[MSHARED-848] Code Improvement in ReaderFactory to get rid of commons-io dependency

[jira-importer]

Karl Heinz Marbaise opened MSHARED-848 and commented

Currently the dependency to:

<dependency>
  <groupId>commons-io</groupId>
  <artifactId>commons-io</artifactId>
  <version>2.6</version>
</dependency>

is only needed within the class ReaderFactory which imports org.apache.commons.io.input.XmlStreamReader.

The question: Can that be replaced with something different? In consequence we could get rid of the dependency on commons-io.

---

Affects: maven-shared-utils-3.3.3

Issue Links:

• MSHARED-899 Upgrade commons-io to 2.7

Remote Links:

• GitHub Pull Request #59
  

0 votes, 5 watchers

[jira-importer]

Elliotte Rusty Harold commented

This would require reimplementing org.apache.commons.io.input.XmlStreamReader or removing newXmlReader from this class. Just maybe we could do the latter if we first deprecated this and suggested clients depend on org.apache.commons.io.input.XmlStreamReader directly.

[jira-importer]

Hervé Boutemy commented

Elliotte Rusty Harold with the merged PR, do you consider this issue done or not?
then please update this issue accordingly: close or change fix version

[jira-importer]

Elliotte Rusty Harold commented

not done yet. It's multireleaase if not won't fix.

[jira-importer]

Richard O'Sullivan commented

Apache Commons IO before 2.7 is vulnerable to https://nvd.nist.gov/vuln/detail/CVE-2021-29425, Improper Limitation of a Pathname to a Restricted Directory". The NIST NVD Severity Score is 4.8, MEDIUM. Since the latest Long-Term Support (LTS) version of Java is now V17, the update to commons-io 2.7 or higher or removal of same should be reconsidered.

[jira-importer]

Elliotte Rusty Harold commented

commons-io has been upgraded to 2.11 so the CVE is no longer an issue. The underlying issue remains.

[jira-importer]

Elliotte Rusty Harold commented

Method is deprecated. Will evntually remove it instead.