From 8aefc15d0421db4136b28f0f3609cd3d3aecb27e Mon Sep 17 00:00:00 2001
From: Jon Roberts <jon.roberts@curavihealth.com>
Date: Wed, 3 May 2023 11:27:19 -0400
Subject: [PATCH] Updates dependecies to fix critical security vunerabilties.
 Updates some package names to use the new names.

---
 pom.xml                                       | 65 ++++++++++++++-----
 .../client/impl/DefaultInterFAXClient.java    | 23 ++++---
 .../client/impl/JerseyRequestExecutor.java    |  4 +-
 .../impl/DefaultInterFAXClientTest.java       |  4 +-
 4 files changed, 67 insertions(+), 29 deletions(-)

diff --git a/pom.xml b/pom.xml
index 3417602..f7b1262 100644
--- a/pom.xml
+++ b/pom.xml
@@ -55,23 +55,39 @@
         <dependency>
             <groupId>org.glassfish.jersey.core</groupId>
             <artifactId>jersey-client</artifactId>
-            <version>2.23.2</version>
+            <version>3.1.1</version>
         </dependency>
         <dependency>
             <groupId>org.glassfish.jersey.media</groupId>
             <artifactId>jersey-media-multipart</artifactId>
-            <version>2.23.2</version>
+            <version>3.1.1</version>
         </dependency>
         <dependency>
             <groupId>org.glassfish.jersey.media</groupId>
             <artifactId>jersey-media-json-jackson</artifactId>
-            <version>2.23.2</version>
+            <version>3.1.1</version>
+        </dependency>
+        <dependency>
+            <groupId>org.glassfish.jersey.inject</groupId>
+            <artifactId>jersey-hk2</artifactId>
+            <version>3.1.1</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-annotations</artifactId>
-            <version>2.8.3</version>
+            <version>2.15.0</version>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-core</artifactId>
+            <version>2.15.0</version>
         </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-databind</artifactId>
+            <version>2.15.0</version>
+        </dependency>
+
         <dependency>
             <groupId>org.slf4j</groupId>
             <artifactId>slf4j-api</artifactId>
@@ -85,40 +101,40 @@
         <dependency>
             <groupId>com.google.guava</groupId>
             <artifactId>guava</artifactId>
-            <version>24.1.1-jre</version>
+            <version>30.0-jre</version>
         </dependency>
         <dependency>
             <groupId>junit</groupId>
             <artifactId>junit</artifactId>
-            <version>4.12</version>
+            <version>4.13.1</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.slf4j</groupId>
             <artifactId>slf4j-log4j12</artifactId>
-            <version>1.7.21</version>
+            <version>1.7.36</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>com.github.tomakehurst</groupId>
-            <artifactId>wiremock</artifactId>
-            <version>2.1.12</version>
+            <artifactId>wiremock-jre8</artifactId>
+            <version>2.35.0</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.dataformat</groupId>
             <artifactId>jackson-dataformat-yaml</artifactId>
-            <version>2.7.6</version>
+            <version>2.15.0</version>
         </dependency>
         <dependency>
             <groupId>org.apache.tika</groupId>
             <artifactId>tika-core</artifactId>
-            <version>1.22</version>
+            <version>2.5.0</version>
         </dependency>
         <dependency>
             <groupId>org.apache.httpcomponents</groupId>
             <artifactId>httpclient</artifactId>
-            <version>4.5.2</version>
+            <version>4.5.13</version>
         </dependency>
         <dependency>
             <groupId>javax.xml.bind</groupId>
@@ -128,13 +144,30 @@
         <dependency>
             <groupId>org.sonatype.plugins</groupId>
             <artifactId>nexus-staging-maven-plugin</artifactId>
-            <version>1.6.8</version>
+            <version>1.6.13</version>
         </dependency>
         <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-release-plugin -->
         <dependency>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-release-plugin</artifactId>
-            <version>3.0.0-M1</version>
+            <version>3.0.0</version>
+        </dependency>
+
+        <!-- update ssd for the maven-release-plugin critical vulnerability -->
+        <dependency>
+            <groupId>org.apache.sshd</groupId>
+            <artifactId>sshd-common</artifactId>
+            <version>2.9.2</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.sshd</groupId>
+            <artifactId>sshd-osgi</artifactId>
+            <version>2.9.2</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.sshd</groupId>
+            <artifactId>sshd-core</artifactId>
+            <version>2.9.2</version>
         </dependency>
 
     </dependencies>
@@ -146,8 +179,8 @@
                 <artifactId>maven-compiler-plugin</artifactId>
                 <version>3.1</version>
                 <configuration>
-                    <source>1.8</source>
-                    <target>1.8</target>
+                    <source>9</source>
+                    <target>9</target>
                     <encoding>UTF-8</encoding>
                 </configuration>
             </plugin>
diff --git a/src/main/java/net/interfax/rest/client/impl/DefaultInterFAXClient.java b/src/main/java/net/interfax/rest/client/impl/DefaultInterFAXClient.java
index 3d8630c..b85f51f 100644
--- a/src/main/java/net/interfax/rest/client/impl/DefaultInterFAXClient.java
+++ b/src/main/java/net/interfax/rest/client/impl/DefaultInterFAXClient.java
@@ -28,19 +28,20 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.ws.rs.client.Client;
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.WebTarget;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.UriBuilder;
+import jakarta.ws.rs.client.Client;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.WebTarget;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.UriBuilder;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.URI;
 import java.net.URISyntaxException;
+import java.nio.file.Files;
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.List;
@@ -336,8 +337,8 @@ public APIResponse uploadDocument(final File fileToUpload, final Optional<Docume
                                                     .create(apiResponse.getHeaders().get("Location").get(0).toString())
                                                     .getPath();
 
-                InputStream inputStream = new FileInputStream(fileToUpload);
-                byte[] bytes = IOUtils.toByteArray(inputStream);
+
+                byte[] bytes = Files.readAllBytes(fileToUpload.toPath());
                 int chunkSize = 1024*1024;
                 byte[][] chunks = ArrayUtil.chunkArray(bytes, chunkSize);
                 int bytesUploaded = 0;
@@ -640,7 +641,9 @@ private byte[] getFaxImage(String path) throws UnsuccessfulStatusCodeException {
             response = client.target(uri).request().get();
             if (response.getStatus() == 200) {
                 InputStream inputStream = response.readEntity(InputStream.class);
-                responseBytes = IOUtils.toByteArray(inputStream);
+                responseBytes = inputStream.readAllBytes();
+
+
                 inputStream.close();
             } else {
                 String responseBody = null;
diff --git a/src/main/java/net/interfax/rest/client/impl/JerseyRequestExecutor.java b/src/main/java/net/interfax/rest/client/impl/JerseyRequestExecutor.java
index 24f6b41..d3970c6 100644
--- a/src/main/java/net/interfax/rest/client/impl/JerseyRequestExecutor.java
+++ b/src/main/java/net/interfax/rest/client/impl/JerseyRequestExecutor.java
@@ -1,7 +1,7 @@
 package net.interfax.rest.client.impl;
 
-import javax.ws.rs.client.WebTarget;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.WebTarget;
+import jakarta.ws.rs.core.Response;
 
 @FunctionalInterface
 public interface JerseyRequestExecutor {
diff --git a/src/test/java/net/interfax/rest/client/impl/DefaultInterFAXClientTest.java b/src/test/java/net/interfax/rest/client/impl/DefaultInterFAXClientTest.java
index c928b4d..1c0583c 100644
--- a/src/test/java/net/interfax/rest/client/impl/DefaultInterFAXClientTest.java
+++ b/src/test/java/net/interfax/rest/client/impl/DefaultInterFAXClientTest.java
@@ -17,6 +17,7 @@
 import net.interfax.rest.client.domain.enums.Sharing;
 import net.interfax.rest.client.exception.UnsuccessfulStatusCodeException;
 import org.junit.Assert;
+import org.junit.Ignore;
 import org.junit.Rule;
 import org.junit.Test;
 
@@ -77,6 +78,7 @@ public void testSendMultipleFilesAsFax() throws Exception {
         Assert.assertEquals(201, apiResponse.getStatusCode());
     }
 
+    @Ignore  //don't run as it makes an actual call to the API
     @Test
     public void testSendMultipleFilesAsFaxWithOptions() throws Exception {
 
@@ -95,7 +97,7 @@ public void testSendMultipleFilesAsFaxWithOptions() throws Exception {
         Assert.assertEquals(201, apiResponse.getStatusCode());
 
     }
-    
+
     @Test
     public void testSendMultipleInputStreamsAsFax() throws Exception {