Upgrade XStream to 1.4.20 (#3446)

This addresses CVE-2022-40151 and CVE-2022-41966, see:

https://x-stream.github.io/changes.html#1.4.20

This version also fixes an issue with closing streams so the workaround in GenerateDefaultTranslationsMojoTest is no longer needed.

Signed-off-by: Wouter Born <github@maindrain.net>
This commit is contained in:
Wouter Born
2023-03-12 12:22:33 +01:00
committed by GitHub
parent 95e04fccbd
commit 0c792ec89a
28 changed files with 51 additions and 73 deletions
+1 -1
View File
@@ -29,7 +29,7 @@
<dependency>
<groupId>com.thoughtworks.xstream</groupId>
<artifactId>xstream</artifactId>
<version>1.4.19</version>
<version>1.4.20</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
@@ -105,15 +105,8 @@ public class GenerateDefaultTranslationsMojoTest {
}
@AfterEach
public void afterEach() {
try {
Files.walk(tempPath).sorted(Comparator.reverseOrder()).map(Path::toFile).forEach(File::delete);
} catch (IOException e) {
// XStream does not close the HierarchicalStreamReader created in XStream.fromXML(URL)
// which causes issues when deleting the temporary path on Windows.
// See: https://github.com/x-stream/xstream/pull/287
tempPath.toFile().deleteOnExit();
}
public void afterEach() throws IOException {
Files.walk(tempPath).sorted(Comparator.reverseOrder()).map(Path::toFile).forEach(File::delete);
}
private void assertSameProperties(Path expectedPath, Path actualPath) throws IOException {