Skip to content

Commit 3ae497f

Browse files
thehungryturnipthehungryturnip
authored
fix(deps): Bump vulnerable dependencies to address CVEs (#455)
Bump jackson 2.14.1→2.17.2 (4 High CVEs), commons-lang3 3.9→3.14.0 (1 High), aws-java-sdk-core/sts/kms 1.12.367→1.12.770 (1 High via ion-java), aws-lambda-java-log4j2 1.5.1→1.6.0 (2 High), aws-encryption-sdk-java 2.2.0→2.4.1 (3 Medium via bouncycastle), spotless-maven-plugin 2.28.0→2.40.0 (2 High via jgit, build-time). Also fixes Jackson 2.17 deprecations (getCurrentLocation→currentLocation, getCurrentName→currentName) and re-enables INCLUDE_SOURCE_IN_LOCATION to preserve existing error message format for customers. Closes #438
1 parent 63f638e commit 3ae497f

4 files changed

Lines changed: 19 additions & 18 deletions

File tree

‎pom.xml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<modelVersion>4.0.0</modelVersion>
44
<groupId>software.amazon.cloudformation</groupId>
55
<artifactId>aws-cloudformation-rpdk-java-plugin</artifactId>
6-
<version>2.2.4</version>
6+
<version>2.2.5</version>
77
<name>AWS CloudFormation RPDK Java Plugin</name>
88
<description>The CloudFormation Resource Provider Development Kit (RPDK) allows you to author your own resource providers that can be used by CloudFormation. This plugin library helps to provide runtime bindings for the execution of your providers by CloudFormation.
99
</description>
@@ -40,11 +40,11 @@
4040
<awssdk.version>2.19.0</awssdk.version>
4141
<checkstyle.version>8.36.2</checkstyle.version>
4242
<commons-io.version>2.14.0</commons-io.version>
43-
<jackson.version>2.14.1</jackson.version>
43+
<jackson.version>2.17.2</jackson.version>
4444
<maven-checkstyle-plugin.version>3.1.1</maven-checkstyle-plugin.version>
4545
<mockito.version>3.12.4</mockito.version>
4646
<spotbugs.version>4.5.3.0</spotbugs.version>
47-
<spotless.version>2.28.0</spotless.version>
47+
<spotless.version>2.40.0</spotless.version>
4848
<maven-javadoc-plugin.version>3.2.0</maven-javadoc-plugin.version>
4949
<maven-source-plugin.version>3.2.1</maven-source-plugin.version>
5050
</properties>
@@ -118,7 +118,7 @@
118118
<dependency>
119119
<groupId>com.amazonaws</groupId>
120120
<artifactId>aws-java-sdk-core</artifactId>
121-
<version>1.12.367</version>
121+
<version>1.12.770</version>
122122
</dependency>
123123
<!-- https://mvnrepository.com/artifact/com.amazonaws/aws-lambda-java-core -->
124124
<dependency>
@@ -130,19 +130,19 @@
130130
<dependency>
131131
<groupId>com.amazonaws</groupId>
132132
<artifactId>aws-lambda-java-log4j2</artifactId>
133-
<version>1.5.1</version>
133+
<version>1.6.0</version>
134134
</dependency>
135135
<!--https://mvnrepository.com/artifact/com.amazonaws/aws-encryption-sdk-java -->
136136
<dependency>
137137
<groupId>com.amazonaws</groupId>
138138
<artifactId>aws-encryption-sdk-java</artifactId>
139-
<version>2.2.0</version>
139+
<version>2.4.1</version>
140140
</dependency>
141141
<!-- https://mvnrepository.com/artifact/com.amazonaws/aws-java-sdk-sts -->
142142
<dependency>
143143
<groupId>com.amazonaws</groupId>
144144
<artifactId>aws-java-sdk-sts</artifactId>
145-
<version>1.12.368</version>
145+
<version>1.12.770</version>
146146
</dependency>
147147
<!-- https://mvnrepository.com/artifact/com.google.code.findbugs/annotations -->
148148
<dependency>
@@ -154,7 +154,7 @@
154154
<dependency>
155155
<groupId>com.amazonaws</groupId>
156156
<artifactId>aws-java-sdk-kms</artifactId>
157-
<version>1.12.368</version>
157+
<version>1.12.770</version>
158158
</dependency>
159159
<!-- AWS Java SDK v2 Dependencies -->
160160
<dependency>
@@ -206,7 +206,7 @@
206206
<dependency>
207207
<groupId>org.apache.commons</groupId>
208208
<artifactId>commons-lang3</artifactId>
209-
<version>3.9</version>
209+
<version>3.14.0</version>
210210
</dependency>
211211
<!-- https://mvnrepository.com/artifact/org.apache.commons/commons-collections4 -->
212212
<dependency>

‎src/main/java/software/amazon/cloudformation/proxy/StdCallbackContext.java‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -151,8 +151,7 @@ private Map<String, Object> readMap(Class<?> type, JsonParser p, Deserialization
151151
}
152152
return value;
153153
} catch (InstantiationException | IllegalAccessException | NoSuchMethodException | InvocationTargetException e) {
154-
throw new JsonMappingException(p, "Can not create empty map for class " + type + " @ " + p.getCurrentLocation(),
155-
e);
154+
throw new JsonMappingException(p, "Can not create empty map for class " + type + " @ " + p.currentLocation(), e);
156155
}
157156
}
158157

@@ -237,8 +236,8 @@ private Object readCollection(Class<?> type, JsonParser p, DeserializationContex
237236
} while (p.nextToken() != JsonToken.END_ARRAY);
238237
return value;
239238
} catch (IllegalAccessException | InstantiationException | NoSuchMethodException | InvocationTargetException e) {
240-
throw new IOException("Can not create empty constructor collection class " + type + " @ "
241-
+ p.getCurrentLocation(), e);
239+
throw new IOException("Can not create empty constructor collection class " + type + " @ " + p.currentLocation(),
240+
e);
242241
}
243242
}
244243
}

‎src/main/java/software/amazon/cloudformation/proxy/aws/SdkPojoDeserializer.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ private SdkPojo readPojo(final SdkPojo pojo, JsonParser p, DeserializationContex
8282
* if (next != JsonToken.FIELD_NAME) { throw new JsonMappingException(p,
8383
* "Expecting to get FIELD_NAME token, got " + next); }
8484
*/
85-
String fieldName = p.getCurrentName();
85+
String fieldName = p.currentName();
8686
SdkField<?> sdkField = fieldMap.get(fieldName);
8787
if (sdkField == null) {
8888
if (codec.isEnabled(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)) {
@@ -187,7 +187,7 @@ private Map<String, Object> readMap(SdkField<?> field, JsonParser p, Deserializa
187187
if (p.currentToken() != JsonToken.FIELD_NAME) {
188188
throw new JsonMappingException(p, "Expecting String key for map got " + p.currentToken());
189189
}
190-
String fieldName = p.getCurrentName();
190+
String fieldName = p.currentName();
191191
// progress to next token
192192
p.nextToken();
193193
value.put(fieldName, readObject(valueType, p, ctxt));
@@ -229,7 +229,7 @@ private Document readDocument(SdkField<?> field, JsonParser p, DeserializationCo
229229
case START_OBJECT:
230230
MapBuilder builder = Document.mapBuilder();
231231
while (p.nextToken() != JsonToken.END_OBJECT) {
232-
String fieldName = p.getCurrentName();
232+
String fieldName = p.currentName();
233233
p.nextToken();
234234
builder.putDocument(fieldName, readDocument(field, p, ctxt));
235235
}

‎src/main/java/software/amazon/cloudformation/resource/Serializer.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,8 @@ public class Serializer {
5353
static {
5454
STRICT_OBJECT_MAPPER = JsonMapper.builder().configure(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS, true)
5555
.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, true)
56-
.configure(MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES, true).build();
56+
.configure(MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES, true)
57+
.configure(com.fasterxml.jackson.core.StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION, true).build();
5758
STRICT_OBJECT_MAPPER.setSerializationInclusion(JsonInclude.Include.NON_ABSENT);
5859
STRICT_OBJECT_MAPPER.setSerializationInclusion(JsonInclude.Include.NON_DEFAULT);
5960
STRICT_OBJECT_MAPPER.setSerializationInclusion(JsonInclude.Include.NON_EMPTY);
@@ -74,7 +75,8 @@ public class Serializer {
7475
static {
7576
OBJECT_MAPPER = JsonMapper.builder().configure(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS, true)
7677
.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false)
77-
.configure(MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES, true).build();
78+
.configure(MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES, true)
79+
.configure(com.fasterxml.jackson.core.StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION, true).build();
7880
OBJECT_MAPPER.setSerializationInclusion(JsonInclude.Include.NON_ABSENT);
7981
OBJECT_MAPPER.setSerializationInclusion(JsonInclude.Include.NON_DEFAULT);
8082
OBJECT_MAPPER.setSerializationInclusion(JsonInclude.Include.NON_EMPTY);

0 commit comments

Comments
 (0)