgraphics:batik-all:1.10'
+        compile 'org.apache.xmlgraphics:batik-all:1.11'
         compile 'xml-apis:xml-apis-ext:1.3.04'
         compile 'org.apache.xmlgraphics:xmlgraphics-commons:2.3'
 
diff --git a/build.xml b/build.xml
index e794387d29..9c6bc603a3 100644
--- a/build.xml
+++ b/build.xml
@@ -220,18 +220,18 @@ under the License.
               value="${repository.m2}/maven2/javax/activation/activation/1.1.1/activation-1.1.1.jar"/>
 
     <!-- xml signature libs -->
-    <property name="dsig.xmlsec.jar" location="${compile.lib}/xmlsec-2.1.0.jar"/>
-    <property name="dsig.xmlsec.url" value="${repository.m2}/maven2/org/apache/santuario/xmlsec/2.1.0/xmlsec-2.1.0.jar"/>
+    <property name="dsig.xmlsec.jar" location="${compile.lib}/xmlsec-2.1.2.jar"/>
+    <property name="dsig.xmlsec.url" value="${repository.m2}/maven2/org/apache/santuario/xmlsec/2.1.2/xmlsec-2.1.2.jar"/>
     <property name="dsig.bouncycastle-prov.jar" location="${compile.lib}/bcprov-ext-jdk15on-1.61.jar"/>
     <property name="dsig.bouncycastle-prov.url" value="${repository.m2}/maven2/org/bouncycastle/bcprov-ext-jdk15on/1.61/bcprov-ext-jdk15on-1.61.jar"/>
     <property name="dsig.bouncycastle-pkix.jar" location="${compile.lib}/bcpkix-jdk15on-1.61.jar"/>
     <property name="dsig.bouncycastle-pkix.url" value="${repository.m2}/maven2/org/bouncycastle/bcpkix-jdk15on/1.61/bcpkix-jdk15on-1.61.jar"/>
-    <property name="dsig.sl4j-api.jar" location="${compile.lib}/slf4j-api-1.7.25.jar"/>
-    <property name="dsig.sl4j-api.url" value="${repository.m2}/maven2/org/slf4j/slf4j-api/1.7.25/slf4j-api-1.7.25.jar"/>
+    <property name="dsig.sl4j-api.jar" location="${compile.lib}/slf4j-api-1.7.26.jar"/>
+    <property name="dsig.sl4j-api.url" value="${repository.m2}/maven2/org/slf4j/slf4j-api/1.7.26/slf4j-api-1.7.26.jar"/>
 
     <!-- svg/batik libs - not part of the distribution -->
-    <property name="svg.batik-all.url" value="${repository.m2}/maven2/org/apache/xmlgraphics/batik-all/1.10/batik-all-1.10.jar"/>
-    <property name="svg.batik-all.jar" value="${compile.lib}/batik-all-1.10.jar"/>
+    <property name="svg.batik-all.url" value="${repository.m2}/maven2/org/apache/xmlgraphics/batik-all/1.11/batik-all-1.11.jar"/>
+    <property name="svg.batik-all.jar" value="${compile.lib}/batik-all-1.11.jar"/>
     <property name="svg.xml-apis-ext.url" value="${repository.m2}/maven2/xml-apis/xml-apis-ext/1.3.04/xml-apis-ext-1.3.04.jar"/>
     <property name="svg.xml-apis-ext.jar" value="${compile.lib}/xml-apis-ext-1.3.04.jar"/>
     <property name="svg.xmlgraphics-commons.url" value="${repository.m2}/maven2/org/apache/xmlgraphics/xmlgraphics-commons/2.3/xmlgraphics-commons-2.3.jar"/>
@@ -718,8 +718,11 @@ under the License.
                 <include name="xmlsec-2.0.6.jar"/>
                 <include name="bc*jdk15on-1.5*.jar"/>
                 <include name="bc*jdk15on-1.60*.jar"/>
+                <include name="batik-all-1.10.jar"/>
+                <include name="xmlsec-2.1.0.jar"/>
                 <include name="slf4j-api-1.7.7.jar"/>
                 <include name="slf4j-api-1.7.12.jar"/>
+                <include name="slf4j-api-1.7.25.jar"/>
             </fileset>
         </delete>
 
diff --git a/sonar/ooxml/pom.xml b/sonar/ooxml/pom.xml
index 41267d0d9e..357990f38e 100644
--- a/sonar/ooxml/pom.xml
+++ b/sonar/ooxml/pom.xml
@@ -147,7 +147,7 @@
         <dependency>
             <groupId>org.apache.santuario</groupId>
             <artifactId>xmlsec</artifactId>
-            <version>2.1.0</version>
+            <version>2.1.2</version>
         </dependency>
         <dependency>
             <groupId>org.apache.commons</groupId>
diff --git a/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/SignatureInfo.java b/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/SignatureInfo.java
index 006dd94051..32dc8db2e4 100644
--- a/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/SignatureInfo.java
+++ b/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/SignatureInfo.java
@@ -150,8 +150,8 @@ import org.w3c.dom.events.EventTarget;
  * in the classpath:</p>
  * <ul>
  * <li>BouncyCastle bcpkix and bcprov (tested against 1.61)</li>
- * <li>Apache Santuario "xmlsec" (tested against 2.1.0)</li>
- * <li>and slf4j-api (tested against 1.7.25)</li>
+ * <li>Apache Santuario "xmlsec" (tested against 2.1.2)</li>
+ * <li>and slf4j-api (tested against 1.7.26)</li>
  * </ul>
  */
 public class SignatureInfo implements SignatureConfigurable {
-- 
2.39.5