From c706290a085761d0af3a20a07ef82ea47424c031 Mon Sep 17 00:00:00 2001 From: Florian Zschocke Date: Tue, 31 Oct 2023 18:04:09 +0100 Subject: dep: Update mina-core, commons-compress and guava Update dependencies: Mina Core, Guava and commons-compress. These don't need any other adjustments. --- .classpath | 12 ++++++------ build.moxie | 6 +++--- gitblit.iml | 36 ++++++++++++++++++------------------ 3 files changed, 27 insertions(+), 27 deletions(-) diff --git a/.classpath b/.classpath index bf5450a9..094e1508 100644 --- a/.classpath +++ b/.classpath @@ -9,13 +9,13 @@ - + - - - + + + @@ -72,7 +72,7 @@ - + @@ -80,7 +80,7 @@ - + diff --git a/build.moxie b/build.moxie index 31dba4a7..e5da1b2b 100644 --- a/build.moxie +++ b/build.moxie @@ -115,7 +115,7 @@ properties: { selenium.version : 2.28.0 wikitext.version : 1.4 sshd.version: 1.7.0 - mina.version: 2.0.21 + mina.version: 2.0.25 guice.version : 5.1.0 # Gitblit maintains a fork of guice-servlet guice-servlet.version : 5.1.0-gb2 @@ -135,7 +135,7 @@ properties: { dependencies: - compile 'com.google.inject:guice:${guice.version}' :war :fedclient - compile 'com.google.inject.extensions:guice-servlet:${guice-servlet.version}' :war -- compile 'com.google.guava:guava:31.1-jre' :war :fedclient +- compile 'com.google.guava:guava:32.1.3-jre' :war :fedclient - compile 'com.intellij:annotations:12.0' :war - compile 'log4j:log4j:1.2.17' :war :fedclient :manager - compile 'org.slf4j:slf4j-api:${slf4j.version}' :war :fedclient :manager @@ -180,7 +180,7 @@ dependencies: - compile 'com.unboundid:unboundid-ldapsdk:2.3.8' :war - compile 'org.apache.ivy:ivy:2.2.0' :war - compile 'com.toedter:jcalendar:1.3.2' :authority -- compile 'org.apache.commons:commons-compress:1.22' :war +- compile 'org.apache.commons:commons-compress:1.24.0' :war - compile 'commons-io:commons-io:2.11.0' :war - compile 'com.force.api:force-partner-api:24.0.0' :war - compile 'org.freemarker:freemarker:2.3.22' :war diff --git a/gitblit.iml b/gitblit.iml index 4f83701c..15471f7e 100644 --- a/gitblit.iml +++ b/gitblit.iml @@ -48,13 +48,13 @@ - + - + - + @@ -90,35 +90,35 @@ - + - + - + - + - + - + - + - + - + @@ -737,13 +737,13 @@ - + - + - + @@ -823,13 +823,13 @@ - + - + - + -- cgit v1.2.3 From f124dfca7f8ec97b1f28cb5d258d8ee5d1da9b30 Mon Sep 17 00:00:00 2001 From: Florian Zschocke Date: Tue, 31 Oct 2023 18:27:35 +0100 Subject: dep: Update JSoup to 1.16.2 Update JSoup to version 1.16.2. This requires renaming `Whitelist` to `Safelist`, because the class name was changed in version 1.15.1 in a breaking change. --- .classpath | 2 +- build.moxie | 2 +- gitblit.iml | 6 +++--- src/main/java/com/gitblit/utils/JSoupXssFilter.java | 8 ++++---- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.classpath b/.classpath index 094e1508..6dd5eace 100644 --- a/.classpath +++ b/.classpath @@ -95,7 +95,7 @@ - + diff --git a/build.moxie b/build.moxie index e5da1b2b..e410855b 100644 --- a/build.moxie +++ b/build.moxie @@ -191,7 +191,7 @@ dependencies: - compile 'redis.clients:jedis:2.6.2' :war - compile 'ro.fortsoft.pf4j:pf4j:0.9.0' :war - compile 'org.apache.tika:tika-core:1.5' :war -- compile 'org.jsoup:jsoup:1.7.3' :war +- compile 'org.jsoup:jsoup:1.16.2' :war - compile 'com.sun.activation:javax.activation:1.2.0' :war :manager :fedclient - test 'junit:junit:4.12' # Dependencies for Selenium web page testing diff --git a/gitblit.iml b/gitblit.iml index 15471f7e..85756ae8 100644 --- a/gitblit.iml +++ b/gitblit.iml @@ -988,13 +988,13 @@ - + - + - + diff --git a/src/main/java/com/gitblit/utils/JSoupXssFilter.java b/src/main/java/com/gitblit/utils/JSoupXssFilter.java index aec22411..f2702813 100644 --- a/src/main/java/com/gitblit/utils/JSoupXssFilter.java +++ b/src/main/java/com/gitblit/utils/JSoupXssFilter.java @@ -18,7 +18,7 @@ package com.gitblit.utils; import org.jsoup.Jsoup; import org.jsoup.nodes.Document; import org.jsoup.safety.Cleaner; -import org.jsoup.safety.Whitelist; +import org.jsoup.safety.Safelist; import com.google.inject.Inject; import com.google.inject.Singleton; @@ -38,7 +38,7 @@ public class JSoupXssFilter implements XssFilter { @Inject public JSoupXssFilter() { - none = new Cleaner(Whitelist.none()); + none = new Cleaner(Safelist.none()); relaxed = new Cleaner(getRelaxedWhiteList()); } @@ -64,8 +64,8 @@ public class JSoupXssFilter implements XssFilter { * https://github.com/github/markup/tree/master#html-sanitization * @return a loose HTML whitelist */ - protected Whitelist getRelaxedWhiteList() { - return new Whitelist() + protected Safelist getRelaxedWhiteList() { + return new Safelist() .addTags( "a", "b", "blockquote", "br", "caption", "cite", "code", "col", "colgroup", "dd", "del", "div", "dl", "dt", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", -- cgit v1.2.3 From d2a3322b280c408184cfe8618375b47cef09657a Mon Sep 17 00:00:00 2001 From: Florian Zschocke Date: Tue, 31 Oct 2023 19:07:35 +0100 Subject: dep: Update slf4j to 1.7.36 and switch from log4j1 to reload4j Replace log4j 1.2.17 with reload4j 1.2.25. log4j 1.x was caught in the fire of the Log4Shell vulnerability, even though the 1.x line was not affected by the vulnerability. Still, this looks bad when it shows up in security scanners even though it doesn't mean it has the Log4Shell vulnerability. Switch to reload4j instead. This is a drop-in replacement of log4j. Actually, it is log4j rebooted by the same author. The reload4j 1.x line fixes security issues that have since surfaced. At the same time we update to the latest slf4j version, which also switched to reload4j for the log4j12 line. --- .classpath | 6 +++--- build.moxie | 6 +++--- gitblit.iml | 18 +++++++++--------- 3 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.classpath b/.classpath index 6dd5eace..823a61f2 100644 --- a/.classpath +++ b/.classpath @@ -18,9 +18,9 @@ - - - + + + diff --git a/build.moxie b/build.moxie index e410855b..efbf7d5e 100644 --- a/build.moxie +++ b/build.moxie @@ -106,7 +106,7 @@ repositories: central, eclipse-snapshots, eclipse, gitblit # Convenience properties for dependencies properties: { jetty.version : 9.4.49.v20220914 - slf4j.version : 1.7.29 + slf4j.version : 1.7.36 wicket.version : 1.4.22 lucene.version : 5.5.2 jgit.version : 4.11.9.201909030838-r @@ -137,9 +137,9 @@ dependencies: - compile 'com.google.inject.extensions:guice-servlet:${guice-servlet.version}' :war - compile 'com.google.guava:guava:32.1.3-jre' :war :fedclient - compile 'com.intellij:annotations:12.0' :war -- compile 'log4j:log4j:1.2.17' :war :fedclient :manager +- compile 'ch.qos.reload4j:reload4j:1.2.25' :war :fedclient :manager - compile 'org.slf4j:slf4j-api:${slf4j.version}' :war :fedclient :manager -- compile 'org.slf4j:slf4j-log4j12:${slf4j.version}' :war :fedclient :manager +- compile 'org.slf4j:slf4j-reload4j:${slf4j.version}' :war :fedclient :manager - compile 'com.sun.mail:javax.mail:1.5.6' :war - compile 'javax.servlet:javax.servlet-api:3.1.0' :fedclient - compile 'org.eclipse.jetty:jetty-servlet:${jetty.version}' @jar diff --git a/gitblit.iml b/gitblit.iml index 85756ae8..20b42cee 100644 --- a/gitblit.iml +++ b/gitblit.iml @@ -145,35 +145,35 @@ - + - + - + - + - + - + - + - + - + -- cgit v1.2.3 From b1f7c7c6725b023047b301d9b2d377c20d4f0997 Mon Sep 17 00:00:00 2001 From: Florian Zschocke Date: Tue, 31 Oct 2023 19:17:54 +0100 Subject: dep: Update Apache Tika to 1.28.5 --- .classpath | 2 +- build.moxie | 2 +- gitblit.iml | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.classpath b/.classpath index 823a61f2..0181995b 100644 --- a/.classpath +++ b/.classpath @@ -94,7 +94,7 @@ - + diff --git a/build.moxie b/build.moxie index efbf7d5e..057c1c9d 100644 --- a/build.moxie +++ b/build.moxie @@ -190,7 +190,7 @@ dependencies: - compile 'commons-codec:commons-codec:1.9' :war - compile 'redis.clients:jedis:2.6.2' :war - compile 'ro.fortsoft.pf4j:pf4j:0.9.0' :war -- compile 'org.apache.tika:tika-core:1.5' :war +- compile 'org.apache.tika:tika-core:1.28.5' :war - compile 'org.jsoup:jsoup:1.16.2' :war - compile 'com.sun.activation:javax.activation:1.2.0' :war :manager :fedclient - test 'junit:junit:4.12' diff --git a/gitblit.iml b/gitblit.iml index 20b42cee..0761644b 100644 --- a/gitblit.iml +++ b/gitblit.iml @@ -977,13 +977,13 @@ - + - + - + -- cgit v1.2.3