Browse Source

安全漏洞:
1.MyBatis本版过低:3.5.3->3.5.6
2.spring-web版本低:Spring boot版本2.2.1.RELEASE->2.2.3.RELEASE
3.Apache POI 版本过低:3.17->4.1.2
4.fastjson 版本过低:1.2.60->1.2.75
5.xstream 版本过低:1.4.11.1->1.4.18

lijie 3 years ago
parent
commit
62d8b768af
5 changed files with 27 additions and 13 deletions
  1. 8 2
      gradle.properties
  2. 4 2
      meiku/build.gradle
  3. 5 3
      revit-algorithm/build.gradle
  4. 6 3
      scanbuilding/build.gradle
  5. 4 3
      scheduler/build.gradle

+ 8 - 2
gradle.properties

@@ -63,10 +63,16 @@ JUNIT_VERSION=4.3.1
 MYBATIS_VERSION=1.3.2
 # https://mvnrepository.com/artifact/mysql/mysql-connector-java
 MYSQL_VERSION=8.0.12
+# https://mvnrepository.com/artifact/com.alibaba/fastjson
+FAST_JSON_VERSION=1.2.75
+# https://mvnrepository.com/artifact/com.alibaba/fastjson
+MYBATIS_CORE_VERSION=3.5.6
+# https://mvnrepository.com/artifact/com.alibaba/fastjson
+XSTREAM_VERSION=1.4.18
 # https://mvnrepository.com/artifact/javax.persistence/persistence-api
 PERSISTENCE_VERSION=1.0.2
 # https://mvnrepository.com/artifact/org.apache.poi/poi-ooxml
-POI_VERSION=4.0.1
+POI_VERSION=4.1.2
 # https://mvnrepository.com/artifact/org.slf4j/slf4j-api
 SLF4J_VERSION=1.7.25
 ## https://mvnrepository.com/artifact/org.springframework.boot/spring-boot-starter-web
@@ -104,7 +110,7 @@ PROTOBUF_VERSION = 3.11.1
 # https://mvnrepository.com/artifact/com.google.protobuf/protobuf-gradle-plugin
 PROTOBUF_GRADLE_VERSION = 0.8.10
 # https://mvnrepository.com/artifact/org.springframework.boot/spring-boot-starter-web
-SPRING_BOOT_VERSION = 2.2.1.RELEASE
+SPRING_BOOT_VERSION = 2.2.3.RELEASE
 # https://mvnrepository.com/artifact/org.springframework.cloud/spring-cloud-starter-eureka-server
 SPRING_CLOUD_VERSION = 1.4.7.RELEASE
 # https://mvnrepository.com/artifact/org.springframework.cloud/spring-cloud-starter-config

+ 4 - 2
meiku/build.gradle

@@ -82,9 +82,11 @@ dependencies {
 
     ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
     // persagy依赖
-    compile group: "cn.sagacloud", name: "saga-kotlin-base", version: SYBOTAN_KOTLIN_VERSION
+    compile group: "com.alibaba", name: "fastjson", version: FAST_JSON_VERSION
+    compile(group: "cn.sagacloud", name: "saga-kotlin-base", version: SYBOTAN_KOTLIN_VERSION) {exclude group: 'com.alibaba',module:'fastjson'}
     compile group: "cn.sagacloud", name: "saga-kotlin-database", version: SYBOTAN_KOTLIN_VERSION
-    compile group: "cn.sagacloud", name: "saga-kotlin-mybatis", version: SYBOTAN_KOTLIN_VERSION
+    compile(group: "cn.sagacloud", name: "saga-kotlin-mybatis", version: SYBOTAN_KOTLIN_VERSION) {exclude group: 'org.mybatis',module:'mybatis'}
+    compile group: "org.mybatis", name: "mybatis", version: MYBATIS_CORE_VERSION
     compile group: "cn.sagacloud", name: "saga-kotlin-mysql", version: SYBOTAN_KOTLIN_VERSION
     compile group: "cn.sagacloud", name: "saga-service-base", version: SYBOTAN_SERVICE_VERSION
     compile group: "cn.sagacloud", name: "saga-service-mybatis", version: SYBOTAN_SERVICE_VERSION

+ 5 - 3
revit-algorithm/build.gradle

@@ -83,9 +83,11 @@ dependencies {
 //    compile group: "com.sybotan", name: "sybotan-service-mybatis", version: SYBOTAN_SERVICE_VERSION
 
     // 带隐性数据库接口
-    compile group: "cn.sagacloud", name: "saga-kotlin-base", version: SYBOTAN_KOTLIN_VERSION
+    compile group: "com.alibaba", name: "fastjson", version: FAST_JSON_VERSION
+    compile(group: "cn.sagacloud", name: "saga-kotlin-base", version: SYBOTAN_KOTLIN_VERSION) {exclude group: 'com.alibaba',module:'fastjson'}
     compile group: "cn.sagacloud", name: "saga-kotlin-database", version: SYBOTAN_KOTLIN_VERSION
-    compile group: "cn.sagacloud", name: "saga-kotlin-mybatis", version: SYBOTAN_KOTLIN_VERSION
+    compile(group: "cn.sagacloud", name: "saga-kotlin-mybatis", version: SYBOTAN_KOTLIN_VERSION) {exclude group: 'org.mybatis',module:'mybatis'}
+    compile group: "org.mybatis", name: "mybatis", version: MYBATIS_CORE_VERSION
     compile group: "cn.sagacloud", name: "saga-kotlin-mysql", version: SYBOTAN_KOTLIN_VERSION
     compile group: "cn.sagacloud", name: "saga-service-base", version: SYBOTAN_SERVICE_VERSION
     compile group: "cn.sagacloud", name: "saga-service-mybatis", version: SYBOTAN_SERVICE_VERSION
@@ -103,7 +105,7 @@ dependencies {
     // https://mvnrepository.com/artifact/commons-fileupload/commons-fileupload
     compile 'commons-fileupload:commons-fileupload:1.3.1'
     // https://mvnrepository.com/artifact/com.alibaba/fastjson
-    compile group: 'com.alibaba', name: 'fastjson', version: '1.2.56'
+    // compile group: 'com.alibaba', name: 'fastjson', version: '1.2.56'
 
 //    // anko依赖
 //    // https://mvnrepository.com/artifact/org.jetbrains.anko/anko-commons

+ 6 - 3
scanbuilding/build.gradle

@@ -92,9 +92,11 @@ dependencies {
 
     compile group: "com.persagy", name: "persagy-kotlin-base", version: PERSAGY_KOTLIN_VERSION
     compile group: "com.persagy", name: "persagy-kotlin-database", version: PERSAGY_KOTLIN_VERSION
-    compile group: "com.persagy", name: "persagy-kotlin-mybatis", version: PERSAGY_KOTLIN_VERSION
+    compile (group: "com.persagy", name: "persagy-kotlin-mybatis", version: PERSAGY_KOTLIN_VERSION) {exclude group: 'org.mybatis',module:'mybatis'}
+    compile group: "org.mybatis", name: "mybatis", version: MYBATIS_CORE_VERSION
     compile group: "com.persagy", name: "persagy-kotlin-mysql", version: PERSAGY_KOTLIN_VERSION
-    compile group: "com.persagy", name: "persagy-service-base", version: PERSAGY_SERVICE_VERSION_LAST
+    compile(group: "com.persagy", name: "persagy-service-base", version: PERSAGY_SERVICE_VERSION_LAST) {exclude group: 'com.alibaba',module:'fastjson'}
+    compile group: "com.alibaba", name: "fastjson", version: FAST_JSON_VERSION
     compile group: "com.persagy", name: "persagy-service-mybatis", version: PERSAGY_SERVICE_VERSION
     compile group: "com.persagy", name: "persagy-service-mysql", version: PERSAGY_SERVICE_VERSION
     compile group: "com.persagy", name: "dmp-digital-starter", version: DIGITAL_START_VERSION
@@ -107,7 +109,8 @@ dependencies {
     compile 'com.google.code.gson:gson:2.8.0'
 
     // spring cloud 依赖
-    compile group: 'org.springframework.cloud', name: 'spring-cloud-starter-netflix-eureka-client', version:  SPRING_CLOUD_CONFIG_VERSION
+    compile(group: 'org.springframework.cloud', name: 'spring-cloud-starter-netflix-eureka-client', version:  SPRING_CLOUD_CONFIG_VERSION){exclude group: 'com.thoughtworks.xstream',module:'xstream'}
+    compile(group: 'com.thoughtworks.xstream', name: 'xstream', version:  XSTREAM_VERSION)
     // Log 工具
     compile group: "org.projectlombok", name: "lombok", version: LOMBOK_VERSION
 

+ 4 - 3
scheduler/build.gradle

@@ -86,7 +86,8 @@ dependencies {
     // Sybotan依赖
     compile group: "cn.sagacloud", name: "saga-kotlin-base", version: SYBOTAN_KOTLIN_VERSION
     compile group: "cn.sagacloud", name: "saga-kotlin-database", version: SYBOTAN_KOTLIN_VERSION
-    compile group: "cn.sagacloud", name: "saga-kotlin-mybatis", version: SYBOTAN_KOTLIN_VERSION
+    compile(group: "cn.sagacloud", name: "saga-kotlin-mybatis", version: SYBOTAN_KOTLIN_VERSION) {exclude group: 'org.mybatis',module:'mybatis'}
+    compile group: "org.mybatis", name: "mybatis", version: MYBATIS_CORE_VERSION
     compile group: "cn.sagacloud", name: "saga-kotlin-mysql", version: SYBOTAN_KOTLIN_VERSION
     compile group: "cn.sagacloud", name: "saga-service-base", version: SYBOTAN_SERVICE_VERSION
     compile group: "cn.sagacloud", name: "saga-service-mybatis", version: SYBOTAN_SERVICE_VERSION
@@ -104,7 +105,7 @@ dependencies {
 //    compile group: 'com.google.protobuf', name: 'protobuf-java', version: '3.7.0'
 
     // https://mvnrepository.com/artifact/org.mybatis/mybatis
-    compile group: 'org.mybatis', name: 'mybatis', version: '3.5.0'
+    //compile group: 'org.mybatis', name: 'mybatis', version: '3.5.0'
 
     // https://mvnrepository.com/artifact/org.mybatis/mybatis-guice
     compile group: 'org.mybatis', name: 'mybatis-guice', version: '3.10'
@@ -116,7 +117,7 @@ dependencies {
     // https://mvnrepository.com/artifact/log4j/log4j
     compile group: 'log4j', name: 'log4j', version: '1.2.17'
     // https://mvnrepository.com/artifact/com.alibaba/fastjson
-    compile group: 'com.alibaba', name: 'fastjson', version: '1.2.56'
+    compile group: 'com.alibaba', name: 'fastjson', version: '1.2.75'
 
     compile group: 'org.slf4j', name: 'slf4j-api', version:'1.7.25'